← EVM Cross-Chain Wallet-Drain Campaign (June 2026)reviewed 2026-09-06 · 19 claims checked
Fact-check findings
What an automated fact-checker found when it re-read EVM Cross-Chain Wallet-Drain Campaign (June 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #3[disputed][awaiting moderator]in the summary
“across at least a dozen EVM-compatible chains”
reviewerThe campaign spanned 'at least a dozen' (roughly 12) EVM-compatible chainsThe page's own 'Flagged Aggregation Address' and 'Chains Affected' sections both state 'approximately 20' EVM chains, and independent reporting consistently cites 20 networks. The summary's 'at least a dozen' understates this and contradicts the rest of the page.Proposed correction (not yet applied)across approximately 20 EVM-compatible chains - #4[disputed][awaiting moderator]in the timeline
“ZachXBT publicly disclosed an active, automated cross-chain wallet-drain campaign affecting hundreds of wallets across at least 12 EVM chains, with over $107,000 consolidated into aggregation address 0xAc2e5153170278e24667a580baEa056ad8Bf9bFB. Root cause listed as unidentified.”
reviewerThe campaign spanned 'at least 12' EVM chains (timeline entry)Same underlying chain-count error as the summary; both should read 'approximately 20' to match the page's own other sections and independent reporting.Proposed correction (not yet applied)ZachXBT publicly disclosed an active, automated cross-chain wallet-drain campaign affecting hundreds of wallets across approximately 20 EVM chains, with over $107,000 consolidated into aggregation address 0xAc2e5153170278e24667a580baEa056ad8Bf9bFB. Root cause listed as unidentified.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #8[partially supported][awaiting moderator]in section: Chains Affected and Loss Distribution
“Smaller but nonzero losses were also reported on Manta Pacific ($784), zkSync Era ($691), Ink ($565), Blast, Gnosis Chain, and Ronin.”
reviewerSmaller losses also occurred on Manta Pacific ($784), zkSync Era ($691), Ink ($565), Blast, Gnosis Chain, and RoninThe specific dollar figures appear accurate per independent reporting, but none of the three sources actually cited for this section contain this granular breakdown — the real supporting source (Blockonomi/similar wire pickups) is not among the section's citations, so the claim is a citation mismatch rather than a factual error. - #15[partially supported][awaiting moderator]in the timeline
“Security researchers flagged wallet draining from Trust Wallet v2.68 users; white-hat researchers reportedly disrupted attacker infrastructure. Approximately 2,520 addresses were affected, with losses of $7–8.5 million.”
reviewerWhite-hat researchers reportedly disrupted attacker infrastructure around December 25, 2025The underlying fact is corroborated by other reporting (Security Affairs), but the specific source cited for this timeline entry (The Hacker News 'hack' article) does not contain this detail — a citation-support gap rather than a factual error.
confirmed
15 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Campaign Overview
“On January 2, 2026, blockchain investigator ZachXBT publicly warned via his Telegram investigation channel that 'hundreds of wallets are currently being drained on various EVM chains for small amounts (<$2k total per victim).'”
reviewerZachXBT's direct quote that hundreds of wallets are being drained across EVM chains for under $2k per victimQuote wording matches aggregate reporting across multiple independent outlets covering the January 2, 2026 disclosure. - #2[confirmed][no action needed]in section: Campaign Overview
“Total confirmed losses stood at approximately $107,000 at the time of ZachXBT's initial disclosure, with the figure expected to climb as the attack was still active.”
reviewerTotal confirmed losses were approximately $107,000 at the time of ZachXBT's initial disclosureFigure and hedge language directly confirmed by The Block and The Crypto Basic. - #5[confirmed][no action needed]in section: Flagged Aggregation Address
“Multiple independent reporting outlets corroborated that funds drained from victim wallets on approximately 20 EVM-compatible blockchains were consolidated into this address in small increments consistent with the sub-$2,000 per-victim theft pattern.”
reviewerFunds from approximately 20 EVM-compatible blockchains were consolidated into the flagged aggregation addressThe '~20 chains' figure here is the one corroborated by independent reporting; it is the summary and timeline[4] that are out of step with it. - #6[confirmed][no action needed]in section: Flagged Aggregation Address
“The wallet address 0xAc2e5153170278e24667a580baEa056ad8Bf9bFB was publicly flagged by ZachXBT as the central aggregation point for stolen funds in this campaign.”
reviewerAddress 0xAc2e5153170278e24667a580baEa056ad8Bf9bFB was publicly flagged by ZachXBT as the central aggregation pointAddress string verified character-for-character (42 chars, valid checksum length) against multiple independent reports. - #7[confirmed][no action needed]in section: Chains Affected and Loss Distribution
“Reported chain-level data attributed the largest share of losses to Ethereum ($54,655, approximately 51% of the total), followed by BNB Chain ($25,545, approximately 24%), Base ($8,688), Arbitrum ($6,273), Polygon ($3,498), Optimism ($1,480), Zora ($994), Linea ($909), and Avalanche ($386).”
