Since 03:31 UTC on 25 August, roughly 129.5M RIO has moved out of Realio-controlled wallets and holder accounts across five chains, Ethereum, BNB Chain, Algorand, Stellar and the Realio native chain, into accounts created that morning. It came in three waves, the last of them on 27 August, which also took the native BNB from 709 wallets. Nothing has been swept anywhere since 12:57 on 27 August, and Realio has said the theft is over. The attacker spent the following night selling: he then emptied every liquid balance on 28 August and now holds 46.1M RIO, on Algorand and the halted native chain only, having extracted about $338,700 in total. The fastest cash-out route was closed within hours, after community members raised the alarm and MEXC and KuCoin suspended RIO deposits on Algorand, and the native chain was halted 23 minutes after its sweep stopped. This page records what the public chain data shows, with every address and transaction ID, so anyone can check it independently.
Nothing has been swept anywhere for 43 hours. The last wallet was emptied at 12:57:33 on 27 August. Checked again across a twenty-three-hour window on both Ethereum contracts and twenty-two hours on BNB Chain, each with a control query in a window known to contain events. Realio's statement that the theft is over is consistent with everything the chain shows.
On the evening of 28 August the attacker emptied every liquid balance he held. Between roughly 17:30 and 23:00 the collecting addresses went to zero: 68.78 ETH off Ethereum, 135.6 BNB off BNB Chain, 49,517 XLM off Stellar and 29,754 ALGO off Algorand. The last RIO on BNB Chain was sold first, taking that balance to zero as well. What is left in those four addresses now is dust: 0.00002 ETH, 0.019 BNB, 5 XLM, 0.6 ALGO.
It went out in round-number tranches to fresh addresses. The ones we have pinned: 23 BNB at 17:30:07, 18 ETH at 17:32:11, 8 ETH at 22:22:35, 10.78 ETH at 22:27:47 and 24.5 BNB at 22:31:29. Each went to an address with no prior history, which is the standard shape of an exchange deposit. We have not traced every hop and we are not naming venues while they have had no chance to act.
One tranche has not moved. The 24.5 BNB, about $16,850, sent at 22:31:29 sits at an address that has still never sent a transaction. It is the one piece of this that is currently sitting still and identifiable.
The Stellar cash-out went to the same place as before. At 22:48:42, 49,517 XLM went to the identical exchange deposit address used on 26 August, carrying another numeric memo. That is now two deposits at the same venue, which is useful to anyone trying to attach a name to this.
In total the attacker has extracted about $338,700. Set against 129.5M RIO taken, nominally $5.5M at today's price, that is 6.2%, or one dollar in every sixteen. The figure has barely moved in three days. What changed is that it is no longer sitting in wallets anyone is watching.
What remains is 46.1M RIO, and almost none of it is sellable. 40,349,824 on Algorand, where the DEX route he found on 27 August clears at roughly a 90% discount, and 5,732,041 frozen on the halted native chain. Ethereum, BNB Chain and Stellar are all at zero. The Stellar position, 71.9M RIO, was sold over four days for about $34,000.
Realio has now set out a plan. From Eduardo, Realio's CTO, and Derek Boirun on Telegram, summarised publicly on 28 August: the network will be brought back in phases, with a current target of mid next week. The chain is restored first, and then "a new chain update will allow recovery of funds". There will be no new contract. All bridges stay off for now, and stuck transactions will process when they are turned back on. A v1 claims dashboard is being built on Freehold, which will need an account with completed KYC. Realio also confirmed that Freehold and Districts were not affected, and that the old web app should not be used.
What the chains actually permit, which is worth knowing before that lands. A native chain upgrade can rewrite native chain state, so the 5,732,041 RIO frozen there is genuinely reachable that way. The other chains are a different matter, and we checked rather than assumed:
On Algorand, ASA 2751733 has its clawback and freeze addresses set to the all-zero address. Both capabilities are permanently disabled and cannot be restored. On Stellar, the RIO issuer GBNLJIYH34UW…AYTEJ5AK, home domain realio.fund, has clawback disabled, revocation disabled and auth_immutable set to true, which means those flags can never be changed. On Ethereum and BNB Chain the RIO contract has no pause, blacklist or clawback function at all.
