Tracing the Ronin bridge exploiter's wallet with FindMore

Every Ethereum wallet is public. Balances, counterparties, and the full transaction history sit on a ledger anyone can read, which means a wallet you have never touched can still be investigated end to end. We ran FindMore's wallet check on one of the most consequential addresses on the chain, the wallet OFAC sanctioned as the Ronin bridge exploiter, to show what the tool surfaces from public data alone and how to confirm it.

The address

The subject is 0x098B716B8Aaf21512996dC57EB0615e2383E2f96. On Etherscan it carries the name tag "Ronin Bridge Exploiter," an OFAC-sanctioned label, and a note that stablecoin issuers have blocked it. It is the wallet tied to the March 2022 Ronin bridge hack, attributed by the US Treasury to the Lazarus Group, in which roughly $625 million left the bridge. You need no special access to look at it. Paste the address into FindMore's wallet check, or any block explorer, and the whole history is there.

What the wallet check returns

FindMore reads the address off the public chain and reports what stands out. With no prior context, three things surface immediately.

It first appears on 23 March 2022, the day of the Ronin hack. An address whose entire history begins on the date of a known theft is the first thing an investigator lines up against the public record.

It still holds about 102 ETH, roughly $276,000 when we ran it, in full public view. Most of the $625 million was bridged out and laundered long ago; what remains sits on an address anyone can watch forever. FindMore flags the public balance as an exposure, which for an ordinary user is privacy advice and for a sanctioned wallet is just the nature of the ledger: there is no hiding a balance on Ethereum.

It is linked to 34 other addresses across its recent transactions. Each counterparty is a thread to pull, and each one connects this wallet's activity to everyone else it has touched.

Even a hacker's wallet gets phished

The more revealing signal is the junk. FindMore flags eight tokens on the address as airdrop spam, with names like yRise.Finance, DIXT.FINANCE, and yefam.finance. Look closer and several are not even pretending to be projects; the name is the scam: "Visit website getether .net to claim rewards", "Visit LiquidETH.org to claim rewards", "Visit https://apyeth.net to claim rewards".

These are phishing airdrops. Scammers send worthless tokens to high-visibility addresses so the token, and its "claim your rewards" URL, shows up in the owner's wallet. It rides on the ledger's openness, and it does not discriminate: the same drainer campaigns that target ordinary users pile onto a sanctioned nation-state wallet, because the address is public and the airdrop is free to send. FindMore marks these tokens suspicious and tells you to do the one correct thing, which is nothing: do not approve, sell, or visit anything they advertise.

How we verified it

One signal is a lead, not a conclusion. The date is suggestive on its own, but it becomes evidence when it lines up with the public record: Etherscan's "Ronin Bridge Exploiter" tag, the OFAC designation, and the widely reported hack on that exact day. FindMore's job is to surface the signals from raw chain data; the attribution is confirmed by cross-referencing an independent, authoritative source. That discipline is what separates an investigation from a guess, and it is the same rule the agent applies to every claim it makes: a finding is only as good as the source you can open behind it.

Try it yourself

The wallet check runs on any Ethereum address, and everything above came from public data and a single lookup. Take an address you own and read what the chain already shows: the balance anyone can see, the counterparties you are linked to, and the spam tokens sitting in your history with a phishing URL for a name. The lesson from a sanctioned wallet applies to an ordinary one. On a public ledger the question is never whether the information is out there. It is whether you have looked.