FUND FLOW
STOLEN$1,226,747
FROZEN~$64,300
LAUNDERED~$254,000
IN WALLETS~$825,000
AT EXCHANGES~$52,000
Graph Timeline Recovery
CONFIDENTIAL
Attack Timeline — Chronological Transaction Log
Behavioral Analysis
Duration ~29 hours
Transactions
Chains Used ETH, BSC, TRON, SOL
Services FixedFloat, THORChain, HTX, KuCoin, ALFAcash, NRNB.io, MEXC, MetaMask DEX
Frozen TXs
Frozen Value ~$51,500
Pattern: Attacker adapted when FixedFloat froze deposits — pivoted from direct deposits to intermediary hops, then abandoned FixedFloat ETH entirely for THORChain cross-chain swaps. FixedFloat started blocking around 19:29 KST. Day 2 operations shifted to BSC distribution through HTX, Binance, and ALFAcash.
AXIS INTERNAL — ATTACK TIMELINE — 2026-03-23