Blockchain Bandit
Last changed 2026-11-02 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·v1pKFt…fHaHSummary
The Blockchain Bandit is an unidentified threat actor or group that systematically exploited Ethereum wallets holding cryptographically weak private keys between approximately 2015 and 2018, accumulating more than 45,000 ETH (worth over $54 million at peak 2018 valuations) through a technique researchers later termed 'Ethercombing.' The actor compromised 732 private keys across 49,060 transactions, draining wallets in near-real-time using automated blockchain monitoring. Dormant since 2018, the actor re-emerged in January 2023 and again in December 2024, consolidating approximately 51,000 ETH (valued at roughly $172 million) into a single multisig wallet, as tracked by on-chain investigator ZachXBT.
Connected Entities
5 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Blockchain Bandit→mentioned with→ZachXBT(70%)
- Blockchain Bandit→mentioned with→Bitcoin(60%)
- Blockchain Bandit→mentioned with→Ethereum(80%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- Blockchain Bandit→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- ZachXBT→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→Ethereum(60%)
Timeline(7 events)
2015
Earliest alleged Blockchain Bandit wallet exploitation activity begins, targeting Ethereum addresses generated with weak private keys.
Chainalysis Blog2016
Blockchain Bandit activity peaks; actor begins systematically draining Ethereum wallets derived from 732 compromised private keys across 49,060 transactions.
ISE Ethercombing Case Study13 January 2018
Blockchain Bandit's primary accumulation address (0x957cd4ff9b3894fc78b5134a8dc72b032ffbc464) holds 37,926 ETH, valued at approximately $54.3 million at prevailing Ethereum prices.
ISE Ethercombing Case Study31 December 2018
Blockchain Bandit's active exploitation campaign largely ceases; wallets enter dormancy.
CoinTelegraph23 April 2019
Independent Security Evaluators (ISE) publishes 'Ethercombing: Finding Secrets in Popular Places,' publicly documenting the Blockchain Bandit's methods, scale, and primary wallet address for the first time. WIRED publishes concurrent coverage by Andy Greenberg.
ISE Ethercombing Case Study16 January 2023
After approximately five years of dormancy, Blockchain Bandit wallets begin moving funds. Between January 16 and January 21, the actor transfers 51,000 ETH and 470 BTC (approximately $90 million combined) to new addresses, flagged by Chainalysis and ZachXBT.
Chainalysis Blog30 December 2024
ZachXBT identifies the Blockchain Bandit consolidating 51,000 ETH (approximately $172 million) from 10 previously dormant wallets into a single multisig wallet in the largest single fund movement attributed to the actor.
CryptoPotatoDecision Log
- slot 464361220 · hash 8mmogZmMKqw1KCsrYJQ5s5DVa3AJXkBaPPJqrqA1Yfqv
- slot 464361216 · hash ZF32U19LejaXJ7Xus1WFHDt5CkEZ26r9MfFku6YzZqQ
- slot 420808079 · hash 5cW5b4xLCQnNCMN91jmB9o7hu4MMBQMcdVeR9GLnmypm
This investigation is cryptographically anchored to the Solana blockchain (3 decisions).
model: claude-sonnet
generated: 5/4/2026, 4:04:57 PM
last updated: 11/2/2026, 4:29:34 AM
4 viewsavoid.net — verified advice for a post-truth world