About 180,000 solana (SOL) tokens are suspected to have leaked from a large wallet believed to hold early distribution allocations, raising the possibility of theft. On-chain analysts identified signs that some funds were bridged to the Ethereum network and began further tracking.

On July 11, CoinPost reported that on-chain investigator ZachXBT said on Telegram that about 180,900 SOL, worth about $14.2 million, may have been stolen from an early whale wallet linked to Solana’s genesis block allocation.

On-chain data also showed the path of the fund movements. About 181,026 SOL moved from the address flagged as the victim wallet (HwtbQB...Pads) to a theft address (Ffd1oB...C2bE). Of that, 60,000 SOL appeared to have been bridged from Solana to the Ethereum network via another address (653pnn...mswp). ZachXBT said TRM’s on-chain data also supports this flow of funds.

The case is drawing attention because the victim wallet is believed to be linked to Solana’s early distribution allocations. Solana issued a total of 500 million SOL in the genesis block when it launched its mainnet beta in March 2020. At the time, tokens were distributed in concentration to a small number of large wallets. About 37.8 percent, or 189 million SOL, was allocated to private investors, about 12.8 percent, or 64 million SOL, to Solana Labs, and about 10.4 percent, or 52 million SOL, to the Solana Foundation. The victim wallet is also believed to be one of the whale wallets holding such early allocations.

In the investigation, staking withdrawals and bridge transfers were flagged as key anomalies. ZachXBT said he is tracking the case jointly with Specter Investigation and that the group first spotted unusual movements during the unstaking and bridging process. Funds then moved from the victim wallet to the theft address, and some appeared to have crossed to the Ethereum network.

The market is also focusing on security issues in early whale wallets and the impact that the movement of large holdings could have. In particular, funds bridged to Ethereum are expected to be a key clue in tracking subsequent routes and whether they are cashed out.

So far, the case is being assessed as a theft possibility stage based on on-chain data. Still, with fund transfers between addresses and bridge-transfer records confirmed, the scope of the investigation has been narrowed considerably.

Key points to watch include where the remaining SOL that has not yet moved ends up and confirmation of the victim wallet’s actual owner. If the timing of the unstaking, additional bridge-use records and analysis results of related addresses are disclosed, the nature of the case is expected to become clearer.