Aquifer’s Cross-Chain Trail: 1,000.7955 ETH and 11 USDC Deposits to Hyperliquid

Executive Summary

Public research describes an Aquifer Solana venue exploit on 31 August 2026. This investigation separates the reported exploit mechanism from the later transaction-anchored proceeds trail. Ethereum records confirm a transfer of 1,000.795547188808275967 ETH on 1 September to a relay address. Eleven subsequent Arbitrum USDC transfers to a contract labeled Hyperliquid: Deposit Bridge 2 total 2,470,625.249359 USDC.

The deposit total does not establish a current Hyperliquid balance, the identity of the operator, or an ability to freeze assets. The Solana provenance of the largest Ethereum arrival remains unresolved. Reported counts of 212 calls and 18 vaults were not independently re-enumerated.

The Finding in One Screen

Three Findings That Matter

1. The EVM handoff is anchored to a transaction. The large ETH transfer is directly identified. It does not resolve its complete upstream Solana provenance.

2. The destination is a deposit endpoint, not a final location. Eleven transfers establish gross USDC deposits. They do not establish current account holdings, identity or recoverability.

3. Cross-chain confidence is uneven. One fee-adjusted burn/mint pair is supported in retained evidence. Matching amount and time alone are insufficient for the other ten routes.

When Did the Verified Trail Move?

Which Ethereum Transfer Anchors the Trail?

A successful Ethereum transfer on 1 September at 20:37:23 UTC forwarded 1,000.795547188808275967 ETH from the explorer-labeled Aquifer Exploiter 1 address to the relay. This is a verified transaction anchor, not proof that every upstream Solana transfer has been matched.

The dashed Solana segment marks unresolved provenance; the deposit endpoint does not imply current holdings.

What Do the Eleven Deposits Establish?

The retained ledger records eleven successful transfers from the same Arbitrum depositor to the explorer-labeled deposit contract. Their gross sum is 2,470,625.249359 USDC. The full transaction ledger is preserved in Appendix B below.

The destination is explorer-labeled Hyperliquid: Deposit Bridge 2. These transactions establish deposits to that contract. They do not establish the subsequent trading-account balance, withdrawals, beneficial ownership, or the availability of a freeze mechanism. Those conclusions require separate evidence.

Which Cross-Chain Pair Is Supported?

SentinelTX saved evidence supports one Ethereum burn and Arbitrum mint pair using decoded message fields and matching amounts. The other ten routes remain amount-and-time correlations. A message hash and attestation were not established in the retained evidence, so this report does not claim complete cryptographic proof for all routes.

The fee-adjusted mint equals the last verified deposit. This figure illustrates one supported pair, not a universal proof of every route.

Why Must the Privacy Branch Be Kept Separate?

A separate relay-funded branch received 1 ETH and interacted with wrapping and shielding infrastructure. Its amounts must not be confused with the much larger Arbitrum deposit route or with total activity in a shared helper contract. The following values come from the saved SentinelTX investigation, not a fresh independent replay of every internal call.

The lower branch is separate from the main Arbitrum deposit route. Its unreconciled remainder is explicitly retained rather than assigned by inference.

The shared helper’s aggregate volume is not Aquifer proceeds. The earlier 54.53 WETH preview is not attributed to this case. A later call from the branch wallet remains unverified; the privacy boundary prevents a supported claim about its final owner or destination.

What Remains Unproven?

Where Further Investigation Can Change the Conclusion?

The useful next steps are evidence-specific, not generic wallet advice. Each would resolve a different boundary in this case.

These are proposed verification actions, not claims that a service can freeze funds or that recovery has occurred.

Conclusion

The strongest result is a transaction-anchored EVM trail: one large ETH handoff and eleven independently verified Arbitrum USDC deposits. The key analytical distinction is between seeing a deposit endpoint and proving where the money is now. Upstream provenance, complete cross-chain message matching, and onward account activity remain separate questions. Neither a service label nor a matching amount establishes an operator’s identity.

Appendix A — Full Incident Addresses

Appendix B — Full Arbitrum Deposit Ledger

All eleven transactions below were checked against visible Arbiscan records: successful status, the same sender and destination, and native Arbitrum USDC. Times are UTC in 2026. The total is gross deposited USDC, not a current account balance or independently proven total stolen proceeds.

Sources and Revision Scope

The report combines the saved SentinelTX investigation with visible Etherscan and Arbiscan transaction checks. Public incident context: Bitquery Aquifer investigation. Reported exploit counts and mechanism are public research, not an independent re-execution performed for this report. The full transaction links above identify the directly checked transfer evidence.

Editorial revision: 6 October 2026. The structure and explanations were revised; no new on-chain observations or current-balance claims were added.