FUND FLOW
STOLEN$1,226,747
FROZEN...
LAUNDERED...
IN WALLETS...
AT EXCHANGES...
Graph Timeline Recovery Exchange Contact TX Lookup Monitor
CONFIDENTIAL
Attack Timeline — Chronological Transaction Log
Behavioral Analysis
Duration ~29 hours
Transactions
Chains Used ETH, BSC, TRON, SOL
Services FixedFloat, THORChain, HTX, KuCoin, ALFAcash, NRNB.io, MEXC, MetaMask DEX
Frozen TXs
Frozen Value ~$51,500
Pattern: Attacker adapted when FixedFloat froze deposits — pivoted from direct deposits to intermediary hops, then abandoned FixedFloat ETH entirely for THORChain cross-chain swaps. FixedFloat started blocking around 19:29 KST. Day 2 operations shifted to BSC distribution through HTX, Binance, and ALFAcash.
AXIS INTERNAL — ATTACK TIMELINE — 2026-03-23
Claude is updating this timeline autonomously — monitoring 45+ wallets across 5 chains every 3 minutes, tracing new movements, and committing findings in real-time.