Eye

On-chain sleuth 👁️

[Eye @eyeonchains]

1/ An investigation into the alleged identity of the mysterious Hyperliquid/Hyperunit whale, who holds over 100,000 BTC. Recently, he sold over $4.23B in BTC to acquire ETH and is the same person behind the $735M BTC short order placed on the same platform.

[Eye @eyeonchains]

@heinenbros @generalcatalyst Proud of u Dan! Congrats

[Eye @eyeonchains]

@XtineFang lmao

[Eye @eyeonchains]

@lookonchain @Strategy can you rectify what you wrote? it's false, they didn't sell it, it seems more like a connectivity test or rebalancing

[Eye @eyeonchains]

@v12sec @THORChain this should be your cup of tea @zachxbt

[Eye @eyeonchains]

4/ This situation shows how thin the line really is between “trust” and hidden control in abandoned crypto platforms.

DxSale was once presented as the trusted infrastructure behind countless launches on BNB Chain, including SAFEMOON a project whose team members were later indicted and prosecuted.

If these allegations are confirmed, it would mean the same people who built and promoted the locker infrastructure may have intentionally left a backdoor open for years, only to eventually exploit it themselves.

Even if many of these LPs were abandoned or forgotten, this still represents a massive breach of trust and potentially fraud against investors who believed their liquidity was safely locked.

I believe the funds that were moved through @Binance should be immediately frozen, as they may ultimately belong to investors from projects that originally raised funds through DxSale.

@cz_binance @_RichardTeng @heyibinance

[Eye @eyeonchains]

1/ DxSale allegedly drained $7.3M from some of the oldest liquidity pools on BNB Chain LPs locked back in 2021

According to @Tahax1 the exploit involved a silent ownership transfer, 80+ wallet hops and more than 1,400 LPs being exploited

After analyzing the fresh wallet used during the attacks, i believe there are strong indicators pointing to a direct connection with the @DxSale team itself.

0xC4574DDEF299e7E563971e200433e592EeaaFA69

[Eye @eyeonchains]

Back in August 2025, a user asked me to investigate DxSale and shared screenshots showing that someone was already selling a service through their TG channel, claiming they had direct contacts inside the DxSale team and could unlock old LPs from projects launched before late 2021 taking a 20% cut of the recovered funds as payment

The only requirement, according to them was that someone from the original team still had access to the wallet used to raise funds on DxSale

After today’s events, it really feels like this backdoor may have existed for years already, which also raises the possibility that the exploit came from someone with insider-level access potentially even a former DxSale team member who already knew how these LPs could be unlocked all along

[Eye @eyeonchains]

3/ The address 0xC457 later transferred a total of 3.4K BNB ($1.2M) to these two wallets:

0xb71c1C2A0cD7A88f1317f9A996e4d121E7db5E92
0x4c5ee9703653C8e7725C65593bff372655e0453C

Over the last few hours, the funds were fully off-ramped through multiple Binance deposit addresses, including:

0xE06AcCf50D4F34a5bcA2750D24f943b4F6f7e53B
0xAc69F86C4a43D93f1b7d0B57aEfE6a1b7B9a6773
0x18Dfd8278de50e4A6f3BF1606bA77371451D8602
0x323A1155aA67Aa92CE9306F7c73f8C223568F24d
0x519eD00dd7Be16040Cfe14dDd7D43Db4D77A4A61
0xDd57F5eA9C7CA2C16e243627cA9CAd9F7c2CB3CB
0x8243e20CecafA6D3dDDcF15D5Ac9726dD28F7afD
0x391c5756A9b1924f6C206cC029315CF154B95Eca
0x8eAFD73a26785948d05E89684273304B29a3c0a0
0x582A8eF74c49F5a7435aDD214Cf144f4af7A2aED
0x78Fc689Ccc109be4D8663e353700E1f7e9bD5A6D
0xc87eC86a089C9A15Ce6191444ADBB6f04fCE88D8
0x045F605740Cb1E9954DBB9E174596a59e926a183
0x944D82abc234884f822Ec9E695D4Da91e8e1327A
0xC21C0BC9C911B86dfb659718762806ec409A3dc4
0x67741069FD99B56B5E92C356FE876Efb23658069
0xb39274583Ba7De8b50334A1BA12e7d6a0046C580
0xF9229db0279F1E803b4702b08dC0AD18f50E2694
0xa84d0e8522CFdd8B316F5b215fbC505A522301D3
0x5A5EA07c5Aa921cE424c4e2897051d19b3146934
0x98bf9fF3f51fc57e5602ca7D200d980403de1BdF
0x0c29B1e2Cc5fD9536149Cb497ff18c086663655A
0xC5c04B8236F57090E39C3f67C9B37e218e7aab82
0xD5753F4424eBc6Efb9964E18446B1833FDd52697

