FILEThe trenchbook · crew · 4 wallets on file

The TradeWiz SOL PVP drainer

File opened Oct 5, 2026 · updated Oct 5, 2026

trenchbook.app · The TradeWiz SOL PVP drainer · updated Oct 5, 2026 · trenchbook.app/file/tradewiz-drainer

The wallets that drained about 20,800 TradeWiz SOL PVP wallets on 28 and 30 September, and the route the money has taken since: USDC on Solana, and USDT on Tron.

Named for what it did on the chain. Who controls these wallets is only stated where a published piece establishes it.

Who is the TradeWiz SOL PVP drainer?

Someone holding the private keys to TradeWiz's SOL PVP wallets emptied about 20,800 of them into one collector wallet on 28 and 30 September: 3,523 SOL, most of it after TradeWiz's warning. A second wallet has swept leftovers from the drained wallets since 1 October.

Since then the money has been moving off Solana. The collector has sent 490 SOL through a hop wallet and cross-chain swaps into USDT on Tron, and that USDT went on to an address with the pattern of a cash-out broker. The sweeper swapped 3,359 SOL into USDC on 4 October and still holds it. Who controls any of these wallets is unknown.

How the money has moved (ET)

newest first

Oct 5, 2026, 8:21 AM ET
At 8:19 and 8:20 AM ET, a Tron address created that minute sends 58,118 USDT back into the same Tron address, close to the 58,025 that left it. A minute later, 57,340 USDT goes on to another new address. We can't yet say whether this is the same money coming back through the broker.
The 57,340 USDT transfer ↗
Oct 5, 2026, 7:56 AM ET
The Tron address that received the USDT forwards the last of 58,025 USDT to a cash-out-broker-like address and is left with 7 USDT.
The 34,785 USDT transfer ↗
Oct 5, 2026, 7:54 AM ET
The hop wallet 87GS… sends 2,000 USDT through a one-use wallet into a Wormhole bridge transfer: 1,986 USDT goes into the bridge 9 seconds later. About 1,985 USDT reaches the Tron address from a new sender soon after and leaves in its next transfer. The timing fits the same money, but we haven't matched the bridge transfer end to end.
2,000 USDT from the hop wallet ↗
Oct 4, 2026, 7:53 AM ET
The collector sends 270 SOL to the hop, which swaps it into USDT on Tron.
The 270 SOL swap ↗
Oct 4, 2026, 2:53 AM ET
The sweeper 2J9x… swaps 3,359 SOL into about 406,000 USDC.
The last fill ↗
Oct 2, 2026, 3:45 AM ET
The collector sends 140 SOL to the hop wallet 87GS…, which swaps it into USDT on Tron within minutes.
140 SOL to the hop ↗

The wallets

4 on file

drain collector6mmi…88HjReceived 3,523 SOL from about 20,800 drained wallets; 1,585 SOL left at 10:08 AM ET on 5 Oct 2026. · Our briefing ↗

attacker holding wallet7iFX…MHscReceived 1,599 SOL from the collector on 30 Sep; untouched as of 10:08 AM ET on 5 Oct. · Our briefing ↗

sweeper2J9x…7kKjSwept drained wallets from 1 Oct; swapped 3,359 SOL into USDC on 4 Oct and held 429,494 USDC at 8:00 PM ET that day. · Our briefing ↗

hop to Tron87GS…8c8bReceived 490 SOL from the collector and swapped it into USDT on Tron; sent 2,000 USDT toward a Wormhole bridge transfer on 5 Oct. · Our briefing ↗

From our dispatch

TradeWiz drain: 20,800 wallets, two-thirds emptied after the warningTradeWiz's SOL PVP wallets were drained of 3,523 SOL. Most went after its 30 Sep warning. Now the collector is swapping it into USDT on Tron, and a second sweeping wallet holds $429,494 in USDC.Read the dispatch →

What we don't know

Who controls the collector, the sweeper and the Tron addresses.
Whether the 58,118 USDT that came back to the Tron address on 5 Oct is the drain's money returning from the broker.
Whether TradeWiz's refunds have been paid; none can be traced on-chain yet.

TradeWiz drain: 20,800 wallets, two-thirds emptied after the warning

Mentions in the trenchbook