Tracing the $735K TeleSwap Exploit: Following Bitcoin and Ethereum Transactions with Hornet

A blockchain forensic investigation into suspicious Bitcoin outflows, cross-chain laundering, exchange exposure, and the limits of tracing cryptocurrency through Tornado Cash.

By Souvik Haldar | October 14, 2026

The TeleSwap Incident

On July 15, 2026, TeleSwap, a Bitcoin-focused cross-chain bridge, reportedly suffered a security incident involving more than $735,000 in cryptocurrency.

On-chain investigator ZachXBT brought attention to the incident on July 20, identifying suspicious Bitcoin outflows, a subsequent interruption in activity from TeleSwap's Bitcoin hot wallet, and the movement of suspected proceeds into Tornado Cash.

At the time of the initial report, the project had allegedly made no public disclosure for five days.

The reported laundering activity involved several important components of the cryptocurrency ecosystem: Bitcoin, Ethereum, a cross-chain swapping protocol, and a privacy mixer.

We reconstructed and examined the available transaction paths using Hornet, a blockchain forensic intelligence platform designed for cryptocurrency transaction tracing, investigation, and risk analysis.

Our objective was to follow the observable movement of funds, identify relevant counterparties, and distinguish confirmed blockchain transactions from assumptions about wallet ownership.

1. Starting with TeleSwap's Bitcoin Hot Wallet

The investigation began with the Bitcoin hot wallet publicly attributed to TeleSwap:

bc1q5wnpn4k99wc587maaaa6eqnx27g4r6mduxg2s5

ZachXBT also identified the following Bitcoin address as associated with the suspected theft:

bc1pz95zv3qhpmt52yezs84a5zrddrk5jsxm8a60rln5kzlk06e87a3q8pf79l

Using Hornet's transaction visualization, we examined a downstream Bitcoin transaction network originating from a node labelled TeleSwap.

The graph shows multiple intermediary wallets, successive transfers, and eventual branching toward several destinations.

Some visible edges contain substantial Bitcoin amounts, exceeding 100 BTC in later transaction paths.

However, these amounts must not be confused with the reported exploit loss. A transaction graph can contain historical balances, subsequent activity, unrelated transfers, and overlapping transaction paths. Every transfer must be reconciled against its transaction hash, timestamp, inputs, and outputs before it can be attributed to the incident.

The primary finding from this stage is the presence of a traceable, multi-hop Bitcoin network worthy of further forensic examination.

2. Investigating the Ethereum Transaction Chain

The investigation also examined three Ethereum addresses identified in the initial public disclosure:

• 0x2448cbaee50a67030692b7519a954e5550dc2718
• 0xfc5048fbba2f74ed482ffcd7663601f818c5bb47
• 0xf8706a51f8df01a71f408e50c901dd14916a12c7

Hornet's Ethereum visualization shows a sequence of transfers through these addresses, culminating in the last wallet.

The graph displays transfers of approximately 312 ETH within the visible sequence, with smaller amounts also arriving from other addresses.

This supports the presence of a substantial Ethereum consolidation path.

Independent research published by IndagoLabs on July 23 indicates that suspected TeleSwap proceeds were converted from BTC to ETH through Chainflip before being consolidated into the same final Ethereum wallet.

This introduces an important distinction in cross-chain investigation.

A Bitcoin transaction and an Ethereum transaction cannot be connected solely because their amounts or timestamps are similar.

A reliable cross-chain attribution requires supporting evidence such as swap transaction records, protocol-specific identifiers, event logs, timing consistency, and reconciliation of the input and output assets.

Our Hornet screenshot visualizes the Bitcoin and Ethereum activity, while the reported Chainflip connection provides an investigative hypothesis requiring transaction-level corroboration.

3. Following the Money Toward Tornado Cash

The Ethereum consolidation wallet is particularly relevant:

0xf8706a51f8df01a71f408e50c901dd14916a12c7

IndagoLabs reported that this address subsequently made 19 deposits into Tornado Cash, distributed as follows:

Tornado Cash poolDepositsTotal100 ETH3300 ETH10 ETH880 ETH1 ETH22 ETH0.1 ETH60.6 ETHTotal19382.6 ETH

These deposit figures originate from IndagoLabs' published research rather than from the Hornet screenshot.

Tornado Cash presents a particularly challenging environment for financial investigators. Its zero-knowledge design separates deposit transactions from withdrawal transactions, preventing ordinary blockchain tracing from establishing a deterministic relationship between them.

Nevertheless, investigators may examine denomination patterns, transaction timing, liquidity movements, gas funding, and subsequent interactions with identifiable services.

