Gary Club hack: 135 wallets drained in six hours, and the money landed on KuCoin
An attacker holding the private keys to Gary Club's custodial wallets emptied 135 accounts on Solana and sold the loot for about 319 SOL. 99.5% of it ended up at a KuCoin deposit address.
On Sunday, October 19, 2026, an attacker holding the private keys to Gary Club’s custodial wallets drained 135 user accounts on Solana. The stolen tokens were sold for about 319 SOL (roughly 33,000 dollars), and 99.5% of that money ended up at a KuCoin deposit address, according to an on-chain trace.
What happened
It all happened within a few hours. The theft began at 05:24 UTC and the loot was sold off before 10:00 UTC.
| Time (UTC) | What happened |
|---|---|
| Oct 19, 05:24 | The first collector wallet, Ncad3…, becomes active. |
| 05:57–07:10 | Ncad3… drains the SOL from 80 user wallets: 8.1 SOL in total. |
| 06:33–08:21 | A second collector, A3kh…, sweeps the tokens from 97 wallets: ~434,000 GARY and ~166.5 million GIRAFFISH. |
| 08:11–09:41 | A3kh… sells everything on Raydium and Pump.fun for ~297 SOL. The largest sale, 148.8 million GIRAFFISH, goes out in a single trade at 09:41. |
| 09:43 | The 297 SOL move to a bridge wallet. |
| 13:11 | After a second hop, 296.8 SOL arrive at an address Solscan labels as a KuCoin deposit address. |
| Oct 19 and 21 | Ncad3… sells its share (~13 SOL) in two rounds and sends 20.78 SOL down a second route that also leads to KuCoin. |
135 distinct wallets were hit. 42 of them were hit twice: first their SOL was taken, then their tokens.
How they did it
This was not a liquidity rug or a smart-contract bug. The attacker had the private keys to the wallets Gary Club created and held for its users.
- The proof: every token transfer into
A3kh…is signed by the victim’s own wallet. On Solana that is only possible with the private key. No token approvals or contracts were involved. - Two collectors, two jobs:
Ncad3…took the SOL first. Without SOL, victims could not pay network fees, soA3kh…paid the fee on each transfer and co-signed to pull the tokens. - No funding trail: the collectors paid their fees with the victims’ own SOL. There is no “mother” wallet funding them.
- Down to the last cent: after emptying the wallets, the attacker closed the now-empty token accounts to collect their rent deposits (~0.002 SOL each).
The project’s own vaults (Squads multisig) were not touched: their last activity dates to July and August.
Where the money went
Almost all of the loot, 317.6 of about 319 SOL, reached KuCoin by two routes. The main route passed through two bridge wallets in under five hours before landing at an address Solscan labels as a KuCoin deposit address.
The left-hand route carries 93% of the money. The right-hand route runs through a wallet that receives funds from many people unrelated to the hack, which points to an exchange or swap service rather than the attacker. About 1.7 SOL sits untouched in two leftover wallets (7sDwzS… and Aopfi…).
What Gary Club says
Gary Club has acknowledged the breach in public. On October 19, the day of the theft, its founder posted “We got hacked” on X and hosted a live audio discussion about it, which the club’s account shared. Its written notice confirms that the wallet keys were compromised. Neither says in writing when the keys leaked, how much was taken or where it went. Here is what the notice does say:
- Utility for GARY, GIRAFFISH and the Giraffes NFTs inside Gary Club is ending.
- The club is moving into a physical home in Austin, opening November 1.
- Users must move their assets to a new wallet, with a new key, by November 15, 2026.
- The compromised wallet should never be used again. Importing the old key into another app does not make it safe.
The notice does not mention any report to law enforcement or the attacker’s addresses. As of October 23, we found no news coverage or other independent trace of the incident.
What affected users can do
The most useful lead is the KuCoin deposit address. KuCoin requires identity verification (KYC), so with a request from law enforcement it can tell who owns that account.
- Check whether your wallet was drained: look up your Gary Club custodial wallet on Solscan and see whether it shows transfers to
A3kh…orNcad3…on October 19. - File a complaint at ic3.gov (FBI). Gary Club operates out of Texas. Include the KuCoin deposit address, both collector wallets and your transaction signatures.
- Report the deposit address to KuCoin through its support channel, with your complaint number.
- Ask Gary Club in writing for the breach date, the amount stolen and whether it has reported to the authorities. Keep the reply.
- Move anything left in the compromised wallet to a new wallet before November 15. Never reuse the old key.
Never share your private key or seed phrase with anyone offering to “recover” funds: that is the scam that usually follows hacks like this one.
What we still don’t know
- How the keys leaked: Gary Club has not said, and the blockchain cannot show it.
- Whether KuCoin has frozen the deposit account.
- Who the attacker is: the trace ends at KuCoin. Going from there to a person takes KuCoin and law enforcement.
- The full damage: this trace covers the two collector wallets. It does not include NFTs the attacker may have moved by other routes.
Sources and key addresses
Traced on October 22, 2026 using the public Solana RPC node and Solscan’s labels. SOL price used: ~103.6 dollars.
| What it is | Address |
|---|---|
| Token collector | A3khCSVnG9uCDbbhPCg2HZmo3tYaJQ1aADyCjiWP7Xje |
| SOL collector | Ncad3pB2hKbqRedGHtydivR83Vfv5FjfpzwoFzb1fBe |
| First bridge | D3UFH1dCVftUFnFrqnJfQfrZ3egkyFMY6KDVdgoopTS |
| Second bridge | HFkgAv6TPAY5UPziFGu5AVVuYaaPTZbCiZpcTmZy2sjZ |
| KuCoin deposit (Solscan label) | eS4n56zrQ4ESznC8mDxQhsY4JoCpEt1jDczgcQ299qW |
| Largest sale (148.8M GIRAFFISH) | CMpProaSTdBy… |
| 297 SOL sent to the bridge | 4CBR5S93SBpY… |
- Gary Club notice
- Gary Club privacy policy, which says: “We are not a licensed custodian or financial institution.”
- Gary Club founder’s post, October 19
- GARY on Solscan · GIRAFFISH on Solscan
Update, October 23, 2026 (UTC): added the founder’s public post of October 19 and the live discussion that followed, which the first version left out. We also removed a list of guesses about how the keys leaked: the record does not show it.
This article describes public blockchain data and public statements. It is not financial or legal advice.