He used Tornado. He used Zcash. We still have his scent.
$SNIFF is an on-chain bloodhound. It watches every wallet publicly tied to the $94.5M hardware-wallet drain and barks the second the money moves. Every alert links to the transaction. No guessing, no names, just the trail.
XXXXXXXXXXXSoonContract address revealed at launch
The cold wallets weren't cold.
Hardware wallets sold through an official reseller in Southeast Asia came with a hidden implant that read recovery phrases off the screen. On 9 October the wallets started emptying.
- Rehearsal. Attacker wallets funded and tested on throwaway wallets.
- The drain. Wallets on Tron, Bitcoin, Ethereum and four more chains swept into collectors.
- First freeze. Tether freezes about 10M USDT. The thief swaps the rest into USDD to dodge it.
- The wash. THORChain, Tornado Cash, then Zcash's private pool and back out as USDC and ETH.
- Still traced. The money came out the other side and the trail picked it right back up.
Source for every fact and address on this page: YFarmX investigation. Live balances come straight from public block explorers.
Every wallet we're sniffing.
These are the wallets publicly reported as holding the drained funds. Balances refresh every minute from public explorers. A row flashes when money moves.
| # | Chain | Wallet | Role (as reported) | Balance | ≈ USD | Last activity |
|---|---|---|---|---|---|---|
| Picking up the scent… | ||||||
When he moves, the hound barks.
Every transfer out of a watched wallet shows up here with a ready-to-post alert. Copy it, or open it straight in X. Each one links to the transaction so anyone can check it.
- Reading the last moves from every wallet…
Not all of it got away.
Stablecoin issuers and services can freeze funds that land on their rails. These are the amounts publicly reported as frozen or freezable so far.
A bloodhound that never sleeps.
No backend, no secret data. The hound reads the same public explorers anyone can open, so every alert can be checked in one click.
38 wallets publicly reported as holding the drained funds, on Ethereum, Bitcoin and Tron.
Balances and recent transfers are pulled from Blockscout, mempool.space and TronGrid.
Money leaving a watched wallet becomes an alert with the amount, where it went and the transaction link.
Each alert is written ready for X. Holders copy it, the account posts it, the trail stays public.
- Only watches wallets named in public reporting, with the source linked.
- Links every alert to its transaction on a public explorer.
- Flags new destinations as "lead · unconfirmed" until reporting confirms them.
- Never names or accuses a person.
- Never contacts victims or asks anyone for a recovery phrase or a wallet. Anyone who does is a scammer.
- Never claims funds are recovered unless an issuer has said so publicly.
The hound that can't be shaken.
$SNIFF is a meme coin for the trail. The tracker on this page is free for anyone and runs whether you hold or not.
XXXXXXXXXXXSoonContract address revealed at launch
