It seems like @payy_link was exploited for ~$1.9M in USDC Our tracing shows the proceeds were swapped into ~683 ETH and split across four fresh wallets (~200 / ~280 / ~200 / 1 ETH). Those wallets have not moved since A second batch of ~90.2k USDC is still parked in the attacker's entry wallet. It remains there and was not blacklisted by @circle at our last check Worth noting: the attack wallet's gas was seeded through Railgun two days before the drain We are actively monitoring this case and will post updates if funds move
