After analyzing this case, it was found that the theft of the wallet was caused by the theft of the Telegram account. After the thief stole the target user's Telegram account, he immediately took action to transfer funds from the bots on it, such as @ PepeBoost888 @ gmgnai and others. Through on chain fund analysis, the gang likes to steal funds and launder them across chains through a certain bridge. The address of the gang is: F1aq7gY3Gnw761SmXer9pjVBz7gdUo5dZbQcr96i6zt4 Regarding the address of a certain bridge (note that it is not a gang address, I have misunderstood a few people): 2xCKVe8QDtE4DHoPRywbmTKEJCjYeHRCvM5wp7HXBovL 3qJwxTR7jE6RSFUVQkViWtxwgvYwLVkLft2XsWoDHrxm The funds have shifted from Solana to Tron, and SOL has been replaced with USDT: TW4WPp6H9Qo6cgaVacWTfxQPqNuzrAzWcz As for the method of stealing Telegram accounts, it has been widely known before. The trick related to this case is to induce users to voluntarily submit Login codes by impersonating Telegram abnormal reminders. If the user does not enable Two Step Verification, the account will be directly compromised. @SlowMist_Team @MistTrack_io