IndagoLabs reported two probable post-mixer withdrawal wallets based on a distinctive denomination fingerprint and compatible withdrawal timing:

0x0c43012C3F3c6617E30B848D50f619098B45465A

0x039D037000593a65f45193e96bD2e73c7fDF043e

These addresses are investigative leads, not conclusively established destinations of the stolen funds.

Their attribution requires continued examination and independent corroboration.

4. What Hornet Revealed About Downstream Exposure

One of the interesting features of the Bitcoin graph is its branching structure.

Instead of showing a single linear transaction path, the visualization identifies several downstream destinations.

Some nodes carry service or risk-related labels, including Kraken and a ransomware-associated classification.

These labels are valuable because they help investigators prioritize further examination.

However, a wallet's connection to a labelled service does not establish that the service received stolen assets, controlled the originating wallet, or knowingly facilitated any illicit activity.

The relevant questions are whether the transaction path belongs to the suspected exploit proceeds, whether the labelled attribution is current and reliable, and whether any intermediary activity breaks the assumed ownership relationship.

Where the evidence supports a direct deposit into an identifiable custodial exchange, investigators may have an opportunity to request account information or seek preservation of relevant records through appropriate legal channels.

In the present visualization, these possibilities remain leads rather than confirmed recovery opportunities.

5. Why Unlimited-Hop Transaction Analysis Matters

Cryptocurrency investigations rarely end with a single suspicious address.

Funds may move through numerous intermediary wallets, undergo cross-chain swaps, split into smaller transfers, or enter services designed to obscure transaction relationships.

Traditional block explorers are valuable for examining individual addresses and transactions, but investigations involving multiple intermediary wallets and chains quickly become difficult to interpret manually.

Hornet helps organize the transaction network visually, allowing investigators to examine paths, branches, counterparties, and labelled entities within a common analytical interface.

The TeleSwap investigation illustrates why investigators must combine transaction tracing with contextual intelligence.

A visual connection identifies a relationship worth investigating. It does not automatically prove common wallet ownership, criminal intent, or the identity of an individual.

Forensic conclusions must remain grounded in verifiable blockchain evidence.

6. What Remains Unknown

Although substantial activity has been documented publicly, several important questions remain unresolved:

1. Initial compromise: Was the incident caused by a compromised signing key, an internal operational failure, or a vulnerability in the protocol?
2. Cross-chain reconciliation: Can the Bitcoin outflows be matched conclusively to the Ethereum receipts using Chainflip swap records?
3. Post-mixer destinations: Can the suspected Tornado Cash withdrawal wallets be linked to identifiable custodial services through additional evidence?
4. Fund recovery: Have any of the reported proceeds reached an entity capable of preserving or freezing assets?
5. Incident response: What actions did TeleSwap take after identifying the suspicious activity, and has a detailed technical post-mortem been published?

Without answers supported by transaction records and reliable disclosures, conclusions about the exploit mechanism or the final beneficiaries would be premature.

Conclusion: The Blockchain Preserves Evidence, but Attribution Requires Care

The alleged $735,000+ TeleSwap exploit demonstrates the complexity of modern cryptocurrency investigations.

The publicly reported transaction sequence crosses Bitcoin, Ethereum, Chainflip, and Tornado Cash.

Our investigation using Hornet illustrates how multi-hop visualization can help expose transaction structures, consolidation patterns, and potential service exposure that warrant further scrutiny.

The wider lesson is that blockchain transparency does not automatically establish attribution.

Even when every transaction is publicly recorded, reconstructing the movement of assets across protocols requires specialized analytical tools, reliable intelligence, and careful interpretation.

And when funds enter a privacy mixer, deterministic tracing may no longer be possible. Investigators must distinguish probabilistic leads from confirmed evidence.

That distinction is essential for producing technically credible, legally defensible cryptocurrency forensic investigations.

Explore the Investigation

Interactive Hornet visualization: https://app.hornet.technology/visualize?code=wt1jb_hUeK8UXJTcKbVwmgTTWoDdZXvDtXqpdEAcSIw%3D&is_new=true

References:

• ZachXBT, Investigations by ZachXBT, July 20, 2026: https://t.me/s/investigations
• IndagoLabs, Tracing the TeleSwap Exploit: Deanonymizing Tornado Cash Outflows, July 23, 2026: https://indagolabs.eu/tracing-the-teleswap-exploit-deanonymizing-tornado-cash-outflows-with-our-tool-multichain-detective/
• Hornet Blockchain Forensics: https://www.hornet.technology/

Disclaimer: This article presents an independent analysis of a reported security incident using a Hornet transaction visualization and publicly available third-party research. Wallet labels, transaction relationships, and inferred fund movements should not be interpreted as definitive proof of beneficial ownership, criminal involvement, or responsibility