On-chain forensics indicate a single actor was responsible for draining funds from eight TRON wallets and three Ethereum wallets. Most of the stolen funds, approximately 79%, were routed through instant exchange FixedFloat. The attack vector remains unknown, but Coinsbuy has since refilled the drained wallets, suggesting the team does not believe private keys were compromised.