Proceeds linked to the X100 exploit have reportedly been distributed across four separate wallets, each holding 400 ETH, according to on-chain observations circulating as of October 2026. The
Proceeds linked to the X100 exploit have reportedly been distributed across four separate wallets, each holding 400 ETH, according to on-chain observations circulating as of October 2026. The reported split places a total of 1,600 ETH across those four addresses, a distribution pattern that blockchain analysts typically flag for further monitoring even before motive or ownership can be established.
The reported wallet distribution involves four addresses, each receiving an equal allocation of 400 ETH from funds associated with the X100 exploit. Equal-value splits of this kind are a recognized pattern in post-exploit fund movement, where proceeds are divided before any further transfer activity begins. For related coverage, see Bitcoin Refuses to Break: What Its Resilience Signals.
Four allocations of 400 ETH each produce a reported combined figure of 1,600 ETH held across those wallets. That calculation reflects only the wallet distribution described in available reports; it does not represent a confirmed total loss figure from the exploit itself, as no independent audit or official incident statement has been included in the available record. For related coverage, see Weekly Review: FINMA Approves Switzerland's First Bitcoin ETF.
The core reported fact is an even four-way split: four wallets, 400 ETH each, 1,600 ETH in aggregate across those addresses. No wallet addresses, transaction hashes, block numbers, or timestamps have been independently verified in the available reporting. Readers seeking on-chain confirmation should cross-reference any published addresses against Etherscan's X100-related search results once specific identifiers are made available by credible sources.
The absence of confirmed transaction data means the reported split should be treated as a developing on-chain observation rather than a settled fact. Blockchain data is publicly verifiable once an address or transaction hash is published; the verification step has not yet been completed in available sources.
An even distribution of funds across multiple wallets is observable on-chain, but what it implies about the holder's intent requires additional evidence. Equal-sized transfers are straightforward to spot in block explorer data precisely because the matching amounts stand out against otherwise irregular transaction flows.
Blockchain analysts routinely flag equal-denomination splits because they create distinct signatures in transaction graphs. When funds from a known exploit address move into several wallets in matching amounts, each subsequent wallet becomes a monitored address in its own right. Each one can be tracked for outgoing transfers, bridging activity, or deposits to labeled services.
What an equal split does not establish on its own is common control. Four wallets holding identical amounts of ETH could belong to the same actor, different actors, or a mixing arrangement. Attribution requires additional signals: shared funding sources, simultaneous activity timing, common interaction with labeled contracts, or confirmed identity information. Without those signals, the split is a pattern worth watching, not a conclusion.
It is also important not to conflate the wallet distribution with the full exploit loss. The 1,600 ETH figure across these four addresses describes what has been reported about the distribution; it does not confirm that 1,600 ETH is the complete amount taken in the exploit. Separate incident disclosures or security firm analyses would be required to establish total losses. For context on how large ETH movements are tracked more broadly, Santiment data has shown Ethereum exchange outflows reaching 169,770 ETH in prior monitoring periods, illustrating the scale at which on-chain ETH flows draw analytical attention.
The current reported state places 1,600 ETH across four wallets with no confirmed subsequent movement described in available sources. The next verifiable events that would change that picture are specific and observable.
The first signal to watch is any outgoing transfer from one or more of the four wallets. A move to a fifth address, a decentralized exchange contract, or a cross-chain bridge would each represent a new on-chain event that narrows the possible interpretations. Consolidation, where two or more of the four wallets send funds to a single address, would suggest coordinated control. Fragmentation into smaller amounts would suggest a different handling approach.
Deposits to labeled services carry the most investigative weight. When funds reach a centralized exchange address or a mixer contract that has been tagged in public blockchain analytics databases, that interaction creates a potential point of identity linkage. Security researchers and affected parties typically monitor for exactly these deposits in the hours and days following an exploit. This type of fund-tracing pattern mirrors what investigators tracked after the Initia blockchain incident, where a hacker printed $2.7 million in crypto before investigators began tracing the subsequent movement.
Bridge activity is a separate category. If any of the four wallets initiates a cross-chain transfer, the funds would leave the Ethereum transaction graph and appear on a different network. Bridge transactions are detectable at the source chain level but require separate monitoring on the destination chain. No bridge activity has been reported in the available information about these wallets.
Until one of these signals is confirmed, the four-wallet distribution remains the last known state of the reported proceeds. Official incident updates from any affected protocol or verified security firm reporting would constitute the most reliable next source of confirmed information.
Verifying claims about exploit-linked wallets requires a specific set of on-chain inputs that have not yet been made publicly available in the current reporting on this incident. The steps below apply once those inputs are published.
The starting point for verification is the wallet addresses themselves. Any reported address can be entered directly into a block explorer to retrieve its full transaction history, current balance, and interaction record. A wallet that is genuinely connected to an exploit will show an inbound transaction from the exploit-related address at a traceable point in time. That inbound transaction should have a hash, a block number, and a timestamp that match the reported timeline of the exploit.
Amount matching alone is not sufficient to establish a connection. A wallet holding 400 ETH is not, by itself, evidence of a relationship to the X100 exploit. Thousands of Ethereum addresses hold amounts in that range. The connection must be established through a traceable transaction path back to the source address, not through balance size.
Official incident statements from the X100 project, if and when published, would carry the most direct evidential weight. Security firms that specialize in blockchain forensics sometimes publish wallet attribution analyses with documented transaction paths; those should be cross-checked against explorer data rather than accepted at face value. Until such documentation is available, the reported four-wallet split should be treated as unconfirmed on-chain intelligence.
Based on the reported allocations, four wallets holding 400 ETH each represent a combined 1,600 ETH across those addresses. That figure describes the reported wallet distribution only. It does not confirm the total amount taken in the exploit, which would require separate disclosure from the affected protocol or verified incident reporting.
No. Wallet flows show fund movement but do not prove identity or sole control. Four wallets receiving equal amounts of ETH is a pattern that draws monitoring attention, but attribution of those wallets to a specific individual or group requires additional evidence: shared on-chain history, verified identity linkage, or confirmed interaction with a labeled service. None of that evidence has been established in available reporting.
No. The available report describes four wallets holding 400 ETH each. It does not state that 1,600 ETH is the complete exploit total. A post-exploit wallet distribution can represent a portion of the full proceeds, funds already filtered through prior addresses, or a subset selected for a particular handling strategy. The full loss figure, if one exists, would need to come from an official incident disclosure or independent security audit, neither of which has been referenced in the current available brief.
Readers should monitor any official communications from the X100 project directly, as well as blockchain security firms that publish verified exploit analyses with documented transaction paths. Any specific wallet addresses or transaction hashes released through those channels can then be checked against Etherscan to confirm on-chain activity independently. Unverified social media reports citing wallet addresses without transaction evidence should be treated with caution until a credible source traces the full path.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making any investment decisions.
Read original article on trustscrypto.com
