October 08, 2026

For three days, someone tried to rob the Bitget hacker. With a lookalike address

Analyst MASTR spotted a funny story on-chain. We checked it transaction by transaction and found more.

WHO IT IS

The wallet labeled "Bitget Exploiter 4" is one of the addresses from the September 24 Bitget hack. We verified the link ourselves: it received 10,000 ETH directly from Bitget Exploiter 1.

WHAT HAPPENED

On September 29, the thief was moving money to his own wallet 0xf7bC92…96C3: 19 transfers in one day, 4,151.75 ETH in total.

An address-poisoning bot was following him. A lookalike wallet, 0xf7bc3e…96c3, kept sending him dust, 0.000000001 ETH at a time. For example, at 07:46:11 UTC the thief sent himself 730 ETH, and at 07:49:11 the lookalike had already dropped its dust.

Why: the lookalike shares the same first 6 and last 4 characters. Wallets show addresses shortened, so the dust sits in the history right next to the real one. The bet is that next time the thief copies the address from history and sends hundreds of ETH to the scammer.

WHAT WE FOUND

• It wasn't a one-off: the lookalike sent 28 dust transfers over three days, from the evening of September 27 to the night of the 29th, usually a few minutes after each of the thief's transfers.
• It worked 0 times: none of the thief's 467 transactions went to the lookalike.
• The real wallet 0xf7bC92…96C3 received 22,892 ETH in total (about $59M) and is empty now. The largest outflow, 5,789 ETH, went through a LayerZero contract.

WHY IT MATTERS TO YOU

The bot doesn't care who it fools: it hunts any large transfer. If dust from a similar-looking address shows up right after you send money, that's it.

• Never copy an address from your transaction history.
• Check the middle of the address, not just the start and end.
• Send a small test first when the amount is large.

All three addresses are in our database now: the thief and his wallet are flagged as theft, the lookalike as address poisoning. If funds from them reach you, the check will show it.

🔎 Check an address: https://amlconsensus.com/en