Iris

Case report14 wallets on the board

Robinhood CEO's X hack: the $VLAD insiders cashed out to Binance through Base

By the Iris teamUpdated October 7, 2026

Robinhood CEO's X hack: the $VLAD insiders cashed out to Binance through Base

Chain: Robinhood Chain (with the exit on Base). Date: July 23, 2026. Type: a hacked account promoting a pre-bought token. Board: board_robinhood.json.

What happened

On July 23, 2026, Robinhood CEO Vlad Tenev's X account was taken over and used to promote "Vladhood" (VLAD) as Robinhood Chain's "official mascot" (Decrypt, The Defiant, BeInCrypto). The token 0x92d176ccbeeffecd8089e841d09ea17b6c22d969 was launched on the Pons launchpad 46 minutes before the post.

The chain shows that the token was rigged before anyone saw the post:

  • 16:38:35 UTC, launch. The launch transaction mints 1,000,000,000 VLAD. The creator 0xd70627fd9ee5b70906620a6f2001ba74457b438d buys 47.17M VLAD in that same transaction (0x24f319b9…).

  • 16:38:43 UTC, 8 seconds later. Six wallets buy exactly 50,000,000 VLAD each, all in block 17437269:

  • 0x1338c1a9… (0xef00f39d…)

  • 0x2a129a2c… (0x418cc673…)

  • 0x678da315… (0x5170c9c5…)

  • 0xb1c426d9… (0x7e708dbd…)

  • 0xe26d978d… (0x459471c9…)

  • 0xf00d0450… (0x24cef2c2…)

  • Within 89 seconds of launch, the creator and these six wallets held 909.3M VLAD, 90.9% of the supply. This comes from VLAD's Transfer logs out of the pool 0xac870e97….

  • About 17:24 UTC, the hacked post goes up. From 17:26 UTC the six wallets dump into the pool in 120 to 376 small sells each. For example, the collector sold 67.6M VLAD in 119 sells between 17:28:00 and 17:28:10.

The trail

  1. Funding came from Base, over Relay. On Jul 23 at 15:25:34 UTC, 0x407e7282d771412dbf4079a75645e096e926f8d2 on Base sent 0.2956 ETH through Relay. The creator received 0.2955 ETH on Robinhood Chain 1 second later (0x2aebb190…, from Relay's solver 0xf70da978…). The Base-side transaction is 0x7861529f…. This leg comes from Relay's requests API.

  2. The creator and the bundle feed one collector.

  • The creator sent 65.04M VLAD to bundle wallet 0xb1c426d9… (0x484d9340…, 0xf746c17d…).

  • The creator paid 24.22 ETH to the collector 0xa01ed60b443967bbdff6bf7511c7e2ae5d3c6268 at 18:03 UTC (0x88edb05d…).

  • Bundle wallet 0x1338c1a9… paid the collector 1.50 ETH (0x5ee5476a…).

  • Bundle wallet 0xf00d0450… sent it 67.60M VLAD (0x8e92eae0…).

  1. The collector sends 110.59 ETH on. It went to 0xba45dde5b29ef06266f3317d2fbf71b30b262cfb at 18:10:57 UTC (0xe92a3074…).

  2. Bridged to Base, to the same address. 0xba45 sent 110.58 ETH into Relay in 4 transactions between 18:34 and 18:36 UTC: 20 + 30 + 30 + 30.58 ETH. The first was 0x7674c5b9… and the last 0x9899ddce…. 109.75 ETH landed at 0xba45 on Base (0xd7730a8a… … 0xe9802c5d…).

  3. Split three ways on Base.

  1. Through a service that keeps 1%. All three branches pass through 0x3ab2206b98b01ba256dbdd4c50208bf17ab27d50. It's an unlabeled wallet with 4,069 transactions. It pays out 99% to a fresh address within seconds: 39.99999 in, 39.59997 out (0xef258cff…, 0xed08d397…). That looks like an instant-swap or mixing service.

  2. Into Binance (0x3304e22ddaa22bcdc5fca2269b418046ae7b566a, labeled Binance by Iris):

  • Branches 2 and 3 go through fresh wallets into the merge wallet 0x1b2d89be… (11,651 transactions). There they're merged with other money into 139 ETH (0x278e56cf…). Then 136.32 ETH goes to Binance at 19:50 UTC on Jul 23 (0x775c7646…).

  • Branch 1 goes 0xfc1b4954… → 0x4eea5b74… → 0xf27e6b48…. It lands in Binance as 50 ETH on Jul 26 at 15:50 UTC (0xac8a4641…).

Other money of the creator:

  • 3.23 ETH bridged to its own address on Ethereum through Relay on Jul 27 (0x08daba82…; Ethereum tx 0x7e99d980…).

  • 1.96 ETH received from SideShift on Aug 2 (0x925f86f9…).

  • 30.72 ETH forwarded in 101 transactions to 0x218f0414… between Aug 2 and Sep 24. Most likely these are launchpad fee claims.

Where the money is now

Of the 110.58 ETH followed out of Robinhood Chain, 109.70 ETH reached the 1% service. After the service's cut, all three branches end in Binance deposits on Base: 136.32 ETH on Jul 23 and 50 ETH on Jul 26. Both deposits include other money merged on the way. Binance can identify the account behind those deposits. The creator's wallet holds 0.00087 ETH.

What Iris shows that a block explorer doesn't

  • The exit, five hops away on another chain. Three "Follow the funds" runs on Base (2 credits each) followed each branch to Binance. They show the branches converging on the same service and merge wallet. Blockscout and Basescan show one hop at a time, on one chain each.

  • Labels on both chains: Relay (bridge) on Robinhood Chain and Base, SideShift's hot wallet on the creator, and Binance at the end of every trail.

  • The insider link. In Iris's connections, the creator's cash-out wallet (0xa01e) is paid by the creator and by two of the six launch-block buyers. That ties the "independent" early buyers to the creator.

  • Honest limits, stated by Iris: "Robinhood Chain has no internal transfers, so ETH paid out by contracts is missing." The VLAD sell proceeds, about 650 ETH by public estimates, aren't visible as transfers. The 110.59 ETH above is what left as wallet-to-wallet transfers.

Caveats

  • The Relay legs were matched with Relay's public requests API. Iris's bridge lookup (/api/xchain/resolve) returned no link for 0x7674c5b9…, 0x2aebb190… or the Base fills on 2026-10-07. Before posting, fix that or show the Relay request on the board as a manual step.

  • The ~650 ETH total is from press reports. Iris and this trace confirm 110.59 + 24.22 ETH of transfers.

  • Arrows that fold several hops are marked "via N hops" on the board. The hop hashes are in this file.

  • USD on the board is at Iris's ETH price on 2026-10-07 ($2,580.54), not the price on the day.