A major crypto security incident has raised concerns after a large group of wallets was reportedly targeted in a suspected attack. The incident appears to involve wallets potentially connected to the GoMining ecosystem, with blockchain monitoring now helping track the movement of the stolen funds.
At a Glance
600+ wallets were allegedly compromised in the suspected attack.
~$2.8 million in crypto was reportedly stolen.
A GoMining-tagged service wallet suffered the largest loss of about $2.79 million.
Most affected accounts had previously held GMT, suggesting a possible connection to the GoMining ecosystem.
The attacker allegedly swapped and bridged funds across multiple chains.
Stolen assets were ultimately consolidated into ~1,147 ETH worth about $2.8 million.
The suspected theft address is 0xa7372Fa49da5e52cf31f35cCE517C4768FeD4704.
In the latest piece of Crypto Hack News, on-chain monitoring firm Specter reported on September 5, 2026, that an attacker allegedly compromised a large cluster of wallets suspected to be linked to GoMining, a Bitcoin mining and rewards platform.
The incident reportedly affected more than 600 addresses and resulted in a combined loss of approximately $2.8 million, making it one of the more notable entries in recent Crypto News coverage.
According to Specter's findings, a single service wallet tied to an address tagged as GoMining accounted for the bulk of the damage, losing roughly $2.79 million on its own. It's important to stress that the connection to GoMining remains allegedly established through on-chain clues rather than confirmed by the project itself, and the wallet cluster is only suspected to be part of the broader ecosystem.
Source: Specter Investigation
Specter's analysis found that most of the drained wallets had previously held GMT, GoMining's native token used for mining allocation and platform access. This pattern of shared token history increases the likelihood that the affected addresses belong to GoMining users or GoMining-adjacent infrastructure.
However, holding GMT alone does not prove ownership or affiliation for every one of the 600-plus addresses, and no independent confirmation has tied each address definitively to accounts. Readers should treat the ecosystem connection as a working theory supported by circumstantial on-chain evidence, not a settled fact.
Wallets affected: 600+
Estimated total loss: ~$2.8 million
Largest reported loss: ~$2.79 million
Largest affected accounts: tagged as GoMining
Final consolidation: ~1,147 Ethereum (ETH)
Theft address: 0xa7372Fa49da5e52cf31f35cCE517C4768FeD4704
Once the accounts were allegedly drained, the attacker reportedly moved quickly to obscure the trail. Stolen tokens were swapped for other crypto assets and then bridged across multiple blockchains, a common laundering pattern seen across recent security incidents this year.
Specter's tracking indicates the proceeds were eventually consolidated into approximately 1,147 ETH, worth close to $2.8 million at current prices. This kind of cross-chain movement is typically harder to trace in real time, though on-chain analytics firms can often follow the funds as they settle into fewer wallets.
Source: Wu Blockchain
Initial compromise: Multiple wallets allegedly drained in a coordinated sweep.
Cluster identified: Specter flags a group of 600+ suspected addresses.
Largest loss detected: GoMining-tagged service wallet loses ~$2.79M.
Asset swaps begin: Stolen tokens exchanged for other crypto assets.
Cross-chain movement: Funds transferred across multiple networks.
Final consolidation: Proceeds reach ~1,147 ETH (~$2.8M).
At this stage, the incident rests on on-chain monitoring and pattern analysis rather than a confirmed forensic report. Several details remain unclear: exactly how the wallets were compromised, whether every one of the 600-plus addresses actually belongs to users, and who controls the destination address now holding the consolidated ETH. Further wallet tracing, or an official statement, could help clarify the scope and cause of the breach.
Until then, crypto users are encouraged to review their wallet approvals, revoke any unnecessary or unfamiliar token permissions, and watch for suspicious outbound transactions, especially if they have previously interacted with GMT or GoMining-related contracts.
This alleged $2.8 million holdings attack adds to a growing list of hack stories in 2026 involving compromised token holder clusters. While the GMT connection strengthens suspicion of a link, key facts about attribution and root cause remain unconfirmed. Users should stay cautious, monitor their holdings, and follow updates from Specter as the investigation develops.
Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency markets are highly volatile, and details surrounding security incidents may change as investigations continue. Always conduct your own research (DYOR) and consult a qualified professional before making financial decisions.
