hack or exploit

Crypto trader Frogman hacked for over $4 million during TOKEN2049

0Importance
closedStatus
5News media
6Pieces
Published
Updated
Since then
6 new reports
Also mentions
SOLBNBETH

Frogman said more than $4 million was taken from two wallets while he was in Singapore for TOKEN2049, and onchain traces show the tokens were moved and sold within minutes on the event’s opening morning. The assets were later routed through multiple services and privacy tools, while the method of access remained unresolved.

Key claims & sources

✓
The stolen assets included BP, MARSCOIN and CASHCAT.
✓
Those tokens were later swapped into Ether, BNB and SOL.
✓
More than $4 million was taken from two of Frogman’s wallets while he was in Singapore for TOKEN2049.
✓
Onchain records show the tokens left his Solana wallet at 4:14 a.m. Singapore time and were sold in four equal lots over the next nine minutes.
✓
Frogman said he had found no evidence of a breach on his phone or email.

What it means

Frogman is the person most directly affected today, because his two wallets were drained during TOKEN2049 in Singapore and the tokens were moved within minutes. Anyone following the trader’s wallets or the assets involved would see the transfers and sales already completed by the time the event opened on Tuesday morning.

The practical change is that the stolen tokens no longer stayed in the original wallets and were converted into other assets and passed through several services. What remains the same is that the method of access is still not identified, and there is still no sign of a breach on Frogman’s phone or email. (per cryptopolitan.com)

What is still unknown is how the signing access was obtained and whether the incident began from the wallets themselves or elsewhere. The unresolved point is the access path, which would be clarified by evidence tying the transfers to a specific device, account, or service.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
+0.4% 2 h before
-1.5% 4 h after
$2.9Tmarket cap at publication
11data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 7 11:06
Crypto Briefing scoop
Breaks the event: $4M
+1 h 10 m
Oct 7 12:16
+5 h 51 m
Oct 7 16:57
The Defiant context
Its angle: followed, defiant, records; with quotes
+10 h 20 m
Oct 7 21:27
CR Cryptopolitan context
Its angle: individuals, conference, attendees; with quotes
+1 d 7 h
Oct 8 18:47
The Cryptocurrency Post adds
Adds the identifier 0x427c4b37de0714821b09c4fc655a713abbcfba; brings into the story: EVM, with quotes
+2 d 2 h
Oct 9 13:33
The Cryptocurrency Post echo
No new facts: unconfirmed, interaction, trenchbook; with quotes

Thefts of a similar size

WhenWhat happenedFigure
1.7 years ago Suji Yan incident $4M
2.0 years ago JRNY · Private key leakage incident $4M
3.6 years ago Terraport · Contract vulnerability incident $4M
3.6 years ago Kokomo Finance · Rug pull incident $4M
3.9 years ago Lodestar · FlashLoan price manipulation incident $4M

4280 incidents stored · 559 were as large as this one or larger ($4M)