Frogman’s stolen tokens sold in nine minutes as the trader finds no breach on his phone or email
- Tokens drained from Frogman’s Solana wallet were sold in four equal lots within nine minutes, onchain records show.
- Frogman says he has found no sign of a breach on his phone or email.
- The attacker stole about $4 million across nine tokens and moved the proceeds through Privacy Cash and Chainflip.
Onchain data shows attackers sold tokens siphoned from crypto trader Frogman’s Solana wallet in four equal lots in the span of nine minutes.
Frogman said he has found no evidence of a breach on his phone or email.
The drain hit at 4:14 a.m. as TOKEN2049 opened in Singapore
The tokens left the wallet at 4:14 a.m. Singapore time, or 20:14 UTC Tuesday. Frogman was in Singapore for TOKEN2049, which opened that morning.
The conference runs October 7 and 8 at the Marina Bay Sands. It sold out and pulled in 25,000 attendees from 160 countries.
“Was drained for $4m+ USD this morning at 4:30am while I was asleep,” Frogman wrote on X at 1:21 p.m. local time. He said he was “not sure how it happened yet” and had met “a lot of new people” in Singapore.
His 4:30 a.m. estimate is 16 minutes off the onchain timestamp. He thanked “the teams and individuals who are helping with the investigation” and said he would share more when he could.
Two of his wallets were hit, with losses of about $4 million. Onchain analyst EmberCN, also known as Yu Jin, flagged the transactions about five hours before Frogman confirmed the theft.
BP made up $1.77 million of the haul
The haul covered nine tokens. The biggest was 1.43 million BP worth about $1.77 million, and the second biggest was 13.96 million MARSCOIN worth about $1.55 million.
The third largest position, about 3.7 million CASHCAT, was worth about $515,000. Six smaller holdings made up the rest.
The attacker converted the tokens to ETH, BNB and SOL. The money then went through Privacy Cash and Chainflip, two services that make the money harder to trace from wallet to wallet.
September’s hacks followed a similar pattern, Cryptopolitan reported. Stolen funds were moved in hours and mixed in days through DEX swaps, the Tornado Cash mixer, and no-KYC exchanges.
Some proceeds from September were also swapped into Monero and shielded Zcash. The biggest losses came from compromised wallet keys, which gave hackers access to Bitget’s hot wallets.
September was the worst month of 2026 so far, with hackers stealing $766.49 million. Bitget’s hack alone accounted for $387.5 million.
The Liquid Network exploit reaped $320 million, although about $285 million was returned. Losses for the third quarter reached $1.2 billion, a 53% increase from the second quarter.
Incidents were up 12.8% quarter-on-quarter to 247. More than 11% of these incidents were phishing.
In Europe, private crypto holders also faced more targeting, with 39 incidents in the first half of 2026 compared to 14 for all of 2025.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
How fast did the attacker sell Frogman's tokens?
Within nine minutes, in four equal lots, after the tokens left his Solana wallet at 4:14 a.m. Singapore time.
How much did Frogman lose?
About $4 million across nine tokens, led by 1.43 million BP worth about $1.77 million.
Does Frogman know how he was hacked?
No. He says he has found no sign of a breach on his phone or email.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Randa Moses
Randa Moses is an editor and reporter at Cryptopolitan covering tech, AI, robotics, crypto, scams, and hacks. She has worked in the crypto space since 2017. She held roles at Forward Protocol, AmaZix, and Cryptosomniac. Randa holds a degree in Electrical and Electronics Engineering from the University of Bradford.
