WazirX hack fund tracker
2024-07-18 · about $234.9M stolen · Signer phishing (social engineering)
First stop for the funds
Where transfers out of the tagged wallets went first, valued on the day of each transfer.
When the funds moved
Value moved out of the tagged wallets each month (transfers of $10K or more).
Funds trail, step by step
| Step | Went to | Value |
|---|---|---|
| 1st hop | Contracts (swap services, bridges, other apps) | $98.3M |
| 1st hop | Plain wallets | $96.9M |
| 1st hop | Tornado Cash | $6.3M |
| 2nd hop | Contracts (swap services, bridges, other apps) | $396.0M |
| 2nd hop | Plain wallets | $148.4M |
The 2nd hop follows ETH sent on by the 10 wallets that received the most in the 1st hop. Funds can pass through the same wallets more than once, so these totals can be larger than the amount stolen. “Contracts” are smart contracts such as swap services, bridges and other apps without a public label in our lists; “plain wallets” are ordinary addresses. Laundering usually runs through many of both, and through other chains we don’t follow.
Wallets that received the most
| Wallet | Received from attacker | ETH there now |
|---|---|---|
| 0x35febc…8745ca | $66.4M | 0.00 |
| 0x77d5f0…79031b contract | $31.9M | 0.00 |
| 0x90ca79…9f91fd | $30.3M | 0.00 |
| 0xa8c1c9…901185 contract | $27.6M | 11.82 |
| 0xbcc66f…91cd6b contract | $9.4M | 0.00 |
| 0xa90485…35ed36 contract | $9.1M | 0.00 |
| 0xd08d00…ac0900 contract | $5.6M | 0.00 |
| 0xe37e79…57bd09 contract | $3.4M | 0.00 |
| 0xd76825…8b0dab contract | $2.8M | 0.00 |
| 0x8d8404…724bee contract | $2.1M | 0.00 |
Latest transfers out of the attacker wallets
| When | Coin | Amount | Value then | To |
|---|---|---|---|---|
| 2024-09-06 2 years ago |
ETH | 61.12 | $145K | 0x2d2906…eba968 |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-09-02 2 years ago |
ETH | 100.00 | $243K | Tornado Cash (router) |
| 2024-07-22 2 years ago |
ETH | 4.00 | $14K | 0x04b217…891a88 |
| 2024-07-22 2 years ago |
PENDLE | 5,862 | $11K | Contract |
| 2024-07-22 2 years ago |
ONDO | 27,104 | $11K | Contract |
Tagged attacker wallets (21)
| Etherscan tag | ETH now |
|---|---|
| WazirX Exploiter 27 | 0.00 |
| WazirX Exploiter 22 | 0.00 |
| WazirX Exploiter 16 | 0.00 |
| WazirX Exploiter 21 | 0.00 |
| WazirX Exploiter 20 | 0.00 |
| WazirX Exploiter 24 | 0.00 |
| WazirX Exploiter 15 | 0.00 |
| WazirX Exploiter 13 | 0.00 |
| WazirX Exploiter 23 | 0.00 |
| WazirX Exploiter 9 | 0.00 |
| WazirX Exploiter 17 | 0.00 |
| WazirX Exploiter 18 | 0.00 |
| WazirX Exploiter 11 | 0.00 |
| WazirX Exploiter 14 | 0.00 |
| WazirX Exploiter 7 | 0.00 |
| WazirX Exploiter 10 | 0.00 |
| WazirX Exploiter 19 | 0.00 |
| WazirX Exploiter 26 | 0.00 |
| WazirX Exploiter 25 | 0.00 |
| WazirX Exploiter 12 | 0.00 |
| WazirX Exploiter 8 | 0.00 |
Hack date, amount and method: DefiLlama hacks database. Attacker wallets: public Etherscan tags. Transfers read from the Ethereum blockchain, last updated 2026-10-27 12:38 UTC. Only ETH and tracked tokens are valued; transfers under $10K are left out. Information only. We don’t recover funds or identify people.
Questions
Where did the stolen WazirX funds go?
From the 21 wallets Etherscan tags as the WazirX attacker, we see $98.3M to contracts (swap services, bridges, other apps), $96.9M to plain wallets, $6.3M to tornado cash. Most funds pass through further wallets after the first hop, so this shows the first step only.
How much is still in the WazirX attacker wallets?
About $5 in ETH and tracked tokens, read from the blockchain on 2026-10-27T12:38 UTC.
How much was stolen in the WazirX hack?
DefiLlama's hacks database records about $234.9M lost on 2024-07-18 (signer phishing (social engineering)).
Does Deep Blue Alpha recover stolen funds?
No. We show public on-chain transfers from wallets that Etherscan has tagged. We don't trace funds beyond what is shown, recover assets, or identify people.
