Fantom Foundation Wallets Bled Across Five Chains in Overnight Breach

More than $7 million disappeared from a cluster of wallets labelled as belonging to the Fantom Foundation, in an incident discovered the day before this report. Fantom's semi-retired co-founder Andre Cronje moved quickly to clarify that the theft hit an employee's holdings rather than the Foundation's own treasury.

Three hours after Cronje's tweet, the Foundation issued its own acknowledgement, confirming a loss of $550,000. The statement described the compromised addresses as Foundation wallets that were "no longer utilized" and had since been "reassigned" to an employee — raising the obvious question of why previously used wallets were handed off rather than fresh ones generated. Since the Foundation has never publicly disclosed its wallet addresses, even after Cronje's earlier claims of holding more than 30 years of runway thanks to profits farmed during 2020's DeFi Summer, outside observers have little choice but to take the loss figures on trust.

Credit for tracking the incident goes to researchers Tayvano and Spreek.

The attack began just before 4:00 UTC the previous day, ultimately draining at least 12 addresses across five chains: Ethereum, Fantom, Optimism, BNB Chain, and Avalanche.

How the attacker or attackers gained access remains unconfirmed. The fact that so many related addresses were drained within a short window has led Tayvano to suggest a compromised password manager — possibly LastPass — as the likely entry point. That theory looks considerably more credible than the initial account offered by a Fantom Foundation Telegram admin, which attributed the breach to a "zero day exploit on crome" (sic).

The addresses tied to the attacker, holding a combined $7.5 million, were identified as:

• 0x1d93c73d575b81a59ff55958afc38a2344e4f878 — active on Ethereum, Fantom, and Optimism
• 0x2f4f1d2c5944dba74e107d1e8e90e7c1475f4001 — active on Ethereum, Fantom, Optimism, Avalanche, and BNB Chain
• 0xdadc0421ee1b5426fca3db22f0a94a3bad5a329d — active on Ethereum and Fantom

Funds were ultimately funneled into a single Ethereum consolidation address holding 4.5k ETH, worth roughly $7.1 million: 0x0b1f29df74a19c44745862ab018d925501fe9596.

A more complete breakdown of victim addresses, labels, and how they relate to one another is available in Tayvano's thread; Beosin also circulated its own summary table.

The confused public messaging around this incident wasn't limited to Fantom. Earlier in the week, Cointelegraph published an unsourced report claiming Bitcoin ETF approval, triggering more than $100 million in liquidations. Given the scale of that fallout, one might have expected more caution from the outlet's social accounts when covering the Fantom story — but that apparently wasn't the case. Cointelegraph's own clarification of the ETF story, which pointed to its social media team and, vaguely, to "the society" and "the technology" more broadly, arguably deserved more careful tweeting and cross-referencing against its own reporting in the days that followed.

Bad fortune has been a recurring theme for the Fantom ecosystem. Cronje had previously touted the size of the Foundation's treasury, likely in an effort to reassure the community following FTX's collapse. If those holdings — reportedly including over $100 million in stablecoins — remain intact, the Foundation's treasury alone now exceeds Fantom's entire network TVL, which has fallen steadily from more than $500 million earlier in the year to about $40 million today. That decline was punctuated in July by the collapse tied to Multichain. Whether justified or not, this latest incident has once again rattled users of the chain.