If crypto disappeared from your wallet after you connected it to an Aurum-branded site, this page is about your case specifically. It is the same answer for everyone it happened to, so you should not have to work it out alone.
Check your wallet (free) · Your full Aurum ledger · Where the money went · Live wallet board
Nobody stole your seed phrase. You approved something — a token approval, or an account delegation — on a site that looked like Aurum. That permission let a contract move funds out of your wallet, and it keeps working until you cancel it. The funds were pulled to the drain's beneficiary address at first and, from 24 July, pooled in one collector wallet, then split: most of it swapped to TRON, part sent straight to exchange deposit addresses on BNB Chain and Ethereum, and part converted to ETH through a second bridge and sent to TRON later. The drain is still running against wallets whose approvals are still live: its latest pulls were on 2 October 2026.
Paste your address. The check is free, needs no account and no payment, and reads the live chain. It answers one question and only that question: what this operation took out of your wallet, and where it went. You stay on this page — nothing here turns into a general wallet report you then have to read through. It takes 20–60 seconds, because it reads 8 chains and the live approval state rather than a stored copy.
We do not ask who you are, we have no account for you, and we will never ask for a seed phrase, private key or wallet password — nor should anyone else.
For anyone who put money into Aurum. Paste the wallet you paid from and the ledger lists every deposit it made into the platform, every payout it claimed, how much of what went in was its own payouts going back in, and anything the wallet drainer took from it — on BNB Chain, Ethereum, Polygon, Base and Arbitrum, from April 2022 to today (with the Neobank coin top-ups: BNB, ETH, DOGE, PEPE and the rest), USDT and TRX on TRON (paste the T… address you paid from), BTC on Bitcoin (paste the bc1…, 1… or 3… address) and SOL and USDT on Solana (paste the Solana address); each wallet is built on its own, or several together as one combined ledger, every line with its transaction and a PDF and CSV to keep. A drained wallet shows the drain as its own total and a net after the drain. It also works out what Aurum would still owe the wallet had it kept paying: what each product had on deposit on 26 July 2026, the day the payouts stopped, and the trading interest due since at Aurum’s own rates (the Neyro bot’s rate as the wallet was actually paid it, or its advertised 27.6 % a month where too little was paid to measure; the EX-AI tier the balance falls in), simple trading interest counted live to the moment you look — the figures a claim for being made whole is built on. The drain check above stays free and on its own. Included with a 30-day access pass.
What you will see. Money sent straight to a deposit contract is shown under the contract’s own name on chain, so every line matches the block explorer. Neyra and Neyro are the Neyro bot’s two USDT deposit contracts: “Neyra” is the name the operation gave the first one (5 April 2026, used April to June), and Neyro is the Neyro_USDT contract that followed it (29 June 2026); from 2 July depositors of both were paid from the same payout position. Neyra_USDC (10 June 2026) is a USDC version of the same contract. Every other dashboard product — EX-AI, Zeus, RWA Gold, the BTC/ETH/SOL vaults and the rest — was paid into a single-use deposit address or through the payment gateway, and those all show under one label, “EX-AI / Zeus / other dashboard products”. The chain never recorded which product someone chose; that only existed in Aurum’s own database, so the ledger cannot split EX-AI from RWA Gold from the BTC vault. Money paid to Aurum straight from an exchange account does not show: your wallet never appears on chain for it.
Two mechanisms, both of which need you to sign once and nothing after that.
Approving a token tells a contract it may move that token out of your wallet — any amount, any time, until you cancel. It is the same mechanism every legitimate exchange and swap uses, which is what makes it convincing. An approval granted months ago still works today.
Newer and worse: the account itself is pointed at a contract, so that contract can act as your wallet. A delegation you did not set means the wallet is compromised, not just one token. No website can remove it — the removal has to be signed inside your own wallet app, which is a useful thing to know, because anyone offering to remove it for you from a website cannot do what they are claiming.
TraceHunt has step-by-step removal instructions for SafePal, MetaMask and Trust Wallet, taken from each wallet's own documentation.
Every address below is real and public — open any of them on a block explorer and check this yourself. That is the point of publishing them.
Victims connected a wallet to an Aurum-branded site and approved a transaction. Two mechanisms were used: a normal token approval, which lets a contract move that token out of your wallet whenever it likes, and an EIP-7702 delegation, which hands control of the account itself to a contract. Neither needs your seed phrase. Both keep working until you cancel them — which is why wallets are still being emptied today.
