Heleket wallet drain: Global Ledger traces roughly $527,000 from 385 wallets on TRON and Ethereum, with funds at two receiving addresses as of Nov. 10.
On-chain data shows Heleket's TRON and Ethereum wallets were emptied in about four hours on Nov. 8 — a day before the company told users it had experienced a "technical issue" and that customer funds were not affected.
In about four hours, funds from 385 Heleket-linked wallets — 378 on TRON and seven on Ethereum — were moved to two newly created addresses:
- TRON: TVMHRdw7JZH6psaEeyu8EwB8yV6wRkJ2X6
- Ethereum: 0xbbbb77c73ac32bb4723eb15b68489c31a454bd95
The two addresses received about $389,000 in stablecoins (USDT, USDC and DAI), plus 228,941 TRX, 27.9 ETH, nearly 590 million SHIB and 1,268 MATIC. At Nov. 8 market prices, the total comes to around $527,000.
As of the morning of Nov. 10, neither address had sent the funds anywhere. The only outgoing transactions were small fee payments sent back to the wallets being emptied.
Global Ledger traced the funds from all 385 Heleket wallets to the two receiving addresses. Both addresses are now labeled in Global Ledger's system, and the team is monitoring them for any movement of funds.
Heleket: "Technical Issue, Funds Not Affected"
The following evening, Heleket told users on its official Telegram channel that a technical issue over the previous 24 hours had "temporarily affected some platform features." The company said payment processing had been fully restored and that "customer data, balances, and funds have not been affected." Withdrawals were scheduled to resume on Nov. 10 at 12:00 UTC.
At the same time, Heleket asked merchants to regenerate the API keys they use to accept payments and process payouts, reset and re-enable two-factor authentication, review their webhook URLs and remove unknown IP addresses from their API whitelists — steps typically recommended when access credentials may have been exposed.
Heleket announcement about a technical issue, account security and withdrawal resumption
Heleket’s statement to users on its official Telegram channel.
Public reports on the same day said withdrawals and invoice payments had been switched off, and that Heleket's support team was citing attempts at unauthorized withdrawal.
Test Transfers First, Then a Four-Hour Sweep
The on-chain trail shows a methodical operation that began with small test payments.
Between 20:06 and 21:41 on Nov. 8, three wallets — including Heleket's operational wallet on TRON — sent small amounts of USDT, from 0.1 to 17.36 USDT, to the new TRON address.
At 22:08, the operational wallet was emptied, sending 112,467 USDT and 128,031 TRX in one go. The transfer came at an even hour, outside the wallet's usual schedule.
Over the next 40 minutes, another 58,421 USDT was pulled from 17 more wallets, including Heleket's current payout wallet, which had received the payout balance just an hour earlier. The receiving address first topped up 13 of these wallets with 35 TRX each to cover network fees; each then sent its USDT within seconds.
At 22:48, the fee wallet Heleket uses to fund new customer deposit addresses sent its entire balance of 19,151 TRX. It had funded its last deposit address three minutes earlier and had not funded another as of the afternoon of Nov. 9. By 00:17 on Nov. 9, leftover TRX had been swept from 375 wallets in two passes — including older operational and payout wallets dating back to late September.
Global Ledger graph of six Heleket wallets sending USDT and TRX to the receiving address on TRON
Six Heleket wallets, including the operational and fee wallets, send USDT and TRX to the receiving address on TRON. Source: Global Ledger
On Ethereum, the pattern repeated.
At 22:11, Heleket's operational and payout wallets sent 17.10 ETH and 3.91 ETH, again at an even hour. Between 22:18 and 22:35, after receiving a small amount of ETH for gas, the operational wallet sent 76,731 USDT, 78,465 USDC, 17,764 DAI, about 590 million SHIB and 1,269 MATIC. The payout wallet followed with 17,268 USDT and 8,040 USDC.
Global Ledger graph of Heleket’s operational wallet sending ETH, USDT, USDC, DAI, SHIB and MATIC to the receiving address on Ethereum
Heleket’s operational wallet on Ethereum sends ETH and five tokens to the receiving address. Source: Global Ledger
Four more wallets were emptied between 23:38 and 23:45.
What Was Taken
USD values use Nov. 8 prices: TRX ≈ $0.32, ETH ≈ $2,235, SHIB ≈ $0.0000046; stablecoins at $1.
Hack or Exit Scam?
Who stands behind the operation remains unclear. Whoever controls the two receiving addresses held the private keys to every wallet that was emptied, and the blockchain alone cannot show whether that was an outside attacker or someone inside Heleket.
The pattern — test transfers, pre-funded gas, the fee wallet drained minutes after its last routine payment and dust swept from hundreds of old addresses — suggests whoever ran it knew Heleket's wallet infrastructure well. It is not yet clear whether the incident will turn out to be a hack or a planned exit.
Earlier this year, Russia-linked exchange Grinex was also hacked and has not returned funds to its customers since.
Heleket’s History of Sanctions and AML Concerns
The incident comes a month after the United Kingdom added Heleket to its Russia sanctions list.
On Oct. 8, the UK designated Heleket alongside payment processor Cryptomus and Kyrgyzstan-based exchange TokenSpot as part of a package of 38 Russia-linked entities.
In May, South Korean exchange Bithumb blocked all deposits and withdrawals involving Heleket, citing suspected links to money laundering and terrorism financing.
The move followed blockchain intelligence findings that identified Heleket as a likely rebrand of Cryptomus, which was hit with a record 177-million-Canadian-dollar anti-money laundering penalty by Canada's financial intelligence unit, FINTRAC, in October 2025.
The funds remain in the two receiving addresses for now. Global Ledger continues to monitor them for any outgoing transfers.
