Crypto trader Frogman loses $4 million to a wallet drain on TOKEN2049's opening morning

Onchain data shows attackers sold tokens siphoned from crypto trader Frogman’s Solana wallet in four equal lots in the span of nine minutes.

Frogman said he has found no evidence of a breach on his phone or email.

The drain hit at 4:14 a.m. as TOKEN2049 opened in Singapore

The tokens left the wallet at 4:14 a.m. Singapore time, or 20:14 UTC Tuesday. Frogman was in Singapore for TOKEN2049, which opened that morning.

The conference runs October 7 and 8 at the Marina Bay Sands. It sold out and pulled in 25,000 attendees from 160 countries.

“Was drained for $4m USD this morning at 4:30am while I was asleep,” Frogman wrote on X at 1:21 p.m. local time. He said he was “not sure how it happened yet” and had met “a lot of new people” in Singapore.

His 4:30 a.m. estimate is 16 minutes off the onchain timestamp. He thanked “the teams and individuals who are helping with the investigation” and said he would share more when he could.

Two of his wallets were hit, with losses of about $4 million. Onchain analyst EmberCN, also known as Yu Jin, flagged the transactions about five hours before Frogman confirmed the theft.

BP made up $1.77 million of the haul

The haul covered nine tokens. The biggest was 1.43 million BP worth about $1.77 million, and the second biggest was 13.96 million MARSCOIN worth about $1.55 million.

The third largest position, about 3.7 million CASHCAT, was worth about $515,000. Six smaller holdings made up the rest.

The attacker converted the tokens to ETH, BNB and SOL. The money then went through Privacy Cash and Chainflip, two services that make the money harder to trace from wallet to wallet.

September’s hacks followed a similar pattern, Cryptopolitan reported. Stolen funds were moved in hours and mixed in days through DEX swaps, the Tornado Cash mixer, and no-KYC exchanges.

Some proceeds from September were also swapped into Monero and shielded Zcash. The biggest losses came from compromised wallet keys, which gave hackers access to Bitget’s hot wallets.

September was the worst month of 2026 so far, with hackers stealing $766.49 million. Bitget’s hack alone accounted for $387.5 million.

The Liquid Network exploit reaped $320 million, although about $285 million was returned. Losses for the third quarter reached $1.2 billion, a 53% increase from the second quarter.

Incidents were up 12.8% quarter-on-quarter to 247. More than 11% of these incidents were phishing.

In Europe, private crypto holders also faced more targeting, with 39 incidents in the first half of 2026 compared to 14 for all of 2025.

If you're reading this, you’re already ahead. Stay there with our newsletter.