So no RIO outside the native chain can be clawed back at the token level, and Realio has ruled out a new contract. That is a statement about what these tokens are capable of, not about what Realio can do for the people affected. Making holders whole through a claims process is a different route and does not depend on any of the above. But it does mean the 40.3M RIO still sitting with the attacker on Algorand, and the 71.9M he sold on Stellar into other people's hands, are not going to be reversed on-chain.
Follow the official accounts and nothing else. Realio has asked holders to rely only on @realio_network and @freehold_wallet. Treat any other claims site, DM, or "new contract" link as a scam. The team has explicitly said there is no new contract, so anything offering one is a fake.
Everything taken came from wallets held inside realio.fund. Self-custodied RIO was untouched on every chain.
Correction. An earlier version of this page put the last Ethereum sweep at 05:47:59 on 26 August. Rechecked against two independent nodes with an explicit coverage control, the last transfer into the attacker's address on either Ethereum contract was at 03:12 UTC. The earlier figure came from a node that returned an empty result instead of an error.
The native chain stopped producing blocks at 10:38:05 UTC on 25 August at height 19,573,265, 23 minutes after that sweep's last transfer, and remains stopped at that height four days later. The 5,732,041 swept on native is frozen for as long as that lasts.
The headline is 129.5M RIO. The number that matters for market cap is far smaller, because most of what was taken had already been excluded from circulating supply. Here is the split.
| Where it came from | RIO taken | Share | In circulating supply? |
|---|---|---|---|
| Algorand ASA reserve wallet | 43,850,860 | 33.9% | No, already excluded |
| Stellar treasury (realio.fund) | 69,869,352 | 53.9% | No, already excluded |
| Reserve and treasury | 113,720,212 | 87.8% | Never counted as float |
| Native chain holder accounts2,374 accounts swept between 09:29 and 10:15 UTC on 25 August | 5,732,041 | 4.4% | Yes |
| BNB Chain holder accounts2,049 accounts across four sweeps: 163 on 25 August, 1,574 more ending 00:08 on 26 August, then 178 and 196 more in two bursts on 27 August | 6,519,640 | 5.0% | Yes |
| User wallets, Algorand and Stellar8,908 Algorand custodial accounts, plus Stellar deposits swept after the main drain | 2,122,810 | 1.6% | Yes |
| Ethereum holder accounts1,581 accounts across three sweeps: 121 on 25 August, 1,431 more from 22:39 that evening, then 5 more on 27 August | 1,444,091 | 1.1% | Yes |
| Taken from usersCounted in circulating supply before 25 August | 15,818,582 | 12.2% | Yes |
| Total taken | 129,538,794 | 100% |
The 15.82M taken from users is 4.83% of the 327.3M circulating supply recorded before the incident. Measured against all RIO in existence, roughly 489.3M across every chain, the full 129.5M is about 26%. A further 976,657 of the deprecated Ethereum RIO was taken from 1,410 accounts; it is a separate asset and is not in these totals.
This table says where tokens sit, not who is owed what. Those are different questions and it is worth keeping them apart. Two things follow that are easy to miss. First, the 5.73M native portion may not be a permanent loss at all: it is frozen on a halted chain, and a Cosmos network that restarts from a pre-incident height would reverse those transfers outright, which is a well-established recovery route and squarely the team's decision. Second, if Realio compensates holders from treasury, that would be previously excluded RIO moving into public hands, a new event rather than an unwinding of this one, so it would not change the arithmetic above. We measure what the chain shows today and will update the moment it shows something else.
| Reading | Circulating supply | Change |
|---|---|---|
| 24 Aug, 06:40 UTC, before the incident | 327,292,172 | |
| 25 Aug, 13:06 UTC, after the incident | 330,451,591 | +3,159,419 (+0.97%) |
Circulating supply. Tokens that were already excluded before the sweep stay excluded: the 43,850,860 Algorand reserve and the 69,869,352 Stellar treasury. The 7,854,851 that came out of holder wallets is still counted as float, being 5,732,041 from native holders, 1,646,125 from Algorand holders and 476,685 from Stellar depositors. On that basis 25 August reads 330,451,591, up 0.97% on 24 August. The figure keeps moving while the attacker keeps selling.
