[NEW]: Hundreds of IOTA wallets drained in ongoing theft, millions laundered through Binance and KuCoin #1277
Description
Date
July 2025 (ongoing as of February 2026)
Description
Someone has been systematically draining IOTA wallets since at least July 2025. On-chain analysis shows over 600 wallets were emptied to zero and their funds routed to a single aggregator address — roughly 10.5 million IOTA in total. Eighteen wallets were drained on the same day (September 8, 2025), suggesting the operation is at least partially automated. The stolen funds are laundered through layers of intermediate addresses before being deposited to Binance and KuCoin. A dedicated Binance feeder address has sent millions of IOTA to the Binance hot wallet across dozens of transactions, and multiple KuCoin feeders have moved hundreds of thousands more. The aggregator still holds around 270,000 IOTA and continues to actively cycle funds — the most recent confirmed Binance deposit was 72,561 IOTA on February 12, 2026. At least one victim suspects the compromise originated from unauthorized access to their password manager, has filed a police report with the Catalan Police, and mapped the full chain of custody from their wallet to the exchanges using publicly available blockchain data. A second victim independently confirmed their funds ended up at the same aggregator.
Links
- Aggregator address (central hub receiving from 600+ drained wallets): https://iotascan.com/mainnet/account/0x91c7ab819ff916133e71eedf69ca12a2f7ebca6b8e38795bd35c36a39e0a2bbd
- Example theft TX (332,472 IOTA stolen from one victim): https://iotascan.com/mainnet/tx/4HsjhTeTxSSwEmPYLAnhS9zGWooA6p34JVNg6k36VznC
- Binance feeder address (depositing stolen funds to Binance): https://iotascan.com/mainnet/account/0x03a26b0e17b47ab7244ccc48e137523cc4d49bcec1eee15323b8f540dd1c62fb
- Most recent Binance deposit (72,561 IOTA on Feb 12, 2026): https://iotascan.com/mainnet/tx/2KgNYaWPHXDvKHc8ezssKo89ju894b78BEEcMcQbqQnD
- Verified KuCoin deposit TX: https://iotascan.com/mainnet/tx/DR5RXTpi1SBjb479m6e8jpWDvALfxehDgkfoTMx3BsZ9
- Victim drained wallet: https://iotascan.com/mainnet/account/0x749974e5709607bbdd2ede919c120b47625cc011e312d55239e8db5701a8dc99
Agreement
- I irrevocably agree to release my contribution under the CC-BY 3.0 License
Attribution name
albertolive