The operator address named in the phishing sites' own configuration. It receives the approvals, is the hard-coded owner on the drainer contracts, and from 23 July executed every pull into the collector. Still active: it was running pulls on 2 October 2026, and the live board below shows its latest movement. This is not a closed case.
Two separate contracts — verified as distinct code on chain, not one contract redeployed. They call transferFrom in batches against every wallet that still has a live approval. Both are deployed at the same addresses on Ethereum, Base and Arbitrum too, with byte-identical code.
The drain started three weeks before the collector below existed. From 3 July to 9 August 2026 this address — the beneficiary written into the drain's delegate contract — pulled drained wallets' funds straight to itself: US$482,287.81 from 656 wallets on BNB Chain between 3 July and 9 August (623 of them are also on this case's victim list) and US$9,905.30 from 21 wallets on Ethereum. Counted on chain on 3 October 2026, pull by pull; the case record's US$485,282 also counts payments into it that it did not pull itself. The free check above finds these transfers too.
This is the wallet most victims will recognise from their own transaction list. It is a pass-through, not a vault: funds land and are swept onward within minutes, so what sits in it at any moment is small next to what has gone through it — the live board below reads it. Created on 23 July 2026, it took its first victim money the next day. Up to 29 September 2026, US$3,639,224.02 of victims' stablecoins moved through it: US$3,279,045.21 from 8,499 wallets on BNB Chain, US$294,573.17 from 481 on Ethereum, US$63,932.69 from 68 on Base and US$1,672.95 from 72 on Arbitrum. That is the case record's count, transfer by transfer from the chain. It was still taking money on 2 October.
AF2 kept almost nothing. It split what it collected mainly four ways:
The largest exit: 40 orders on 30–31 July 2026, placed by AF2 and five conduit wallets it funded, through the Bridgers swap service (which the case record links to SWFT). 2,192,569.31 USDT was delivered to six addresses on TRON, consolidated at one hub and then split into two commingled hubs. AF2's later, smaller orders are not in this figure.
What can be done: A swap service pays out from its own reserves, so no transaction hash joins the two sides. Each order names its destination in its own transaction data; the service's order records, which police can request, would confirm each one.
US$850,000 in nine transfers on 30 July 2026, directly from AF2 to a deposit address publicly labelled Binance. A deposit address credits one exchange account.
What can be done: A lead for police: the exchange holds the account's opening file, its login records and what happened to the money next, and can freeze what is left on a valid request.
On 30 July 2026 AF2 sent 260,475 of its Ethereum stablecoins to this intermediary, which paid 129,450 USDT and 128,100 USDC into two exchange deposit addresses within the hour. Both were swept into a hot wallet with the explorer label WhiteBIT. The case record follows it out again: withdrawals of matching size left a TRON wallet tagged WhiteBIT for an address that then paid the drain's TRON hub, matched by amount and timing.
What can be done: The same kind of lead as the Binance address: the exchange's records can say whose account those deposit addresses credit, and confirm or refute the matched withdrawals. The label is an explorer's, so it is a lead until the exchange confirms it.
214,501.17 in 31 transfers on BNB Chain between 31 July and 29 September 2026. Not an end point: every one of AF2's 49 Relay requests, on four chains, paid out to AF2 itself as ETH on Ethereum (123.04 ETH in all). AF2 then funded wallets that placed 21 more swap orders to TRON, with that ETH and with stablecoins it sent them directly.
What can be done: Relay's request records (accounts, IP addresses, app sessions) and the swap service's order records are what a records request asks for.
The drain arm touched five: BNB Chain (where most of it happened, in BSC-USD and USDC), Ethereum (a smaller leg, in USDT and USDC, most of which went to exchange deposit addresses on 30 July), Base and Arbitrum (smaller legs again, with the same two drainer contracts deployed and running the same approval sweep), and TRON (not drained directly — this is where the swapped money landed, as USDT). No address on this page is carried over from any other case.