[Eye @eyeonchains]

Back in August 2025, a user asked me to investigate DxSale and shared screenshots showing that someone was already selling a service through their TG channel, claiming they had direct contacts inside the DxSale team and could unlock old LPs from projects launched before late 2021 taking a 20% cut of the recovered funds as payment

The only requirement, according to them was that someone from the original team still had access to the wallet used to raise funds on DxSale

After today’s events, it really feels like this backdoor may have existed for years already, which also raises the possibility that the exploit came from someone with insider-level access potentially even a former DxSale team member who already knew how these LPs could be unlocked all along

[Tahax @Tahax1]

🚨 BREAKING: @DxSale just drained ~$7.3M from OG @BNBCHAIN LPs

DxSale ran the largest liquidity locker of 2021. Hundreds of millions sat inside it. Even $SAFEMOON was locked here

The team is now mixing the funds through what looks like @anyswapbot, and funds are now untraceable

[Eye @eyeonchains]

Track Garrett on Hyperdash
https://t.co/dA2pMgZgg9

[Eye @eyeonchains]

20 hours ago, Garrett ( @GarrettBullish ) transferred $39.5M USDC from the address 0x1cBa79CF8DD10D0D6cD6f098B34DFc3499377829 to Binance. He is still holding $263M USDC in that address.

15 minutes later, the wallet 0x92ea19ECeB7a8dE0f50978A1583A5D8b018050e9, which had been inactive for 2 months, received $40M USDC from Binance.

10 hours after that, Garrett deposited $10M USDC on Hyperliquid to buy 42.5K $HYPE (~$2.1M) at an average price of $50.1 and opened a long position of 504.4 $BTC (~$39.1M) with an entry price of $77,394.

The position is currently up +$158K PnL.

[Eye @eyeonchains]

@Deebs_DeFi o7

[Eye @eyeonchains]

@justinsuntron I’ve tried reaching out to you and several members of your team regarding Trove Markets. Over $1M has already been traced to HTX yet i haven’t received any response or acknowledgment so far

[Eye @eyeonchains]

@HyperliquidPC @ericonomic Hyperliquid

[Eye @eyeonchains]

@tayvano_ lmao

[Eye @eyeonchains]

@sershokunin @tradexyz @HyperliquidX pure cinema

[Eye @eyeonchains]

@heinenbros Awesome 👀

[Eye @eyeonchains]

@Deebs_DeFi @bubblemaps appreciate bro 🙏🏼

[Eye @eyeonchains]

DISCLAIMER: All information shared in this thread comes exclusively from publicly available sources, including onchain data, social media activity, OSINT and compliance research tools. No private information, unauthorized access or non public materials were used in this research

[Eye @eyeonchains]

1/ After multiple callouts from @ZachXBT regarding transparency concerns surrounding the project, LAB has now reached the $6.20 price mark.

Someone reported to me that an OTC deal involving $LAB allocations was posted in the "Cybertim Ventures" TG channel, a broker known for facilitating OTC deals

Based on the vesting structure and terms that were shared, this appears to match one of the early investor allocations, suggesting that an investor may have sold part of their allocation at a 50% discount as early as January 5

[Eye @eyeonchains]

5/ His personal email, which is connected across multiple social profiles, also appears to be linked to a female TikTok profile, presumably his girlfriend based on the Russian accent

The profile was promoting a campaign built around a “$1 in crypto for every new follower” concept with a stated goal of buying $1M worth of crypto

Despite the effort, the campaign gained little traction, failed to establish any meaningful presence within the crypto influencer space and the associated Instagram account was later deleted, while the TikTok account appears to have been abandoned