TradeWiz drain: 20,800 wallets, two-thirds emptied after the warning

TradeWiz is a Solana trading bot. On 30 September at 10:41 AM ET it posted that "a limited private key exposure occurred in the SOL PVP private key export feature", told users to stop using their SOL PVP wallets and promised to compensate every loss. By then the drain was more than an hour old. We traced it on-chain.

One address, 6mmi…88Hj, collected the SOL. Each drained wallet signed its own transfer to it, which only someone holding that wallet's private key can do. It took 3,523 SOL, about $412,000, from about 20,800 wallets. That matches the count in the investigation SolanaFloor shared. The earlier "$375,000 from 9,580 wallets" was a snapshot taken while the drain was still running.

It started two days early. At 2:40 PM ET on 28 September, the same address drained 20 wallets of 34 SOL, a test run. The mass drain began at 9:25 AM ET on 30 September and took 7,093 wallets in the 76 minutes before TradeWiz's notice. After the notice, it kept going for two more hours: 13,687 more wallets and 1,920 SOL, until 12:44 PM ET. The drain was fast enough that most users couldn't have reacted in time.

The money hasn't gone far. As of 1 October, the collector holds 2,112 SOL and a second attacker wallet, 7iFX…Mhsc, holds 1,599 SOL: about 3,711 SOL, or roughly $434,000, still on-chain where anyone can see it. TradeWiz says police have contacted the exchanges that received stolen funds; the two wallets above still hold more SOL than the drain took.

TradeWiz says the first refunds went out on 30 September and that all verified losses will be paid. We can't check that yet: refunds would go to users' new wallets, not the drained ones. On 1 October we asked TradeWiz publicly, under its refunds post, which wallet the refunds are paid from, so they can be tracked on-chain. We'll add its answer. If you were refunded, or weren't, we'd like to hear from you at @trenchbookapp.

If you used TradeWiz's SOL PVP: treat that wallet as burned. Anyone holding its key can take whatever lands in it, and since 4:54 AM ET on 1 October another address, 2J9x…7kKj, has been moving small amounts of SOL out of more than 300 of the drained wallets. Ask for any refund to be sent to a new wallet you created yourself, outside TradeWiz. Talk only to the support account TradeWiz names in its own posts (@TradeWiz_MoonQ), and ignore anyone who DMs you offering to recover funds: victims of a public drain are the next target.