This is the drain arm only — the money that came out of victims' wallets. The last column carries two different facts, and confusing them is the usual mistake. The large figure is what AF2 sent through that route — from the case record, re-read on chain on 3 October 2026 (for the swap service, the 40 orders of 30–31 July; AF2's later orders are not in it). The figure under it is what is there now, read from the chain when you load this page and again every time you check a wallet. self-verified
| Where it went | Chain | What can be done about it | Passed through · there now |
|---|---|---|---|
| Bridgers swap service 0xb685760ebd368a891f27ae547391f4e2a289895b lands at six addresses, listed in the TRON section on TRON as USDT | BNB Chain, Ethereum, Base, Arbitrum | On 30–31 July 2026 AF2 and five conduit wallets it funded placed 40 orders with this swap service (which the case record links to SWFT), on BNB Chain, Ethereum, Base and Arbitrum, and 2,192,569.31 USDT was delivered on TRON to six addresses. A swap service pays out from its own reserves, so no transaction hash joins the two sides. Each order names its TRON destination in its own transaction data and the delivery matches by amount and timing; the service's order records, which police can request, would confirm it. Later orders, from August on, are not in this figure. On TRON most of it was consolidated on 31 July at one hub, then split into two commingled hubs where it is mixed with other people's money. The TRON section below follows it address by address. | $2.19M passed through reading… |
| Binance deposit address 0x2bfc43abaa244edfe531736b168df8ab2c4bc6e0 | BNB Chain | US$850,000 in nine transfers straight from AF2 on 30 July 2026, to a deposit address publicly labelled Binance. A deposit address credits one exchange account, so on-chain tracing stops here: past this point the value is an entry in the exchange's own ledger, which no explorer can read. A lead for police: the exchange holds the account's opening file, its login records and what happened to the money next, and can be asked for them with a police reference. | $850,000 passed through reading… |
| Ethereum leg, to an exchange labelled WhiteBIT 0xf8e5892199789750a08be4cf16f491235e1a63e2 | Ethereum | AF2 took in 294,573.17 in stablecoins on Ethereum. On 30 July 2026 it sent 260,475.00 of it to this intermediary, which paid 129,450 USDT and 128,100 USDC (257,550 in all) into two exchange deposit addresses within the hour; both were swept into a hot wallet carrying the explorer label WhiteBIT. The label is a lead until the exchange confirms it. The case record follows it out again: withdrawals of matching size (129,150 and 128,100) left a TRON wallet tagged WhiteBIT for an address that then paid the drain's TRON hub. That link rests on amount and timing; the exchange's records would confirm or refute it, and can say whose account the deposit addresses credit. | $260,475 passed through reading… |
| Relay bridge depository 0x4cd00e387622c35bddb9b4c962c136462338bc31 | BNB Chain | 214,501.17 in 31 transfers from AF2 on BNB Chain between 31 July and 29 September 2026. This is not where the money stopped: every one of AF2's 49 Relay requests, on four chains, paid out to AF2 itself in ETH on Ethereum (123.04 ETH in all). AF2 then funded wallets that placed a further 21 swap orders to TRON between 3 August and 29 September, with that ETH and with stablecoins AF2 sent them directly. Relay's request records (accounts, IP addresses, app sessions) are what a records request asks for. | $214,501 passed through reading… |
Reading the current balances from the chains…
US$3,639,224.02 in stablecoins left victims' wallets and passed through the collector between 23 July to 29 September 2026, plus US$482,287.81 pulled by the beneficiary on BNB Chain from 3 July. These are the operation's aggregate figures for the whole drain arm — not any one person's money. Your own figure is whatever your own wallet shows, and the free check above computes it from your own transactions.
self-verified Every pull into the collector, counted transfer by transfer on the four chains it runs on, from 23 July to 29 September 2026 (case record, counted on chain (fact F33)):
| Chain | Wallets drained | Value taken |
|---|---|---|
| BNB Chain | 8,499 | $3,279,045.21 |
| Ethereum | 481 | $294,573.17 |
| Base | 68 | $63,932.69 |
| Arbitrum | 72 | $1,672.95 |
| Total | 9,120 | US$3,639,224.02 |
Wallets are counted per chain, so a wallet drained on two chains appears in both rows; about 9,000 different wallets in all. Starting before the collector existed, from 3 July to 9 August 2026, the drain's beneficiary address pulled US$482,287.81 from 656 wallets on BNB Chain straight to itself, and US$9,905.30 from 21 on Ethereum. Those are not in the table above.
Our own lookup index, built on 2026-09-13 from a complete sweep of every transfer into the collector, separates real losses from dust: by that date 5,620 wallets had lost a dollar or more (2,109 over $100, 548 over $1,000), and a further 3,310 addresses had sent it less than a dollar in total. Addresses caught up in something like this get sprayed with worthless tokens, so we do not count those as thefts. If yours is one of them, the check above will still find it and show you exactly what it was.
The drain is still taking money. 13 more pulls between 29 September and 1 October 2026 (1,444.27), and more on 2 October. This is not a closed case being written up — wallets are still being emptied, and the only thing that stops it for your wallet is cancelling the permission. Treat the total as a floor.
