6tck…LoDQ: a bridge address, not a thief: what we found
After a drain on 2026-10-18, 6tckHFBp…LoDQ was named as the thief's wallet and people were asked to flag it. Pulse shows it can't sign: it's a program-derived address holding thousands of SOL and moving constantly, consistent with NEAR Intents bridge infrastructure. The money was bridged off Solana within seconds, so flagging this address aims at the bridge, not the thief.
Public since 2026-10-31. The drained wallet's owner named this address publicly and asked for it to be flagged. Every fact below is public chain data.
Address: 6tckHFBpiJ8YgYN8FUskvtvTpXQZ55g5LHeo1kvELoDQ
Status: Bridge infrastructure, very likely NEAR Intents (not 100% proven). The thief is not here.
Findings
info
It can't sign: nobody holds a key to it
whats_this: "A program-derived address. Money sent here is controlled by a program, not a person." It held 13,085.67 SOL on 2026-10-31 (about 28,348 SOL on 2026-10-26) and moves every few seconds. A thief's wallet is a normal wallet that can sign.
Solana 6tckHFBpiJ8YgYN8FUskvtvTpXQZ55g5LHeo1kvELoDQ
What to do: Before asking anyone to flag an address, check it with whats_this. If can_sign is false, it belongs to a program (a bridge, an exchange, a pool), and the report should go to whoever runs that program.
trap
The drained SOL passed through in 7 seconds and was bridged off Solana
About 2.03 SOL reached the drained wallet and was forwarded here 7 seconds later; the forwarding transaction's fee was paid by a third wallet through an unnamed program, the mark of an automated sweeper or relayer. The wallet that sent the SOL in was labelled "Near Intents Refill" in the owner's own screenshot. Together: the funds were bridged out through NEAR Intents, so the thief's wallet is on the other side of the bridge.
Pulse history and explain_tx on the drained wallet (2026-10-26)
What to do: Report the transaction IDs to the bridge team (NEAR Intents) quickly, and treat the drained wallet's seed as burned.
Their addresses, read live
The newest transactions of each address, read from the chain when this page opened (refreshed at most every 5 minutes). A read that fails counts as unknown, never as a version.
| Address | Newest read | Version 1 | Version 0 | Legacy | Unknown | Latest activity |
|---|---|---|---|---|---|---|
| Bridge address (program-derived)6tckHF…vELoDQ | reading… | reading… | reading… | reading… | reading… | reading… |
What we measured
| What | Result | How | Checked |
|---|---|---|---|
| Balance | 13,085.668814586 SOL; can sign: no (program-derived address) | Pulse whats_this | Oct 31, 2026 |
| Balance five days earlier | About 28,348 SOL | Pulse whats_this | Oct 26, 2026 |
Tools run on this project
Check it yourself
Every Pulse tool, live on mainnet, starting with tx_version. Paste any signature from this report, or your own.
Toolbox
Pick any tool, change any input, run it on mainnet, and reopen any call to change it and run it again.
Ctrl ↵ runs the tool
Run when code can't find or read a transaction that is on chain, or before relying on code that reads other people's transactions. Read the docs
Response
Run the request to see the live response. The inputs are real mainnet data, so it works as it is.
Your calls 0
Calls you run appear here and stay in this browser. Open one to change its inputs and run it again.