reviewerChain-level breakdown: Ethereum $54,655 (51%), BNB Chain $25,545 (24%), Base $8,688, Arbitrum $6,273, Polygon $3,498, Optimism $1,480, Zora $994, Linea $909, Avalanche $386Every figure in this sentence matches Cryptopolitan's reporting exactly. - #9[confirmed][no action needed]in section: Suspected Attack Vectors (Root Cause Unconfirmed)
“As of ZachXBT's initial public disclosure on January 2, 2026, the root cause of the wallet drains had not been identified.”
reviewerAs of January 2, 2026 the root cause of the wallet drains had not been identifiedConfirmed, and remains true as of the current review date — no subsequent root-cause attribution was found in later reporting. - #10[confirmed][no action needed]in section: Suspected Attack Vectors (Root Cause Unconfirmed)
“Supply-chain compromise of wallet software — the December 24–26, 2025 Trust Wallet browser-extension incident (version 2.68) exposed seed phrases and private key material for approximately 2,520 wallets, and some reporting noted that the timing and victim profile overlapped with the ZachXBT-flagged campaign, though no direct technical link was publicly confirmed”
reviewerTrust Wallet browser-extension incident (Dec 24-26, 2025, v2.68) exposed seed phrases/keys for ~2,520 wallets, with unconfirmed overlap to the ZachXBT campaignWallet count and hedged 'no direct technical link confirmed' language both check out against the official Trust Wallet post and contemporaneous reporting. - #11[confirmed][no action needed]in section: Suspected Attack Vectors (Root Cause Unconfirmed)
“Fake-MetaMask phishing emails — reports described fraudulent emails impersonating MetaMask and claiming a mandatory security upgrade was required, which when followed led victims to sign malicious approval transactions.”
reviewerFake-MetaMask phishing emails claiming a mandatory security upgrade led victims to sign malicious approval transactionsMatches BeInCrypto's reporting on the phishing-email theory. - #12[confirmed][no action needed]in section: Connection to Trust Wallet v2.68 Supply-Chain Incident
“The compromise traced to the industry-wide 'Shai-Hulud' supply-chain attack of November 2025, in which Trust Wallet's developer GitHub secrets — including the Chrome Web Store API key — were exposed.”
reviewerThe Trust Wallet compromise traced to the 'Shai-Hulud' supply-chain attack of November 2025, exposing GitHub secrets including the Chrome Web Store API keyConfirmed directly from Trust Wallet's own incident post; the broader Shai-Hulud campaign is independently documented as detected around November 24, 2025. - #13[confirmed][no action needed]in section: Connection to Trust Wallet v2.68 Supply-Chain Incident
“Trust Wallet confirmed approximately 2,520 wallet addresses were drained, with total impact estimated between $7 million and $8.5 million.”
reviewerTrust Wallet confirmed ~2,520 wallet addresses drained, total impact $7M-$8.5MThe $7M-$8.5M range accurately reflects the two distinct figures reported across the two cited Hacker News articles. - #14[confirmed][no action needed]in section: Connection to Trust Wallet v2.68 Supply-Chain Incident
“Trust Wallet issued version 2.69 as a rollback, initiated a voluntary reimbursement program, and disabled compromised API credentials.”
reviewerTrust Wallet issued v2.69 rollback, started a voluntary reimbursement program, and disabled compromised API credentialsAll three sub-claims verified verbatim against Trust Wallet's own incident update. - #16[confirmed][no action needed]in section: Victim Profile and Attack Methodology
“Chainalysis data cited in contemporaneous reporting noted that 2025 saw approximately 158,000 wallet breaches affecting more than 80,000 unique victims, with victim counts roughly doubling over three years, providing broader context for the frequency of such campaigns.”
reviewer2025 saw approximately 158,000 wallet breaches affecting more than 80,000 unique victims, roughly doubling over three years (Chainalysis)Directly confirmed by the cited Yellow article, which itself attributes the figures to Chainalysis. - #17[confirmed][no action needed]in section: Consumer-Protection Recommendations
“Revoke.cash supports over 100 networks.”
reviewerRevoke.cash supports over 100 networksConfirmed directly from the linked tool's own homepage; no link rot detected.citedrevoke.cash/ - #18[confirmed][no action needed]in section: Broader Context: Rising EVM Wallet-Drain Threat
“a separate fake-MetaMask phishing campaign documented in May 2026 (alleged losses exceeding $9 million across 400+ addresses)”
reviewerA separate fake-MetaMask phishing campaign in May 2026 caused losses exceeding $9 million across 400+ addressesFigures match the cited Phemex source exactly. - #19[confirmed][no action needed]in the timeline
“ZachXBT flagged a separate but related fake-MetaMask phishing campaign — distinct from the January 2026 drains — alleging over $9 million stolen from 400+ addresses via malicious 'mandatory upgrade' emails tricking users into signing setApprovalForAll transactions.”
reviewerZachXBT flagged a May 28, 2026 fake-MetaMask phishing campaign distinct from the January drains, alleging over $9M from 400+ addressesDate, dollar figure, and address count all verified against the cited source.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.