Hackers Keep Draining Realio Wallets 24 Hours After $6M Crypto Attack Began

Points of Focus

• Realio-linked losses have risen to 127.9 million RIO as a second wallet-draining wave continues.
• User-linked accounts have lost 14.2 million RIO, up from 10.7 million after the first sweeps.
• Only 5.73 million RIO is confirmed frozen, while Ethereum wallets were still being drained on Aug. 26.

More than 24 hours after the Realio attack began, the wallet draining still hasn’t stopped. An independent onchain tracker recorded a second wave on Ethereum and BNB Chain overnight, pushing the total RIO moved from about 124.4 million to 127.9 million. Ethereum wallets were still being swept at 05:47 UTC on Aug. 26, 26 hours after the first attack activity appeared.

Realio attack grows to 127.9 million RIO

The first wave moved RIO from Realio-controlled reserves, treasury accounts, and user-linked wallets across Ethereum, BNB Chain, Algorand, Stellar, and Realio’s native network. Reserve and treasury wallets account for 113.72 million RIO, while the amount taken from user-linked accounts has now reached 14.20 million, or 4.34% of the circulating supply recorded before the incident.

The second wave began on Ethereum at 22:39 UTC on Aug. 25. By 05:50 UTC the next morning, 1,431 additional Ethereum accounts had been swept. A second BNB Chain run ended at 00:08 UTC after taking 2.98 million RIO from 1,574 accounts.

New wallet sweeps challenge Realio containment claim

Realio said in an Aug. 25 X post that access to Realio.fund had been halted and “no more funds” were moving in or out of user wallets. The later transfers tracked on Ethereum and BNB Chain show wallet movement resumed after that statement.

Last night, the https://t.co/Ioy6TAUbfx webapp fell victim to an attack. Access to the platform has been halted, and no more funds are moving in or out of user wallets. This report, created by an independent community member, provides a detailed summary of the event:…

— Realio (@realio_network) August 25, 2026

The tracker said all identified sweeps still involve wallets connected to Realio.fund. It hasn’t established the exact attack method, but repeated transfers from platform-linked accounts indicate the attacker retained signing access after the user-facing interface was disabled.

Only 5.73 million RIO is confirmed frozen

Realio’s native chain stopped producing blocks at 10:38 UTC on Aug. 25, freezing 5.73 million RIO held by the collecting account. KuCoin and MEXC also suspended RIO deposits on Algorand, limiting one route for moving the stolen tokens.

Those steps haven’t immobilized most of the balance. The attacker had sold about 3.31 million RIO on Stellar by 02:59 UTC on Aug. 26 and still held roughly 68.96 million RIO there. Another 43.38 million RIO remained in the Algorand receiving wallet.

The native chain balance remains the only 5.73 million RIO confirmed frozen while the network stays halted.