King’s Solana wallet drain: the confirmed transfer and the bridge trail

On November 2, 2026, the Solana arbitrage bot known as King was reportedly drained through transfers signed with its own key. The SentinelTX investigation anchors one victim-to-drain transfer of 359.09K USDC, followed by swaps through Jupiter-labelled accounts. It also documents four similar-sized USDC transfers from a reported forwarding address.

The reported total loss of approximately $856K has a broader evidentiary basis than that single confirmed leg. The remaining drain transfers, the Relay and Mayan bridge exits, and reported blocked funds are attributed to external reporting. They should not be presented as independently established by the Solana trace.

Roles and scope

The reported victim address is identified here as V1, the initial drain address as D1, and the reported forwarding address as F1. The distinction matters: a directly observed transfer from V1 to D1 does not, by itself, establish every subsequent connection associated with F1.

• Role: V1 · Reported victim — Address and scope: 7dGrdJRYtsNR8UYxZ3TnifXGjGc9eRYLq9sELwYpuuUu
• Role: D1 · Drain address — Address and scope: BHRayETPjvgg3BCr9H82V1D6NRwxu5v44JAaVuaod3jU
• Role: F1 · Reported forwarder — Address and scope: Ddmy5oM8xtTs1EBC6eF2SZwQfBreewQpFgtUDm51Hkqj
• Role: Investigation scope — Address and scope: Solana movements; Ethereum was not traced because a correlated full destination address was not obtained.

The report records a 38-day trace lookback parameter. Its methodology appendix does not establish exact executed query bounds. This analysis therefore focuses on the individually dated incident movements rather than claiming complete coverage of a fixed historical interval.

What the loss figure includes

The confirmed victim egress is 359.09K USDC on November 2. The report states that this matches the externally reported 359,094.73 USDC transfer. It does not establish the transaction’s time of day.

External reporting initially placed the loss near $786K. The revised figure of approximately $856K includes a further 69,869 USDT transfer. The other externally reported drain amounts are 7,173.93 USD1, 4,264.57 WSOL and 191.24 SOL. These assets retain their own units here; adding them as if they were all dollars would misstate the evidence.

• Measure: 359.09K USDC — Interpretation: One directly observed victim-to-drain leg.
• Measure: Approximately $856K — Interpretation: Revised total reported externally, not a total independently established by this trace.
• Measure: Approximately $786K — Interpretation: Earlier external headline estimate.
• Measure: Four roughly 94K USDC transfers — Interpretation: Downstream movements from F1, not additional victim losses.

Loss is counted once at victim egress. Swaps, forwarding transfers and bridge deposits must not be added again as separate losses.

The observed route

D1 began swapping USDT for SOL or WSOL through two Jupiter-labelled accounts at 07:58:47 UTC on November 2. The first displayed swap pairs 20.0 USDT with 0.212049759 SOL returned. The report then lists further small swaps through 08:01:07 UTC; these rows are examples from a larger trace, not a complete swap inventory.

Diagram 1. The observed Solana transfer and the partial onward connection. Solid arrows identify movements described as observed; the dashed D1–F1 connection lacks a transaction-hash anchor. Address key: V1 is the reported victim, D1 the drain address, and F1 the reported forwarding address. Full addresses appear above. Source: SentinelTX King report, Executive Summary and Transaction Chronology, pp. 3–4 and 8–9.

Swapping issuer-controlled stablecoins into SOL changes the available freeze mechanisms: Circle or Tether cannot freeze native SOL through their token controls. The report interprets this as consistent with freeze-evasion behaviour. That interpretation is an assessment of the pattern, not direct proof of the actor’s intent.

F1 appears in the graph built from D1, but the D1-to-F1 hop does not have a transaction hash in the report’s evidence. The four F1 outbound transfers are observed separately. Their relationship to the complete theft route remains partial.

Four similar-sized forwarding legs

On November 2, F1 sent 94.27K, 94.19K, 94.18K and 94.16K USDC to four distinct addresses. None of these four recipients carries an attribution label in the report.