Nothing was minted anywhere. The Algorand asset has been fixed at 100,000,000 and immutable since July 2020, Stellar's RIO total is unchanged, and native supply moved only by scheduled emission. Any chart showing a supply increase on 25 August is showing an accounting artefact, not new tokens.
What we have and have not checked. Ethereum, BNB Chain, Algorand, Stellar and the native chain have each been read transaction by transaction, BNB Chain across 111,964 blocks with no gap. Base and Solana have not. We have not found a log endpoint that serves those queries without a paid key, and we will not call a chain clean on a contract total alone, which is the check that missed Ethereum, BNB Chain and native.
Alongside the RIO the receiving accounts also took 137,340 ALGO, 72,565 XLM, 1,813 USDC, and the rUSD and realioUSD balances. Those last two were essentially the entire unissued supply of each asset, sitting in treasury rather than in user hands, and neither trades on any market, so neither is a realised loss.
On all five chains the dividing line is realio.fund. What was emptied was the reserve and treasury it controlled, plus the wallets its users held RIO in. RIO sitting in a wallet with no realio.fund connection does not appear in any of the five sweeps we traced.
On Ethereum 121 accounts lost their RIO and their ETH between 03:46 and 04:31 UTC. On BNB Chain 163 lost their RIO between 04:15 and 05:01. On the native chain 2,374 were swept between 09:29 and 10:15. Checking costs nothing.
Every entry is a public on-chain event with a transaction or ledger reference. Times are UTC on 25 August 2026.
We describe only what the chain data supports. The cause has not been confirmed by anyone, and we are not asserting one.
Every Algorand source account we sampled holds exactly 0.20 ALGO. That is the protocol minimum for an account (0.1) plus one asset opt-in (0.1). Thousands of accounts sitting at precisely the minimum, each opted into a single Realio asset, is the shape of automatically created custodial sub-accounts, one per user, not of independent self-custody wallets.
Algorand lets an account hand signing authority to another key, which is the signature of a phishing or approval-drainer campaign. We checked a sample of swept accounts and found no rekeying: auth-addr was null on every one. Whoever moved the funds could already sign for them.
The Stellar receiving account was created by the treasury at 03:31, the Algorand one at 04:52, and the last sweeps on both chains land 18 minutes apart. Two separate chains with separate key systems were drained inside the same window.
Both drained wallets continued receiving inbound transfers after they were emptied, and those later deposits were swept too. Whatever front end feeds those addresses was still accepting funds while the drain was in progress.
Taken together this points to compromise of signing keys held by the platform, rather than an exploit of a smart contract or a campaign against individual users. Realio has since indicated that realio.fund wallets were drained, which is consistent with what the chain data shows. The precise route in has not been made public, and we are not speculating about it.
As at 11:50 UTC. Both receiving accounts are listed in full so anyone can follow them live.
The Algorand route was closed, and for two days that worked. MEXC and KuCoin suspended RIO deposits on the Algorand network after community members spotted the movement and raised it with the exchanges. Exchange policy is not something on-chain data can show directly, but the effect worked for two days: no RIO left the Algorand receiving account between 08:29:02 UTC on 25 August and 15:19 on 27 August. That has now ended. He is selling on an Algorand DEX instead, at an 86% discount, and the balance stands at 43,349,824 RIO. A deposit suspension closes the exchange door; it cannot close the ledger.
Stellar has no equivalent switch. An exchange can suspend deposits because a company decides to. The Stellar DEX is part of the ledger itself: there is no deposit step, no listing to pull, and nobody to ask. The account paused and resumed repeatedly: a pause around 09:47, back at 12:00, heaviest through the afternoon, a pause at 18:14:51, selling again overnight, on through 26 August, and then a final trade at 18:53:16 one minute after the XLM proceeds were sent to an exchange. It resumed on the evening of 27 August and dumped the rest: 67,457,132 RIO for 39,600 XLM by 02:26:50 on 28 August, an average of $0.000108 per RIO. The account now holds zero RIO. Across the incident it sold 71,883,151 RIO for 184,824 XLM, about $34,000.