Two of the four routes are services that convert or swap. They pay out on the other side from their own reserves, so there is no transaction hash joining the two sides. The destinations are known from the orders' own transaction data; the services' order records would confirm them — those come out under legal process. The Relay route did not even end there: it paid AF2 back in ETH, which went to TRON through more swap orders.
The other two are exchange deposit addresses, and that is a different kind of ending. Once value is inside an exchange it becomes a line in that company's private ledger, and no explorer can read the ledger. At most, withdrawals can be matched by amount and timing, as the case record does for the WhiteBIT leg; only the exchange's records confirm it. That is not bad news. An exchange holds each account's opening file, login records and ledger, and can freeze a balance when law enforcement asks. Those records are the route to whoever controls the account, and the reason to report quickly rather than to keep tracing.
Most of what AF2 took is now inside exchanges, swap services or commingled TRON hubs. Two holdings are in the case record for police, and are not listed here so as not to alert whoever controls them: one TRON wallet still holding a small traced part of AF2's later exits, which Tether can freeze on a law-enforcement request; and a wallet that has never sent a transaction, worth about US$1.25 million, most of it sent there by the drain's beneficiary — that one needs a court order, because what it holds cannot be frozen by an issuer. What a victim can do that helps most is report, so that requests carry victims' reference numbers.
An earlier version of this page showed an Ethereum USDT address here as “the Ethereum end of the drain”. The case record corrected that on 27 September 2026: it is a deposit pot of the platform side and never received anything from the drain’s collector.
The same operation also ran a deposit platform, and most of the money tracked in this case came from that side, not from drained wallets. The case record puts US$8,964,445.86 in 3 TRON wallets attributed to the operation as of the reads of 2 October 2026. It is a much larger pot, and the record traces no drained money into it. It is mentioned so that you recognise the figure if you see it quoted about this case, and know that it is a different pot from the one drained wallets were emptied into. If you paid INTO Aurum, the Aurum ledger on this page is the tool for you.
Every address on this page is watched. This table is read from the chains themselves when you load it — not from a stored copy — so you can see whether the wallets involved in this case are active right now.
Reading the chains…
This is the part people ask for and rarely get: what happened after the swap. Each address was walked on chain, transfer by transfer, and reconciled with the case record on 3 October 2026. self-verified
Publicly tagged Bridgers and carrying a very large number of transactions: the service's hot wallet, paying out to whoever each order names. It is not the operation's wallet, and what passes through it belongs to thousands of unrelated users.
40 orders placed on 30–31 July 2026 by AF2 and the five conduit wallets it funded, on BNB Chain, Ethereum, Base and Arbitrum, delivered 2,192,569.31 USDT to these six addresses. Each one was paid by these orders alone, so up to here the money is the drain's and nobody else's. The one an earlier version of this page treated as the only landing point received 178,975.73 of it.
700,000 USDT in from two of the payout addresses and straight out to the hub below. Both of its sources were AF2's own payout addresses, so nothing else joins the money here.
1,569,782.23 USDT in on 31 July 2026 between 10:55 and 11:00 UTC. 1,192,029.34 of it (75.9%) came from AF2's payout addresses by direct hops. The case record links the rest by amount and timing (298,418, through an exchange), by gas funding (79,015.89, a lead) or to the drain's second collector (319). It paid out 1,100,000 and 469,780 the same morning and is nearly empty now.
1,100,000 USDT in at 11:25 UTC on 31 July and the same amount out to the OTC hub below eight and a half minutes later.
Took the 1,100,000. It receives from thousands of addresses (the case record counts 3,544 sources, and over 5,000 transfers in the four days to 2 October alone), so from here the drain's money is mixed with money that has nothing to do with this case.
Took the other 469,780 from the hub, plus a further 500,000 from one of AF2's payout addresses earlier that morning. 744 transfers and about 13.07M USDT through it, empty now. Mixed, like the one above.
Read honestly, this is a trail and not a receipt. Up to the hub (step 4) the money is the drain's: the payout addresses were paid by AF2's orders alone, and three-quarters of the hub's intake came straight from them, with the record linking the rest by amount and timing or by gas funding. From the two commingled hubs onward it is mixed with money from thousands of other senders, and nobody — not this service, not a commercial analytics firm — can say which dollars that leave them were whose. That is where on-chain tracing stops. What it does establish is the route, the dates and the services involved, and that is what a police officer, the swap service and the exchanges need in order to answer the next question from their own records.
