Operation LedgerDrain: Tracing a Multi-Chain Crypto Drainer Across Solana, Ethereum, BSC, and Tron

Executive Summary

A victim's Ledger hardware wallet was compromised, resulting in the drainage of significant USDC holdings on Solana. Blockchain analysis reveals a sophisticated laundering operation involving multiple intermediary wallets, cross-chain bridges (notably bridgers.xyz and Chainflip), and eventual flows toward centralized exchanges (CEXs) such as Binance and KuCoin. This case study details the fund flows, key addresses, and investigative pathways that could enable asset recovery through exchange KYC data and stablecoin issuer cooperation.

The Incident

On or around late February 2026, the victim's Solana wallet CgJQgJBNYf2DDiHoqxDsRFaTEvHNTAboybetKr7xmGuk (and associated addresses) was drained. Three notable USDC transfers were sent to the primary drainer wallet:

- 10,163.16 USDC on February 26, 2026 at 17:02:46 → Solscan TX: 


- 1,706.52 USDC on February 8, 2026 at 18:24:41 → Solscan TX: 


- 3,821.37 USDC on February 1, 2026 at 14:52:56 → Solscan TX: 

 

The drainer address on Solana is 8LcBTFew56GmMwkypa2SfgPtkvzevbZWwqJvdRiJmGiN. An associated ETH drainer address is 0x51AEA6E412e974194Afc416DF0B5735de8E37D0f.

Initial Laundering on Solana

Post-drain, the drainer wallet received 453.214445269 SOL which was transferred to intermediary BjSygpGSKQG6zFhxy89GL37dDfhGKyaLV49oZtPJ4jwP on March 3, 2026 at 11:05:06 → Solscan TX: 

 

From BjSygp..., multiple large SOL transfers were made to 3tJ67qa2GDfvv2wcMYNUfN5QBZrFpTwcU8ASZKMvCTVU (identified as a Chainflip deposit address):
- 182.3 SOL on April 28, 2026 → Solscan TX: 


- 200 SOL on April 24, 2026 → Solscan TX: 


- 50 SOL on April 8, 2026 → Solscan TX: 


- 220 SOL on April 6, 2026 → Solscan TX: 


- 50 SOL on April 6, 2026 → Solscan TX: 

Cross-Chain Bridging to Ethereum

These SOL amounts were bridged via Chainflip to USDC and then to ETH, landing at several "TA Exit" addresses:

Exit 1: 0x4ea5a4c7c1512cd20fac5ed912e7e1a57d3088fd
- 6.66148439 ETH from the 182.3 SOL bridge → Etherscan TX
- 7.44365558 ETH from the 200 SOL bridge → Etherscan TX

 

Exit 2: 0x2cc2aff9117edd75a29b5291039a05c39530184b
- 1.88339201 ETH from the 50 SOL bridge → Etherscan TX

 

Exit 3: 0x097bbc0a575c99464f3a85b584f55cdfd91a0fd6
- 8.35999386 ETH from the 220 SOL bridge → Etherscan TX
- 1.92759521 ETH from the 50 SOL bridge → Etherscan TX

Further Laundering and CEX Flows (Exit 1 Cluster)

Exit 1 shows heavy interaction with 0x20A9798bA439044e207aAF52447BF0610fe85Abd and 0x2Ae129EcA322e67eF86B8f557389ba8d27773f07, which routed funds to CEX deposit addresses (Binance, KuCoin, etc.).

Proof of multiple large transfers from Exit 1 to 0x20A9798bA439044e207aAF52447BF0610fe85Abd:
- Bscscan TX
- Bscscan TX

- Binance-related withdrawal: Binance withdrawal tx
- KuCoin-related: Kucoin withdrawal tx

Additional large transfers from this cluster went to 0xc20852aEf52ee806bDF9636C336b9A2441B11fd4 (e.g., 9.5k USDT on July 12, 2026) → Bscscan TX

This address further withdrew to CEXs:
- 470 USDT to Binance on July 14, 2026 →
- 1.26k USDC to Bit2Me →

Cross-Chain Laundering via Bridgers.xyz to Tron

A significant portion of the funds was moved off BSC through a cross-chain bridge:

  • 9,500 BSC-USD was bridged via bridgers.xyz Bscscan TX
  • The funds landed on the Tron network at destination address TVrFujDCSoH3qSXwiJbfbc8cygV74GnHpU Tronscan TX

From TVrFujDCSoH3qSXwiJbfbc8cygV74GnHpU, the funds continued to be layered:

  • Multiple large transfers were made to TDH2N9ps5VfxiWEKujXuFLCrrap9qK3dxZ
  • Example: 14,000 USDT transfer Tronscan TX 
  • From TDH2N9ps5VfxiWEKujXuFLCrrap9qK3dxZ, funds were sent to TED8aGVNg4Dzg6trWkuMmN7sPazqPTpW6X Tronscan TX
  • - TED8aGVNg4Dzg6trWkuMmN7sPazqPTpW6X then made multiple withdrawals to Binance:
  • Tronscan TX 1
  • Tronscan TX 2

Inter-Exit Connections

- Exit 2 sent 2.9 ETH to Exit 1 → Etherscan
- Exit 3 sent large amounts to Exit 2 → Etherscan

This indicates a coordinated cluster of laundering addresses.

Investigative Recommendations and Recovery Pathways

1) CEX KYC Subpoenas: Use the identified withdrawal transactions to Binance, KuCoin, Bit2Me, etc., to request account holder information.
2) Stablecoin Freezes: Contact Tether (USDT) and Circle (USDC) with full transaction graphs for potential blacklisting/freezing.
3) Bridge and Chainflip Data: Request any available KYC or IP logs from bridging services (including bridgers.xyz).
4) Visualization: Tools like TRM Forensics or similar can generate clean flowcharts for law enforcement or legal proceedings.

Conclusion

This drainage exemplifies modern crypto crime: rapid multi-chain bridging followed by layered obfuscation toward fiat on-ramps. However, the traceable nature of blockchain—especially CEX on/off-ramps—provides strong recovery potential when investigators act swiftly with the right tools and partnerships. Victims and law enforcement should prioritize immediate wallet flagging, detailed transaction graphing, and collaboration with exchanges and stablecoin issuers.

Stay vigilant: Use hardware wallets with strong operational security, avoid suspicious links/contracts, and consider multi-signature setups for large holdings. For similar incidents, rapid blockchain intelligence is key to clawing back funds.

*This case study is compiled from publicly provided transaction data as of July 2026. Always consult licensed investigators or legal professionals for active recovery efforts.*