Proceeds linked to the X100 exploit have been distributed across four separate Ethereum wallets, with each wallet receiving 400 ETH, according to on-chain data surfaced via Etherscan. The fou
Proceeds linked to the X100 exploit have been distributed across four separate Ethereum wallets, with each wallet receiving 400 ETH, according to on-chain data surfaced via Etherscan. The four-wallet split places a reported total of 1,600 ETH under separate addresses, a post-exploit fund movement pattern that security researchers and on-chain trackers routinely flag as a precursor to further dispersal or conversion.
The reported distribution is structurally uniform: four receiving wallets, each holding 400 ETH, for a combined total of 1,600 ETH across the split. Equal-sized allocations of this kind are a documented pattern in post-exploit fund management, as they create parallel transaction paths that observers must monitor independently rather than following a single outbound flow. For related coverage, see Future Leaders Awards & Conference 2026 to Bring Global Business and Technology Leaders to Singapore on 2–3 November.
At the time of reporting, the wallet ownership, associated transaction hashes, and originating contract addresses have not been independently verified by Coincu. The four-wallet, 400-ETH-per-wallet figure is drawn from the reported account of the distribution; readers should treat specific addresses as unconfirmed until block explorer data confirming the transfers is made publicly available. On-chain search results for X100-related activity can be reviewed directly through Etherscan's X100 search index. For related coverage, see ESGNext Awards & Conference – Virtual 2026: Global ESG Leaders Convene Online to Advance Sustainable Business.
The X100 exploit itself, including its attack vector, the total funds drained from the protocol, and the timeline of the breach, has not been independently documented in the research available at publication time. Prior DeFi security incidents, such as the Makina Finance exploit that led to a $4.2 million loss, followed comparable post-breach dispersal patterns in which exploit proceeds moved into multiple wallets within hours of the initial drain. For related coverage, see Bitcoin Refuses to Break Down: What the Resilience Signal Means.
Splitting exploit proceeds into equal-sized wallets does not by itself confirm a laundering strategy, an intent to deposit on exchanges, or preparation for bridging to another chain. What the split does accomplish is that it multiplies the number of addresses security firms, protocol teams, and on-chain analysts must monitor simultaneously, increasing the complexity of real-time tracking.
Equal-value transfers are also notable because they simplify bookkeeping for the controller of the funds while making automated heuristic detection harder. Blockchain analytics platforms typically flag large single-wallet balances more readily than distributed holdings at uniform round amounts; 400 ETH per wallet sits below the threshold that triggers automatic screening at several centralized exchange compliance systems, though exact thresholds are not publicly disclosed by those platforms.
A four-way split at 400 ETH each does not by itself indicate that the funds will be moved further. Wallets receiving exploit proceeds have historically remained dormant for days, weeks, or months before any outbound transaction occurs, a delay that reduces the urgency of exchange-level intervention while the on-chain trail remains warm. The more meaningful data will come from subsequent wallet activity, which remains unobserved as of this report.
The first and most direct indicator is whether the four wallets remain dormant or initiate outbound transactions. A dormant period followed by a sudden burst of activity is a pattern consistent with waiting for investigative attention to diminish, while immediate movement may indicate a pre-planned dispersal route. Neither dormancy nor activity is itself confirmation of intent.
Consolidation back into a single wallet would suggest the four-way split was a temporary staging step rather than a permanent dispersal. Conversely, further subdivision, where each 400-ETH wallet sends funds to two or more addresses, would indicate deliberate fragmentation to complicate tracing. Bridge interactions, in which Ethereum-native funds move to a Layer 2, a sidechain, or another L1, represent a separate category of movement that can reduce the effectiveness of Ethereum-native blacklisting tools.
Mixer interaction and identifiable service deposits, such as inflows to a centralized exchange deposit address, would provide the most actionable intelligence for investigators and affected parties. Cases such as the Tether blacklisting of USDT wallets linked to CoinDCX outflows illustrate the window in which stablecoin issuers and exchanges can act when wallet addresses are identified quickly; that window narrows as funds move further from the originating addresses. Any verified update to the wallet activity should be evaluated alongside official statements from the X100 protocol team or relevant security firms rather than interpreted from transaction data alone.
The confirmed element of this report, derived from the reported account of the distribution, is the structural fact of the split: four wallets, 400 ETH each, 1,600 ETH in total. That distribution figure is the basis for all downstream analysis in this article.
What is not confirmed includes the wallet addresses themselves, the transaction hashes that would allow independent verification on a block explorer, the identity or attribution of the wallet controller, the intended use of the funds, and the next destination if any outbound movement occurs. The exploit's attack vector, total protocol loss, and incident timeline are also absent from the available research, meaning this article covers only the post-exploit fund movement report and not the underlying security incident that generated the proceeds.
Later verified on-chain data, official incident disclosures, or confirmed statements from blockchain security firms may materially change the picture. Readers monitoring the situation should prioritize primary on-chain data from the X100 token tracker on Etherscan over secondary social media reporting until a detailed post-mortem is available.
DeFi exploit proceeds that remain on Ethereum are subject to the full surveillance infrastructure of the chain: every transaction is public, timestamped, and permanently recorded. That transparency creates a paradox for exploiters, who must move funds to convert or obscure them while every step is visible to any observer with a block explorer. The four-wallet staging structure reported in the X100 case is consistent with a deliberate first step in a longer dispersal sequence, though it is insufficient evidence to conclude that a full laundering operation is underway.
In comparable post-exploit cases, the dispersal sequence has followed a rough pattern: initial split into multiple wallets, a dormancy period, then movement toward liquidity, whether through decentralized exchange swaps, bridge transfers, or deposits to exchanges in jurisdictions with less stringent compliance monitoring. Protocol teams and security firms typically publish wallet address lists within 24 to 72 hours of an exploit, allowing exchanges to apply deposit screening. The speed of that publication relative to the speed of the wallet movements determines how effectively affected parties can freeze or recover funds.
No recovery mechanism, bounty offer, or whitehat negotiation has been confirmed in connection with the X100 exploit at the time of this report. The absence of that information does not preclude its existence; it reflects the limits of the research available at publication.
According to the report, each of the four destination wallets received 400 ETH following the split of the X100 exploit proceeds.
The four-wallet distribution represents a combined total of 1,600 ETH, calculated as four wallets multiplied by 400 ETH each.
No. A wallet split alone does not indicate the next destination, the intended use, or the timeline of future movements. Later verified on-chain transactions are needed to establish what happens to the funds after the initial distribution.
The wallet owners have not been identified in the research available at the time of publication. Attribution requires additional on-chain analysis, exchange cooperation, or official disclosure, none of which have been confirmed in connection with this event.
Readers can search for X100-related wallet activity directly through Etherscan's token and address search. As specific transaction hashes and addresses are confirmed by security researchers or the protocol team, those links will provide the primary verification layer for the figures reported here.
The concrete triggers to monitor are: outbound transactions from the four reported wallets, any consolidation or further fragmentation of the 400-ETH holdings, bridge activity moving funds off Ethereum mainnet, and official statements from the X100 team or blockchain security firms identifying the wallet addresses. Verified disclosures from any of those sources would represent the next material development in this story.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The post X100 Exploit Proceeds Split Into Four 400-ETH Wallets was initially published on Coincu.