At the two commingled hubs. Past them the drain's money is mixed with money from thousands of other senders, and following “the largest amount out” of an address like that proves nothing about where any one dollar went. An earlier version of this page did exactly that for three more hops, to an address tagged as an exchange; the case record does not support those steps, so they have been removed. The next step is not a trace: it is the swap service's order records and the exchanges' account records, asked for by police.
After the drain. AF2 did not stop on 31 July. It kept converting what the drain took to ETH through the Relay bridge — 49 requests on four chains, every one paid to AF2 itself on Ethereum — and funded wallets that placed 21 more Bridgers orders to TRON between 3 August and 29 September 2026, with that ETH and with stablecoins AF2 sent them directly. The swap service and Relay hold the order records for every one of them.
AF2's transaction counts read live on 3 October 2026; contract code compared on 13 September 2026 and confirmed again on 3 October; amounts from the case record. self-verified
| Chain | Collector active? | What we found |
|---|---|---|
| BNB Chain | yes · 100 transactions | Where most of the drain ran: US$3,279,045.21 from 8,499 wallets, in BSC-USD and USDC. Still taking small amounts in October. |
| Ethereum | yes · 46 transactions | US$294,573.17 from 481 wallets. Both drainer contracts deployed. Most of it went to exchange deposit addresses on 30 July (see above). |
| Base | yes · 20 transactions | US$63,932.69 from 68 wallets. Both drainer contracts deployed here with identical code. Balances are empty, so what came through has moved on — but an approval granted to those contracts on Base is still live until it is cancelled. |
| Arbitrum | yes · 6 transactions | US$1,672.95 from 72 wallets. Both drainer contracts deployed with the same code as everywhere else; the operator address has 18 transactions here. |
| Optimism | no · never used | AF2 has never sent a transaction here (checked 3 October 2026). |
| Avalanche | no · never used | AF2 has never sent a transaction here (checked 3 October 2026). |
| Gnosis | no · never used | AF2 has never sent a transaction here (checked 3 October 2026). |
The two contracts that pulled funds out of wallets are deployed at the same addresses on BNB Chain, Ethereum, Base and Arbitrum, with byte-identical code — verified by reading the runtime bytecode from each chain and comparing its SHA-256 hash:
3,147 bytes of runtime code, SHA-256 b985fc20ec5f7699… — identical on BNB Chain, Ethereum, Base, Arbitrum.
6,371 bytes of runtime code, SHA-256 e92f751c1851ad26… — identical on BNB Chain, Ethereum, Base, Arbitrum.
This matters to you directly: an approval you granted on Ethereum, Base or Arbitrum is exactly as live as one on BNB Chain, and the free check above reads every chain this operation has been seen on.
A drain that is still running is a permission that is still live. Run the free scan below on your own wallet: it reads every chain and lists the approvals and delegations that exist right now. Cancel them in your own wallet. TraceHunt never touches your keys and cannot do it for you.
An EIP-7702 delegation you did not set means someone else can act as that account. Removing it stops the sweeper, but whoever set it can set it again if they still hold what let them do it. Move anything of value to a brand-new wallet with a new secret phrase, and treat the old one as burned.
Tracing produces evidence; it does not recover funds. What acts on evidence is a police report and an exchange compliance desk. The reporting channel is different in every country and every one of them is free.
A site calling itself OrbitOne has been reported presenting itself as Aurum’s relaunch with a “$5M recovery”. The case record found no on-chain link between it and Aurum’s wallets, and it is the pattern of a recovery scam aimed at the same victims. Anyone who contacts you offering to recover this money for a fee is running a second fraud. Official reporting is free, and no website can undo a delegation — only your own wallet app can.
Check your wallet against this case Where to report, by country Is the USDT frozen?
A site calling itself OrbitOne has been reported presenting itself as Aurum's relaunch with a "$5M recovery". The case record found no on-chain link between it and Aurum's wallets, and it follows the pattern of a recovery scam aimed at the same people. If someone contacts you about this loss offering to get the money back for a fee, an unlock payment, a tax, or a wallet connection, that is a second fraud. Reporting to police is free. Nobody can return funds from a blockchain by asking for a payment first, and no website can remove a delegation.
self-verified figures were read live from public blockchain data by this service's own tooling on the date shown — balances, transfer aggregates and contract code. report-sourced figures come from case documents and are labelled where used; victim-count figures in particular are early list counts known to include addresses later found not to be victims, so they are deliberately not quoted on this page as a headline. Attribution of an address to a role is an assessment at a stated confidence level, not proof of who controls it — identifying any individual requires legal process directed at a service, which is police work, not ours. No natural person is named anywhere in this service.