🚨UPDATE: CLAUDE traced every solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u token that went to the Brand New #1 Wallet (created June 25, 2026).
12.367 BILLION tokens. 23 transactions. 1,100 individual inputs decoded on the Bitcoin blockchain.
Here's what we found:
The new #1 solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u wallet appeared overnight on June 25/26 with 12.367B tokens - 12.37% of the entire supply - and nobody in the community knew where it came from.
We've spent 75 days tracking the #Binance cluster: a confirmed network of 158+ wallets operating across 4 layers of infrastructure that we believe #Binance controls. They've been quietly accumulating solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u over the past two years.
So we decoded every transaction that funded the new #1 wallet.
Here's the breakdown:
🔴 MM2 (Rank #5, Layer 2) - 47 inputs - 5.6B solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u. #Binance's primary distribution node. Its entire 2.045B balance is now gone.
🟡 158 suspicious cluster wallets - 284 inputs - 3.4B solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u. Dozens of wallets sweeping simultaneously in a 22-hour window.
🔵 Layer 3 whales (Wh7, Wh6, Wh23, Wh31) - 29 inputs - 1.8B solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u. The network's largest accumulators, all moving at once.
🟣 MM1 + INT2 (Layer 1 intermediary) - 15 inputs - 0.9B solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u. The full 4-layer #Binance infrastructure chain is confirmed in the raw transaction data.
375 of 1,100 inputs are directly verified #Binance cluster wallets - confirmed on-chain, permanently recorded on Bitcoin. The remaining 725 are position-split addresses created in the Jun 3–25 gap that themselves received from the cluster.
But it gets bigger.
The same night the new #1 holder appeared, we found a SECOND consolidation wallet - Rank #4 - holding 2.532B solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u. Funded by Wh6. We know Wh6 was the sender because the BTC transaction change returned directly to Wh6's address. That is cryptographic proof.
Updated total under #Binance cluster control as of June 25/26:
12.367B + 2.532B = 14.899B solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u = 14.9% of total supply 👀
Previously we estimated 13.7%. Rank #4 was hiding in plain sight.
Now about Wh6 specifically. @DogDatabtc classified this wallet as Merlin Chain - a Bitcoin L2 protocol - and that was the accepted community explanation for its 2.009B position. But the on-chain data tells a different story. Wh6 had 2 direct transactions with MM2, 3 transactions with Wh7, participated in the coordinated Block 910,839 batch event, and swept its entire balance on June 25/26. It now holds essentially zero. Our hypothesis: #Binance deposited solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u into Merlin Chain's bridge contract, which custodied the tokens in this wallet on #Binance's behalf. The "Merlin Chain" label was masking a #Binance position and creating the appearance of ecosystem adoption.
And while all of this consolidation was happening - #Binance was simultaneously routing solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u into exchanges. MM1 sent 15 transactions to https://t.co/pkaPjqFhen. MM2 sent 7. INT1 and INT2 sent directly into Bitget. Left hand selling into exchange liquidity. Right hand building the largest solana:dog1viwbb2vWDpER5FrJ4YFG6gq6XuyFohUe9TXN65u position ever seen.
14.9% of total supply. One entity. Confirmed and Verified by CLAUDE.
🛡️ Recovery Process Update
Our team remains focused on returning assets to affected users, and we are making strong progress on a structured recovery and verification process.
Two important updates today:
1. The final balance snapshot has been taken today, Friday 26 June 2026. We have been capturing regular snapshots throughout the incident response, and this final one gives us an accurate, verified record of balances to work from as we prepare recovery.
2. Timing of recovery. Behind the scenes, our engineering and security teams have worked around the clock to validate balances and evaluate recovery mechanisms. This has led to a solution where assets can begin being returned, which we estimate is around two weeks away: roughly one week to reach a working solution, then a week of testing and review. Timing may shift as the work continues but our priority is clear: a safe return of funds and getting SecondFi back online responsibly.
We will resume operations once we are fully confident the platform is secure and all security reviews are complete and we are determined to get there as quickly as we safely can.
For now, the only action required is to submit a support ticket at: https://t.co/bKfl8SK9D2.
We appreciate your continued patience as we work through this process responsibly and will continue sharing updates as progress is made.
@SMALYAAR18 Would like to note. Only the original address that had ADA and SNEK, and HOSKY assets was drained. Stake rewards and Night tokens were under a different address in the same wallet and the hacker was unable to steal them.
@secondfiapp I have opened a ticket with SecondFi. I will wait and see how it all plays out. I do not trust anyone trying to DM me with offers of recovery.
Midnight City just went live.
Took a bit before HOSKY showed up.
Think you can catch him? 👀🌃
Best screenshot wins 10B $HOSKY.
Happy hunting 👉 https://t.co/hFwJjvLY66
One delegation. Dual reward streams.
How staking $ADA on YOROI staking pool earns you $NIGHT 🌙
Cardano staking is simple: delegate $ADA to a stake pool, the pool produces blocks, and you earn $ADA rewards.
Midnight is a data-protection blockchain built alongside Cardano. It needs validators to run its network, and those validators are Cardano SPOs.
When an SPO operates both a Cardano node AND a Midnight validator, delegators become eligible for Dual Rewards. That means when you delegate $ADA to us, you earn $ADA + $NIGHT rewards.
Stake $ADA and earn across two networks from a pool that’s been on Cardano since day one.