Hack
Playboi Carti hack: 70 linked wallets made $214K on $carti
+2,124 SOL (~$214K), 70 wallets
After @playboicarti was hacked and posted $carti, 70 wallets funded before launch made +2,124 SOL and swept 2,221 SOL into one address in the same second.
Funds parkedKey facts
- Amount
- 70 wallets: +2,124.2 SOL (~$214.5K) trading profit, 2,221.2 SOL swept to one address at 00:39:17 UTC; dev wallet: +25.73 SOL realized and ~311 SOL unclaimed creator fees
- Victims
- $carti buyers after a hacked @playboicarti post (3.6M followers)
- Date
- Oct 25, 2026
- Where the funds are
- At the last read in the notes, early Oct 26 UTC: E3hyuLVN... held ~937 SOL and 35rtEKa9... ~832 SOL; 452 SOL reached deposit address 8zHcWujHhyJri3CRTcWUGmT5WSRdwW7xrns3WTTkPGvS, which sweeps into Binance's hot wallet; 114.1 SOL sat unmoved in 70 skim wallets; the dev wallet held 27.144 SOL with ~311 SOL of creator fees unclaimed.
- Freezable
- Binance can see the account credited for the 452 SOL that reached 8zHcWujH..., but that address is a pooled collector, so it may only lead to an intermediary. The ~1,769 SOL in E3hy... and 35rt... is in self-custody wallets: watch them. Funding came from FixedFloat's hot wallet (295.48 SOL) and the dev's from a ChangeNOW hot wallet, both possible leads.
- Addresses
FWVUdgpjNrJbPhWxUCQ5JQs7Wt5nudkU7Aw7zKn7nNf1Solana, $carti dev walletA55aGi5ZFsvJpgLsKpGzbQ6QZBH8SSRnoBzB8DxvSovKSolana, got 5% of the dev's sell8qBpk1w5xpH4V2RbpN4vkVgCpE6Qp39QuUfmVEPkj8U8Solana, hop: 295.48 SOL from FixedFloat43AFpc76wZXGQydG5ffCrPSQ5B83y76ipMfKG33L99qdSolana, splitter: 70 payouts via 700 one-use walletsEQ29VfRyKpRKRbUsNuHv4LqcGWfL9eEWtoQc4NtMLPcmSolana, cashout: 2,221 SOL from 70 walletsE3hyuLVNnoBjwhmPUhgG7WNt6T3rwVZqrW2a7i3TK4bjSolana, hop, ~937 SOL35rtEKa9EgCqo7EZdccHoWgQnx1cvZ4VwqjTNCnut6tsSolana, hop, ~832 SOL
On Oct 25, 2026, the X account @playboicarti (3.6M followers) was hacked and posted a pump.fun coin, $carti (H5UCZUqCsuTQijwNLBX2KjwP7XJaMaESBSDzQytypump), launched at 23:41:36 UTC. It graduated to PumpSwap in about 3.5 minutes, peaked near $1.2M market cap at 23:57, and was down about 96% by 00:37 UTC.
70 wallets, funded before the coin existed
A FixedFloat hot wallet sent 295.48 SOL to 8qBpk1w5xpH4V2RbpN4vkVgCpE6Qp39QuUfmVEPkj8U8 at 23:08 and 23:12 UTC, which passed it to 43AFpc76wZXGQydG5ffCrPSQ5B83y76ipMfKG33L99qd at 23:13. Between 23:36:15 and 23:38:27, 43AF made 70 payouts totalling 215.06 SOL. Each reached its target through a mesh of 700 single-use wallets: every final wallet received exactly 10 equal transfers from 10 different wallets in the same few seconds. Every one of the 70 wallets' funding matches one 43AF payout to within 0.01 SOL. The coin launched three minutes later.
The 70 wallets were not fresh: each had been funded with about 0.07 SOL weeks earlier and had traded 7 to 44 other memecoins.
They bought first and sold into the peak
Their first buy came at 23:42:24, 48 seconds after launch and 4 seconds after trading volume jumped. They bought 90.5 SOL on the bonding curve before graduation, sold into the peak (biggest sells 23:56 to 23:58) and were fully out by 00:33:49. 57 of the 70 traded $carti and all 57 made money: 176.6 SOL in, 2,300.8 SOL out, +2,124.2 SOL (about $214.5K). 13 were funded but never traded.
One cashout in one second
At 00:39:17 UTC, the 70 wallets each signed a pre-signed durable-nonce withdrawal into EQ29VfRyKpRKRbUsNuHv4LqcGWfL9eEWtoQc4NtMLPcm: 2,221.2 SOL. From there it hopped to E3hyuLVNnoBjwhmPUhgG7WNt6T3rwVZqrW2a7i3TK4bj and 35rtEKa9EgCqo7EZdccHoWgQnx1cvZ4VwqjTNCnut6ts, and 452 SOL reached a deposit address that sweeps into Binance's hot wallet. Each wallet also sent 5% of its sells to a fresh wallet: 114.1 SOL in 70 skim wallets.
The dev wallet
The dev wallet FWVUdgpjNrJbPhWxUCQ5JQs7Wt5nudkU7Aw7zKn7nNf1 was funded with 2.73 SOL from a ChangeNOW hot wallet 11 minutes before launch, bought 2% of supply for 0.59 SOL, and sold it 53 minutes later for 26.32 SOL. Right after, it sent exactly 5% of the sell to A55aGi5ZFsvJpgLsKpGzbQ6QZBH8SSRnoBzB8DxvSovK. About 311 SOL of creator fees were still unclaimed.
What is not proven
No direct SOL transfer links the dev wallet to the 70-wallet side. The link is the same trading tool with the same setting (a separate 5.0% transfer after every sell) and the timing: the 70 finished selling at 00:33:49, the dev sold at 00:34:28, the sweep followed at 00:39:17. Whether the 70 are the hacker or someone who knew when the post would go out is open. Iris's insider check found no bundle tied to the dev among early buyers.