Cardano

DeFi

USDCx

SundaeSwap

A Cardano wallet-drain cluster may be larger than the first publicly named victims, after onchain analysis flagged up to 178 unique source stake keys tied to a rapid sweep and USDCx liquidation path.
The analysis, shared by Cardano investigator TheRefreshCNFT, <a href="https://x.com/therefreshcnft/status/2069249401206259935?s=46&amp;t=vm3Gh7cIvaITmvaQCJudNQ" rel="noopener noreferrer nofollow">identified</a> 196 drain or sweep transactions between June 21 at 20:29:41 UTC and June 22 at 00:34:06 UTC. The cluster included 178 unique source stake keys, 191 unique source payment addresses, 1,180 source-side asset rows and 12,068,250 ADA in source-side ADA input.
That ADA figure should be handled carefully. It is a source-side input total across the analyzed transactions, not a confirmed net loss retained by the attacker. Cardano’s UTXO model can include larger transaction inputs than the final stolen amount, especially when wallets, tokens, change outputs, swaps and consolidations are involved.
The stronger finding is the pattern. A broad set of wallet sources appears to have been swept into three main recipient wallets before assets moved through a USDCx selloff path. The analysis grouped the recipient wallets as A, B and C, with 48 sweep transactions into A, 53 into B and 95 into C.
The size distribution also points to a serious user-level incident. The analysis found 110 source stake keys with at least 1,000 ADA in source-side input, 57 with at least 10,000 ADA and 17 with at least 100,000 ADA. That suggests the affected cluster may include larger wallets that have not yet publicly reported losses.
<h2 id="usdcx-wallet-looks-like-a-liquidation-pass-through">USDCx Wallet Looks Like A Liquidation Pass-Through</h2>
The USDCx proceeds wallet appears to have acted as a liquidation pass-through rather than a long-term holding address. The wallet identified in the analysis, shown publicly as <code>addr1q8nw4...qhl98qc</code>, had 55 transactions from June 21 at 20:45:21 UTC to June 22 at 01:59:47 UTC.
It received a net 1,685,675.993581 USDCx and sent out 1,685,672.99 USDCx, leaving only about 3.003581 USDCx. That pattern points to fast conversion or routing rather than an address holding the proceeds for long.
The three upstream recipient wallets fed most of the USDCx flow. Wallet A contributed about 800,805 USDCx into the proceeds route, wallet B contributed about 408,797 USDCx, and wallet C contributed about 468,204 USDCx. The analysis also noted DEX or pool-side USDCx inputs inside selloff transactions, but treated those as swap mechanics rather than additional victim wallets.
USDCx is a <a href="https://cardano.org/news/2026-02-27-usdcx-goes-live-on-mainnet/" rel="noopener noreferrer nofollow">USDC-backed stablecoin on Cardano</a> built through Circle’s xReserve infrastructure. It is designed to be backed 1:1 by USDC and usable as a Cardano Native Asset across wallets and DeFi apps. IOG previously said more than <a href="https://www.iog.io/news/usdcx-on-cardano-here-s-what-happened-in-the-first-seven-days" rel="noopener noreferrer nofollow">15 million USDCx moved onto Cardano</a> in its first week, with early integrations across Minswap, SundaeSwap and Liqwid.
<h2 id="root-cause-remains-unconfirmed">Root Cause Remains Unconfirmed</h2>
The drain cluster does not yet have an official public root-cause statement from IOG, the Cardano Foundation, a wallet provider, a DEX or an independent security firm. There is also no public postmortem confirming whether the compromise came from a malicious dApp, fake wallet interface, exposed keys, harmful transaction prompts, compromised frontend, bad signing flow or another attack route.
That uncertainty matters. The current evidence supports a large onchain sweep pattern and a USDCx selloff route. It does not prove that Cardano itself was hacked, that USDCx failed, or that a specific DeFi protocol was exploited. The safer framing is a wallet-level compromise cluster until a named project, wallet provider or security team publishes a verified cause.
The incident still fits a known crypto theft pattern. Wallet drainers often move assets through consolidation wallets, swap routes and stablecoin exits before victims understand what happened. A <a href="https://cryptoadventure.com/crypto-wallet-drainers-explained/" rel="noopener noreferrer nofollow">crypto wallet drainer</a> can work through a malicious signature, fake claim, harmful transaction, compromised interface or approval flow, not only through seed phrase theft.
The Cardano-specific detail is the stake-key count. A stake key can group multiple payment addresses under the same wallet identity structure, which is why 178 source stake keys and 191 payment addresses can appear in the same cluster. For investigators, that helps separate one user with multiple addresses from many distinct wallet sources. Strong <a href="https://cryptoadventure.com/how-to-become-an-on-chain-investigator-everything-you-need-to-know/" rel="noopener noreferrer nofollow">onchain investigation</a> depends on that kind of clustering rather than counting raw transactions alone.
<h2 id="users-should-check-cardano-wallet-activity">Users Should Check Cardano Wallet Activity</h2>
Cardano users should review wallet activity from June 21 to June 22, especially if they held ADA, NFTs or Cardano native assets in wallets that interacted with DeFi apps, unfamiliar sites, token claims, swaps or liquidity pools during the window.
Any wallet that shows unexplained outgoing transactions, missing NFTs, missing native assets, unfamiliar token swaps or sudden USDCx movements should be treated as exposed until the cause is known. Moving remaining assets to a fresh wallet generated from verified software is safer than waiting inside a wallet that may already have signed a harmful transaction or exposed a key path.
Users should also avoid rushing into fake recovery links, fake “claim back funds” pages or unsolicited support messages. Drainer incidents often trigger follow-up scams that target victims a second time. The same caution applied in recent fake-wallet cases, including <a href="https://cryptoadventure.com/fake-ledger-app-on-apple-app-store-drains-over-400000-in-bitcoin/" rel="noopener noreferrer nofollow">malicious app-store impersonation attacks</a> where users lost funds after trusting software that looked legitimate.
The current verified trail is a June 21–22 Cardano wallet-drain cluster, 196 sweep transactions, 178 source stake keys, 191 source payment addresses and a USDCx proceeds route that moved about 1.685 million USDCx through a pass-through wallet. The missing piece is an official root-cause report naming the compromised surface and confirming whether the affected users were exposed through the same dApp, wallet flow, signing prompt or offchain credential path.
The post <a href="https://cryptoadventure.com/cardano-wallet-drain-cluster-points-to-178-stake-keys-as-usdcx-proceeds-move/" rel="noopener noreferrer nofollow">Cardano Wallet Drain Cluster Points To 178 Stake Keys As USDCx Proceeds Move</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Cardano Wallet Drain Cluster Points To 178 Stake Keys As USDCx Proceeds Move

Table of Contents

Crypto Adventure

Other articles published on Jun 23, 2026

Join our free newsletter for daily crypto updates!