How We Track The Stolen Funds

1. Data Pipeline & Tracking Methodology

To track the stolen funds on this dashboard, we monitor the blockchain for specific patterns:

• Timelines: Looking at wallets created when the vulnerable firmware was most popular.
• Sweep Detection: Flagging transactions that completely drain a wallet into a brand new address.
• Grouping: Linking addresses together based on shared transaction behaviors, like identical fees or locktimes.

This allows us to estimate the total amount stolen in real-time.

2. How We Verify Data

We categorize data into three tiers to ensure accuracy:

• Tier 1: Verified Wallets: Addresses confirmed to belong to the attacker, cross-checked with top research firms (Galaxy, Block).
• Tier 2: Community Reports: Addresses reported on social media. We track these but don't include them in the verified total.
• Tier 3: System Discoveries: Addresses automatically flagged by our system because they match the attacker's strict behavior patterns.

3. The Attacker's Footprint

The attacker's automated script left behind clear fingerprints. We focus on 4 core waves defined by exact network fees, rather than the 10 waves reported by the community. This strict method guarantees high accuracy. We score transactions based on:

• Exact Fees (+25 pts): The attacker hardcoded specific fee rates for each wave (30.0, 50.2, 10.0, and 201.0 sat/vB).
• RBF Sequence (+25 pts): A specific Replace-By-Fee setting was used (0xfffffffd).
• Version/Locktime (+25 pts): Expected version (1 or 2) and locktime=0.
• BIP-69 Sorting (+25 pts): Lexicographical sorting of inputs and outputs.

If a transaction generates a confidence score of 50 or higher, the destination address is flagged as a Tier 3 Heuristic Discovery.

Technical Proof: The RBF Arms Race

This scatter plot visualizes the fee-bumping behavior of the sweeping script, confirming the automated nature of the attack.

4. Automated Promotion

If a Tier 2 (Crowdsourced) address receives a transaction that strongly matches our strict heuristics (score >= 50), the pipeline automatically promotes that address to Tier 1 (Verified), creating a powerful automated feedback loop for community intelligence.

5. Evasion Tactics (Wave 3)

In early waves, the attacker swept thousands of wallets into a handful of shared collector addresses. During Wave 3 (July 31st), the attacker changed tactics to evade address-clustering detection: they swept every victim wallet into its own completely fresh, dedicated P2WSH vault.

Because they did not reuse addresses, our system relies entirely on the strict 201.0 sat/vB fingerprint to track Wave 3. This generated tens of thousands of individual clusters in our Tier 3 bucket, successfully capturing the decentralized sweeps without polluting the Tier 1 verified metrics.

6. Actionable Advice

If you believe you may be affected, see the Firmware Advisory on the main dashboard for guidance.