Security

ZachXBT Flags Undisclosed $735K TeleSwap Bridge Exploit as Week's Bridge Hack Toll Tops $5.7M

2026-07-23

Pseudonymous blockchain investigator ZachXBT has publicly called out TeleSwap, a cross-chain Bitcoin bridge, for failing to disclose a six-figure exploit nearly a week after it occurred. According to the investigator, suspicious outflows of more than $735,000 drained from TeleSwap's Bitcoin hot wallet on July 15, after which the wallet stopped processing transactions entirely. Two hours before the finding was published, the attacker moved the stolen funds into Tornado Cash, the sanctioned Ethereum mixing service long favored by hackers looking to obscure the trail of stolen crypto.

ZachXBT called out the firm for "not disclos[ing] the incident publicly after five days," tracking the suspicious outflows and the subsequent freeze of TeleSwap's Bitcoin hot wallet. Crypto industry outlet Protos, which reviewed the finding, reported that ZachXBT revealed the self-styled "Bitcoin DeFi hub" TeleSwap had been exploited the previous week, on July 15. Security firm SlowMist's real-time hack-tracking feed corroborated the same figures and timeline, noting that suspicious outflows of over $735,000 occurred from its Bitcoin hot wallet, which then stopped processing transactions, and five days later, the project had still not publicly disclosed the incident, with the attacker moving funds toward Tornado Cash for laundering.

TeleSwap markets itself as a bridge that allows Bitcoin to move across other blockchains without relying on a traditional custodial model. The lack of any public statement from the team — even after outside researchers began circulating wallet addresses tied to the theft — has become a point of criticism in itself, echoing a familiar pattern in DeFi where projects stay quiet on breaches until sleuths or security firms force the issue into public view.

The TeleSwap incident was not an isolated event. Protos' reporting placed it within a rough week for bridge security broadly: three blockchain bridges were attacked in the span of a week, with an estimated total of over $5.7 million stolen, as Allswap, Across Protocol, and TeleSwap appear to have lost $1.65 million, $3.35 million and $735,000, respectively. Zooming out further, Protos has tallied 20 bridge hacks so far this year, totaling over $355 million lost — a reminder that despite years of post-mortems and audits following mega-hacks like Wormhole and Nomad, bridge infrastructure remains one of crypto's most exploited attack surfaces.

The TeleSwap disclosure arrived just over a week after ZachXBT surfaced a separate, larger theft: roughly 180,900 SOL, worth about $14.2 million, allegedly stolen from a wallet tied to Solana's original genesis-block token distribution. Working alongside another on-chain research group, Specter Investigation, ZachXBT flagged irregular unstaking and cross-chain bridging activity moving the funds from Solana to Ethereum. Crypto exchange KuCoin's news desk, summarizing the finding, reported that an early Solana whale linked to the genesis block allocation may have been hacked, with 180,900 SOL approximately $14.2 million stolen on July 10, with ZachXBT and Specter Investigation detecting unusual unstaking and cross-chain transfers to Ethereum before the assets vanished from the source wallet. The same report noted that the victim address and several suspected theft addresses have been shared, but the attack method and final fund destination remain unclear.

What made the Solana case notable to researchers was the dormancy of the wallet involved — a holder that had reportedly sat untouched since the earliest days of the network before abruptly moving tens of millions of dollars in value in a matter of hours. As with TeleSwap, the precise root cause — whether a compromised private key, a phishing attack, or something else — has not been confirmed publicly, and funds bridged to Ethereum have made tracing more complex, though on-chain records still leave a durable trail for investigators to follow.

Together, the two cases underscore a recurring theme in ZachXBT's recent work: independent, real-time on-chain forensics increasingly outpaces official incident disclosure from the projects and wallets actually affected. In both instances, it was outside researchers — not the platforms or the victims — who first alerted the public, raising fresh questions about transparency norms across both centralized-adjacent bridge operators and individual whale custody practices.

Source & further reading:

Sources