The proceeds of the X100 exploit were not consolidated in a single address after the attack. According to The Defiant's reporting on the incident, the stolen funds were divided into four tranches of 400 ETH each and spread across distinct wallet addresses on the Ethereum network.

Splitting stolen funds across multiple wallets is a recognized pattern in post-exploit activity. On its own, however, the transfer pattern does not establish who controls the funds, confirm a cash-out route, or prove that a mixer — a service that pools and reshuffles crypto funds to obscure their trail — was used. Each of those conclusions would require corroborating on-chain or investigative evidence beyond the transfers themselves.

What the Transfer Pattern Confirms

The observable fact is straightforward: four wallets received 400 ETH each, totaling 1,600 ETH in reported outflows from the exploited protocol. Address-level activity tied to the incident remains publicly verifiable on-chain, since Ethereum's shared ledger records every transfer between addresses, and readers can track the wallet movements through Etherscan's X100 search results, the search page of Ethereum's most widely used public block explorer.

What the wallet split cannot confirm by itself includes who controls the receiving addresses, whether those addresses are linked to a single actor or to multiple parties, and what the next movement of funds will be. Attribution beyond the transaction record requires additional evidence.

Why the Four-Wallet Structure Matters for On-Chain Monitoring

Distributing exploit proceeds across multiple addresses complicates recovery efforts and makes it harder for exchanges or compliance tools to flag the full balance in a single sweep. In past incidents, when Tether blacklisted USDT wallets linked to suspicious outflows, identification of the controlling addresses was a prerequisite — a control that exists because USDT is an issuer-managed token that can be frozen at the address level, an option that does not exist for native ETH. A four-way split introduces more addresses that each need to be independently flagged.

The 400-ETH-per-wallet allocation also keeps individual balances below thresholds that some automated compliance systems prioritize for review, though this interpretation remains speculative without direct evidence of intent.

What to Watch Next in the X100 Fund Trail

Wallet movements. The four reported wallets represent the starting point for any subsequent monitoring. Meaningful updates would include secondary transfers out of those addresses, consolidation back into a single wallet, or deposits to a known exchange address. Each such event would generate a new transaction hash — the unique identifier recorded for every Ethereum transaction — and be visible through block explorer data.

Protocol or project statements. No official statement from the X100 project team has been cited in the available reporting. Any public response, including details about the exploit method, the amount at risk, or a proposed recovery mechanism, would materially change the factual picture. In the absence of a confirmed project statement, the exploit's technical vector and the total funds at risk remain unverified in the current evidence record.

Independent transaction verification. Readers following the incident should look for specific transaction hashes, wallet addresses, and block timestamps tied to the four reported transfers. Without those identifiers, the 400-ETH-per-wallet figure cannot be independently confirmed through a block explorer. If and when those hashes are published by The Defiant or a security research team, Etherscan entries will serve as the primary verification layer. Monitoring Ethereum exchange outflows may also provide context if any of the four wallets eventually move funds toward a centralized venue.

The X100 exploit fund split is an early-stage on-chain story. The reported structure, four wallets holding 400 ETH each, is the verifiable starting point. What those wallets do next will determine whether recovery, blacklisting, or further dispersion becomes the dominant narrative.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.