Where the stolen crypto still sits: 17,500+ BTC and 3,190 ETH on wallets we watch, re-read on 10 October

Chen Zhi / Prince Group — 15,957 BTC. The four addresses that received the bitcoin from the four OFAC-listed addresses still hold 4,999, 4,999, 3,424 and 2,535 BTC. None has spent a single output. None is on the sanctions list. Our page.

Coldcard — 1,038.85 BTC. Three attacker addresses hold 562.02, 398.48 and 45.90 BTC and have never spent; the collecting address still holds 32.45 BTC. Our page.

Liquid Network — 598.50 BTC. The holder address has not spent since 9 September; it only keeps receiving dust. Our page.

Aztec — 909.08 ETH, plus 270,513 DAI and 167.89 wstETH, on one wallet whose last outgoing transaction was on 14 June. Our page.

Duelbits — 1,011.55 ETH, nothing out since 28 September. Our page.

Neutron — 794.05 ETH, never moved since the governance attack. Our page.

Nostra — 253.47 ETH and 1,347,821 DAI on the wallet the attacker moved them to on 4 October, untouched since. Our page.

Limit Break / Magic Eden — 223 ETH, plus 70,664 DAI and 2.06 WBTC, on the attacker’s storage wallet. Our page.

Two stablecoin balances could still be frozen by their issuers and have not been: 90,202.82 USDC on the Payy exploiter wallet (Circle’s blacklist read on 10 October: not listed) and the Bitget attacker’s 218,023 USDT and 99,990 USDC, which Tether and Circle did freeze in September and which sit there frozen. Payy, Bitget.

Fetch.ai / NuNet / ASI. The attacker wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE, which held about 433 ETH, started paying out on 8 October at 10:22 UTC with two 1 ETH tests. Over the next 40 hours it sent 432.5 ETH to 18 fresh wallets in amounts of 1 to 50 ETH. Each fresh wallet passed its ETH on within minutes: about 225 ETH into Chainflip deposit channels, about 165 ETH into THORChain (some swapped to USDT first), and the rest through Uniswap. Both are cross-chain swap services; the ether is now on other chains. The wallet still holds 198 million AGIX tokens and 52,395 mUSD. We marked all 18 relay wallets. Our page.

MUSystem. On 8 October between 12:03 and 12:08 UTC the attacker wallet put its 17.5 ETH into Tornado Cash in 13 deposits.

Base vault. The thief collected the first 1,001 wstETH on Ethereum on 9 October — five days after the withdrawal, not seven — and sent the remaining 782 wstETH into the bridge the same day. Our page.

Ledger / CryptoBilis. Three waves on 10 October; covered on its own page.

Money that sits still is the only money that can still be stopped. An exchange that sees one of these addresses at its door has a reason to look; an issuer that sees a balance it can freeze has a reason to act. Every address on this page is in our database and on our watch list, and each case page is updated when its wallets move.

It does not say who controls any of these wallets beyond what each case page establishes, and it does not say any service named here did anything unlawful. Balances read from Ethereum (Blockscout) and Bitcoin (Blockstream) on 10 October 2026; they change.