Major hack: 20,825 Solana wallets drained, $422.5k stolen.

Summary
On September 30, 2026, a single wallet, 6mmiAP…388Hj, emptied 20,825 Solana wallets in under three hours. It took about $422K: 3,542 SOL, 8,908 USDC and USDT, and 300 other tokens. Every sweep was signed by the victim's own key, so the attacker holds these wallets' private keys. The wallets belong to unrelated traders, which points to a single leak: a service they all gave their key to. That service isn't identified yet.

Key findings

• Scale: 20,825 victim wallets, 21,288 sweep transactions, read from the attacker's complete history.

• Speed: the main wave ran from 13:25 to about 16:00 UTC on September 30. 11,921 wallets were drained between 15:00 and 16:00, peaking at 307 wallets in one minute.

• A test run first: on September 28 at 18:40 UTC, 20 wallets were swept, two days before the main wave. A single 1 SOL sweep on August 28 may be an earlier test.

• Losses: the median victim lost 0.005 SOL. 502 lost more than 1 SOL, 69 more than 10 SOL, and the largest, oriA…, lost 231.66 SOL. Tokens were taken from 257 wallets, and stablecoins from 143.

• Funds: about 1,888 SOL and the stolen tokens were still on the attacker wallet at 18:34 UTC. 1,599 SOL had moved to 7iFXCZ…Mhsc, and about 40 SOL to 7 other wallets.

Evidence blocks: the attacker wallet card; the victims group card; the flow from the attacker to 7iFXCZ….

How it was done
Each sweep is a plain transfer from the victim to the attacker. The victim's wallet is the only signer and pays its own fee. There's no token approval, no drainer contract, and no exploit of a program. A wallet can only sign that way with its private key, so the attacker had the keys and signed as the victims, thousands of times in a row.

Evidence block: one sweep transaction, e.g. a flow from a large victim to the attacker.

Who the victims are
They aren't fresh wallets from one batch. The ones we checked were created between 2024 and 2026, funded from different sources (Binance and others), and used for active memecoin trading on Raydium, pump.fun, PumpSwap and Jupiter. What they share isn't how they were created, but where their keys went: most likely a trading bot or terminal that imports private keys, a wallet app, or a browser extension. The DEXX incident in November 2024 followed the same pattern.

What we don't know yet
The platform behind the leak. Nothing we sampled on-chain points to one app: the fee and tip accounts the victims paid are shared by many bots. The strongest leads are:

1. the 20 wallets swept in the September 28 test run, most likely drawn from the same stolen list;

2. what the victims tell us about the apps they imported their keys into.

What to do

• If you were drained: move what's left to a new wallet with a new seed phrase, and stop using any app you gave your key to.

• Exchanges and bridges: watch 6mmiAP…388Hj and 7iFXCZ…Mhsc, and freeze deposits coming from them.

Conclusion
This is a mass private-key compromise, not a contract exploit. One attacker, with the keys of more than 20,000 traders, swept them in a single afternoon after a small test two days earlier. Most of the money is still in two wallets, which makes it traceable and freezable. The source of the leak is the open question, and the victims hold the answer.

Method: the attacker's complete history, 23,369 transactions, read with Iris. Victims are the signers of every transaction that sent value to the attacker. Figures as of September 30, 2026, 18:34 UTC. Prepared with Iris, Solana wallet intelligence.