Pseudonymous crypto trader Frogman lost more than $4 million after assets linked to his wallets were rapidly drained across multiple networks while he was asleep in Singapore during TOKEN2049. According to Trenchbook’s onchain investigation, activity across Solana, Base and BNB Chain occurred within a 69-second window before the stolen tokens were converted and routed through multiple privacy and cross-chain services. The technical method used to obtain control of the wallets remains unknown.
Frogman said the incident occurred around 4:30 a.m. Singapore time on October 7, although the first onchain movement was recorded closer to 4:14 a.m. He said he had found no obvious compromise of his phone or email and acknowledged meeting numerous people while attending TOKEN2049. There is currently no evidence establishing that his attendance at the conference or any physical interaction in Singapore caused the breach. TOKEN2049 officially ran October 7-8 at Marina Bay Sands.
Nine Tokens Were Drained Across Multiple Networks
Initial tracing identified nine affected assets worth approximately $4 million. The largest position was 1.43 million BP valued near $1.77 million, followed by 13.96 million MARSCOIN worth approximately $1.55 million and 3.7 million CASHCAT valued around $510,000-$515,000. Those three positions alone represented roughly $3.8 million of the estimated loss, with six smaller token holdings accounting for the remainder.
The Solana portion moved particularly quickly. Onchain analysis found stolen tokens being sold in four similarly sized batches over approximately nine minutes. Trenchbook’s broader reconstruction, however, identified the initial drain across all three networks within 69 seconds. The distinction separates the compromise itself from the subsequent liquidation of the assets, which continued after the attacker had already established control.
The cross-chain scope is also important when assessing the attack vector. A stale approval or vulnerable dApp contract normally exposes assets within a narrower permission boundary, whereas simultaneous movements across unrelated networks can indicate compromise of signing authority or another shared credential. That pattern is consistent with a private-key, seed or device-level compromise, but none of those explanations has been confirmed. Frogman has not published a post-mortem identifying how access was obtained.
That makes the incident structurally different from the StablR exploit caused by a compromised key inside a weak multisig configuration or the Matcha Meta incident involving standing SwapNet router approvals. Those cases had identifiable permission boundaries; Frogman’s root cause remains unresolved.
Stolen Funds Split Across Privacy and Bridge Routes
Early reports said the attacker moved proceeds through Privacy Cash and Chainflip after converting the assets into SOL, ETH and BNB. More detailed tracing subsequently showed a more fragmented exit path. One investigation tracked approximately 13,241 SOL into Privacy Cash, while a separate 362.26 ETH leg was distributed through Relay, Across, Mayan, Chainflip, NEAR Intents, an unidentified collector and a small remaining balance. Chainflip should be described as a cross-chain swap protocol rather than a mixer, while Privacy Cash provides a privacy pool that makes public tracing beyond deposits more difficult.
The newer trace found Relay handling 212.5 ETH, or about 59% of the reconstructed Ethereum-side flow, compared with 37 ETH routed through Chainflip. Investigators also reported that they could not identify matching withdrawals for several of the large SOL deposits into Privacy Cash. That does not establish that the funds are unrecoverable, but it means the public transaction trail becomes substantially less deterministic once assets enter the privacy pool.
No recovery, freeze or return of the stolen assets has been publicly confirmed as of October 8. The case therefore remains primarily a wallet-security investigation rather than a protocol exploit. Similar incidents, including the Bankr compromise that exposed 14 managed wallets, show how custody credentials can become the security boundary even when the underlying blockchain and smart contracts continue functioning normally.
The strongest conclusion from the available evidence is that someone obtained effective signing control over assets spanning several networks and moved them with unusually tight coordination. Until Frogman or investigators identify how that authority was compromised, attributing the drain to phishing, malware, a seed phrase leak, physical access or TOKEN2049 itself would go beyond what the evidence currently establishes.
Natalie Pierce tracks the parts of crypto that move fast and rarely wait for everyone to catch up. From South Africa, she covers DeFi, AI crypto, hacks, airdrops, sentiment and emerging narratives, especially when user behavior and protocol risk start to overlap.
Her reporting is built for messy sectors. Natalie looks at incentives, reactions, security concerns, social momentum and early signs of traction without pretending every new trend is already proven. Her voice is clear and accessible, but careful enough for areas where excitement can outrun the facts very quickly.