Figure 2. Four observed USDC transfers from F1, shown from a zero baseline. The figures use the report’s rounded K-unit values and are not a breakdown of total loss. Address key: recipient labels use the opening characters of the full addresses in the reference register below. Source: SentinelTX King report, Transaction Chronology, p. 9.

The four displayed amounts sum to approximately 376.8K USDC using rounded values. They represent four of the 831 transactions retained in the forwarding-address trace, not its complete outbound inventory. Similar sizes can reflect bridge-order sizing or programme behaviour; they do not alone establish deliberate structuring.

The report assesses the amounts as consistent with externally described 1,000-SOL Mayan orders at roughly $94 per SOL. It explicitly distinguishes that inference from decoded bridge-order evidence.

The bridge trail and recovery limits

External reporting describes a Relay test of 1 SOL followed by a blocked 500-SOL attempt. It also describes 13 Mayan deposits: 10 filled orders delivering 251.15 ETH and three blocked orders totalling 232,875 USDC. The reported bridge sequence falls between 13:07 and 14:12 UTC on November 2.

Those figures do not constitute confirmed recovery. The approximately $280K reportedly blocked at the bridges, the Ethereum destination’s reported lack of movement, and ownership-related claims remain unverified in the report. No correlated Ethereum destination was established and no custodial-exchange deposit leg was identified.

The absence of an indexed Mayan order under D1 or F1 does not disprove the reported route. The external account describes programme-owned deposit accounts, which may be indexed separately. Bridge-order records and a full destination address are therefore the report’s principal follow-up leads.

Conclusion

The firmest finding is a 359.09K-USDC victim-to-drain transfer followed by observed Jupiter activity. Four roughly 94K-USDC forwarding legs add detail, but they do not complete the missing inbound connection or establish the cross-chain exit.

Figure 3. The report’s conclusion separates confirmed movement, partial linkage and externally reported bridge outcomes. Source: SentinelTX King report, Conclusion, pp. 15–16.

The report’s assessment is consistent with private-key compromise of an automated-trading hot wallet rather than a demonstrated smart-contract exploit. The signing key was not independently decoded in the investigation, so this remains an assessment. No common-control connection to another incident is established.

The practical priorities are preservation of bridge order and custody records, identification of the full Ethereum destination, completion of the missing Solana transfer anchors, and preservation of the bot host’s access and key-management logs. Any recovery prospects depend on the actual custody and refund status of the reported blocked funds; the report does not establish a recovery amount.

Selected evidence and source notes

E1 · Confirmed victim egress, November 2, 2026: 359.09K USDC. Transaction hash: 2sUAaakTAfQ1J1WdbkafEMemG9m96aHqvo887Ajix2i4Z4QoGtinPTh3QdtwGvzcjmHuChr6Mx7CVs7na7xhG65r.

E2 · First displayed Jupiter swap, November 2, 07:58:47 UTC: 20.0 USDT and 0.212049759 SOL returned. Transaction hash: 3qV3F4VLVynZWVCxEsKZjhVEnoqL1WBT9DZNY9kmvj8WHVo7H1yqNwqdPLfuA3NRyaBmsvb5FuY3gZiG22sXQDJD.

F1 recipient register:

• 94.27K USDC · ASdAsZzw5sbJdDVnUWXQn1GNJf64zpCRQRRGWLWj8VFa
• 94.19K USDC · 4rnkhP9nCPTzeqfL63tDKJgeobRBrHxJ5zwyYBbWGiaK
• 94.18K USDC · 3ThBU4ptq5z1Cf9P8svrWSWH6P43g5Fot2AFB2G6wuv2
• 94.16K USDC · DrCVfAEo1uLr5oZagLhMMBKhDM54eQtTpPKTa1TQ1dcK

Source: SentinelTX, “King Solana arbitrage-bot wallet drain — November 2, 2026,” CASE-ASYNC520, generated November 9, 2026. This article adapts that report; it is not a separate independent investigation. The victim wallet’s high-volume history and more than 20 downstream counterparties were not fully examined. Ethereum and bridge outcomes remain outside the directly established route. Graph-wide totals include commingled third-party activity and are not used as incident losses.