Sweeper wallet 7Lht…XGCX: what we found
On 2026-08-24 a wallet's PUMP, RAY and JTO were moved to 7LhtmP8q…XGCX within about 12 seconds, each transfer signed with the drained wallet's own key: an automated sweeper using a stolen key. The tokens were sold since; the wallet held 116.48 SOL on 2026-10-31 and was last active on 2026-10-18.
Public since 2026-10-31. The drained wallet's owner named this address publicly on 2026-08-26. Every fact below is public chain data.
Address: 7LhtmP8q9WLWoGN2WbLDjqQbFhdDr2hY3a17EnqaXGCX
Status: Still active: last transaction 2026-10-18. Holds 116.48 SOL (2026-10-31).
Findings
trap
Three transfers in 12 seconds, signed with the victim's own key
At 10:32:39 UTC 1,446,074.63 PUMP, and at 10:32:51 UTC 5,375.82 RAY, left the drained wallet for this address; the JTO went the same way. Each transfer was signed and paid for by the drained wallet itself, so whoever sent them had its private key. That speed points to an automated sweeper: a bot that empties a wallet the moment it holds something.
A pre-sign check can't stop this: the thief doesn't need the owner to sign anything once the key is leaked.
HX34UqLGoqoZrPXDgzVSTVtd1jmiSp7FrUJY6v2iVt7MvNLMkF8JBe4zc1w5XDATK2eZZyxXrF27huw5Mgb7zt44uX9QZKw33pJLZNQbvWa7wvx7hveXh4JPGSaR5u66J6Jxnr43CLe5QL6X6R3M1tJuor45cczJpkv4axm5JaUKury
What to do: If your wallet was swept, treat its seed phrase as burned: move anything left to a brand-new wallet made from a new seed, and never type the old seed anywhere again.
warning sign
A lookalike of the drained wallet sent it dust in between
At 10:32:48 UTC, between the two drains, a different wallet whose address starts and ends like the drained one (HkxcH4jW…sEnp, against the real Hkxcf2Jz…sEnp) sent 0.0001 USDT to this address. Lookalike addresses are made to be copied by mistake from a transaction history (address poisoning). Why it was sent here, to the sweeper, is not proven.
ZGnDHY9RtAAYkC184ztaMsatA5qDfvfAgJQPCJxKaM5t86iyx1tcThL9nfS9RJ6xQetintjfAHptAByrVL5BDAPHkxcH4jW6LxcSQe183KLuLAoTECSANr3YQLkCZCQsEnp
What to do: Never copy an address from your transaction history. Check every character, or use a saved contact.
info
A live personal wallet, probably holding more than one victim's money
Pulse's whats_this says it's a normal wallet that can sign (a person or bot holds its key), with 116.48 SOL on 2026-10-31. The stolen tokens are gone, so they were sold. Its history has activity on 2026-10-07 and 2026-10-18; a sweeper usually drains many wallets, so the SOL here is not all from this one drain (not proven).
Solana 7LhtmP8q9WLWoGN2WbLDjqQbFhdDr2hY3a17EnqaXGCX
What to do: Exchanges and wallets can flag it: report the address and the transactions above to the wallet app you use and to any exchange it sends to.
Their addresses, read live
The newest transactions of each address, read from the chain when this page opened (refreshed at most every 5 minutes). A read that fails counts as unknown, never as a version.
| Address | Newest read | Version 1 | Version 0 | Legacy | Unknown | Latest activity |
|---|---|---|---|---|---|---|
| Sweeper wallet7LhtmP…qaXGCX | reading… | reading… | reading… | reading… | reading… | reading… |
What we measured
| What | Result | How | Checked |
|---|---|---|---|
| Balance | 116.484147381 SOL; can sign: yes (System Program wallet) | Pulse whats_this | Oct 31, 2026 |
| Latest transaction | 2026-10-18 17:02:57 UTC (5v6WyPww…) | Pulse history | Oct 31, 2026 |
| PUMP moved in | 1,446,074.625344 PUMP at 2026-08-24 10:32:39 UTC | Pulse explain_tx HX34UqLG… | Oct 31, 2026 |
| RAY moved in | 5,375.8201 RAY at 2026-08-24 10:32:51 UTC | Pulse explain_tx 4uX9QZKw… | Oct 31, 2026 |
Tools run on this project
Check it yourself
Every Pulse tool, live on mainnet, starting with tx_version. Paste any signature from this report, or your own.
Toolbox
Pick any tool, change any input, run it on mainnet, and reopen any call to change it and run it again.
Ctrl ↵ runs the tool
Run when code can't find or read a transaction that is on chain, or before relying on code that reads other people's transactions. Read the docs
Response
Run the request to see the live response. The inputs are real mainnet data, so it works as it is.
Your calls 0
Calls you run appear here and stay in this browser. Open one to change its inputs and run it again.