X100 Exploit Proceeds Split Into Four 400-ETH Wallets
Proceeds from the X100 exploit were distributed across four separate Ethereum wallets, with each wallet receiving 400 ETH, according to a report by The Defiant.
Proceeds from the X100 exploit were distributed across four separate Ethereum wallets, with each wallet receiving 400 ETH, according to a report by The Defiant. The structured split totals 1,600 ETH across the four addresses, a distribution pattern that complicates straightforward on-chain attribution and raises the operational challenge of tracking stolen funds before they move further.
KEY POINTS
X100 Exploit Proceeds Were Divided Across Four Wallets
The reported distribution puts 400 ETH into each of four separate wallets rather than consolidating proceeds into a single address. Splitting exploit proceeds this way is a recognized pattern in post-hack fund handling: it reduces the footprint of any single wallet and spreads monitoring burden across multiple addresses. For related coverage, see Future Leaders Awards & Conference 2026 to Bring Global Business and Technology Leaders to Singapore on 2–3 November.
The Defiant reported the wallet split as the immediate post-exploit state, meaning these four addresses represent the first observable layer of fund movement after the exploit was executed. Whether those wallets subsequently moved funds is a separate question that on-chain monitoring would need to answer in real time. For related coverage, see ESGNext Awards & Conference – Virtual 2026: Global ESG Leaders Convene Online to Advance Sustainable Business.
Blockchain explorers like Etherscan allow anyone to query the transaction history and current balance of each involved address. A 400-ETH balance in each wallet is large enough to be tracked but structured small enough to route through mixers or bridge protocols that often impose per-transaction size limits. This mirrors patterns observed in the Initia exploit, where post-hack fund routing also drew immediate on-chain scrutiny.
Why the Four-Wallet Split Matters for On-Chain Tracking
Monitoring Distinct Addresses and Later Transfers
Each of the four wallets constitutes an independent tracking target. Security researchers and blockchain analytics firms typically flag these addresses for exchange compliance teams, who can then block deposits from those wallets. With four addresses instead of one, that flagging process has to run in parallel across four distinct identifiers, each with its own future transaction graph. For related coverage, see Arcus Review 2026: Stock Token DEX, Wallet Flow, Perps Gate, and Points Campaign.
The practical consequence is that any subsequent transfer from any one of the four addresses, whether to a centralized exchange deposit address, a privacy protocol, or a bridge contract, becomes a new data point in the tracing graph. Public monitoring of such moves has previously helped trigger blacklisting actions when stolen funds convert to stablecoins; Tether and Circle have both frozen USDT and USDC at wallet addresses linked to prior exploits when provided with on-chain evidence by security teams.
The Limits of On-Chain Attribution
Wallet ownership on Ethereum is pseudonymous. Observing that four wallets each received 400 ETH from exploit-linked transactions establishes the fund flow but does not establish who controls those wallets. The report from The Defiant describes the distribution; it does not attribute control of the wallets to any named individual or group.
Security analysts watching this type of split look for behavioral signals in subsequent transactions: timing correlations between wallet activity, shared gas-payer addresses, or routing through the same bridge or mixer contract. These patterns can narrow attribution hypotheses without confirming identity. Until further on-chain movement is observed and analyzed, the four wallets remain addresses to watch rather than confirmed endpoints.
The X100 token contract address is queryable on Etherscan, where the transaction history associated with the exploit and subsequent wallet movements can be reviewed directly. On-chain data provides the ground truth; secondary reporting, including the initial Defiant coverage, points researchers toward which addresses to examine rather than serving as a substitute for the explorer data itself.
For projects operating at the intersection of token infrastructure and on-chain execution, the X100 case adds to a growing incident record that security teams across the Ethereum ecosystem are tracking. The structural choice to split proceeds symmetrically across four equal-sized wallets is itself a data point; it suggests deliberate planning in the post-exploit phase rather than ad hoc fund movement, and that operational detail will factor into any formal post-mortem or law enforcement referral.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