So the honest scoreboard, in two different currencies. In tokens: of the 129.5M taken, roughly 83M has now reached an exchange, a pool or a buyer. It is made up of 71,883,151 sold on the Stellar DEX, 1,444,091 sold on Ethereum, 5,118,982 moved on BNB Chain and about 4.1M routed off Algorand. In money, far less than that sounds. The Stellar sales raised 184,824 XLM in total, about $34,000, of which 144,816 XLM has already been moved to an exchange. Counting every liquid asset the attacker holds across all five chains, plus what has already been moved out, the total comes to about $338,700 against a nominal $5.5M of RIO taken, roughly 6%. The largest single item is 64.87 ETH on Ethereum, which is not RIO proceeds. The reason is liquidity. Every RIO pool on both EVM chains is a concentrated-liquidity pool, and the selling has drained the side that pays out: about $28,500 of WETH left in the Uniswap V3 RIO/WETH pool on Ethereum, $15,700 of WBNB in the PancakeSwap V3 pool on BNB Chain and $2,700 of USDT in the Uniswap V3 pool there. Roughly $46,800 of buyable depth in total, against 46.1M RIO still held. We are not modelling the slippage, because these are not constant-product pools and a formula would give a false precision; the measured outcome is enough. The BNB Chain leg realised about $0.011 per RIO against spot, an 80% discount. The BNB Chain portion was gone before anyone raised the alarm at all, swept and sold between 04:15 and 05:47. This is not a recovery and it is not a freeze. The only portion genuinely immobilised is the 5,732,041 on the native chain, and only while that chain stays halted.
Neither the Algorand asset nor the Stellar asset has clawback enabled. On Stellar the issuer carries auth_clawback_enabled: false and auth_immutable: true, so that cannot be changed later. There is no on-chain mechanism by which these transfers can be reversed.
Out of 129.5M RIO taken, worth about $5.5M at the current price, the attacker extracted roughly $338,713. That is 6.2%, or about one dollar in every sixteen. RIO taken is not money made, and on these chains the gap between the two is enormous. As of 28 August this is no longer a list of what sits in the collecting addresses. Those are empty. It is a list of what left them, priced at market. Read at 07:45 UTC on 29 August, with ETH at $2,436, BNB at $688, XLM at $0.1775, ALGO at $0.0861 and RIO at $0.0424.
| Chain | What was extracted | Value |
|---|---|---|
| Ethereum | 68.78 ETH, moved out 28 August | $167,545 |
| BNB Chain | 135.60 BNB, moved out 28 August | $93,255 |
| BNB Chain | 29 BNB, moved out 28 August | $19,944 |
| BNB Chain | 6,128 USDT, moved out 25 August | $6,128 |
| Stellar | 144,816 XLM, moved out 26 August | $25,705 |
| Stellar | 49,517 XLM, moved out 28 August | $8,790 |
| Algorand | 141,000 ALGO, moved out 26 August | $12,141 |
| Algorand | 2,172 USDC, moved out 26 August | $2,172 |
| Algorand | 29,754 ALGO, moved out 28 August | $2,562 |
| Base | 0.194 ETH, moved out | $472 |
| Total extracted | $338,713 |
Today's increase is the gas sweep plus a modest amount of selling. Of the 1,620,006 RIO swept today, 200,000 has been sold on BNB Chain for about $7,090 and 20,000 on Algorand for about $132; the rest is still held. The largest single addition was the 17.12 BNB taken from 709 wallets at 12:57, worth about $12,180. About $2,400 of the rise is ETH, BNB and XLM being worth more, and roughly $1,600 is USDT and USDC arriving on BNB Chain. The reference point for what today's RIO is likely to fetch is yesterday evening's BNB Chain selling: 1,230,000 RIO for 25.85 BNB, about $18,190, which is $0.0148 per RIO against a spot above $0.041 at the time. A 65% discount.
This total is a floor, not a ceiling. It counts what sits in addresses we have identified. The Ethereum RIO was sold and its proceeds left the chain without landing in any of them, so some of that money is not in the table. The BNB Chain balance rose by 22 BNB over the same period, which is the obvious candidate, but we have not proved the link and are not going to present a guess as a trace.
Set that against the 129.5M RIO taken, nominally about $5.5M at the $0.0424 price above. What is left is 46.1M RIO, roughly $2.0M at quoted prices: 40.3M on Algorand and 5.7M frozen on the halted native chain. Ethereum, BNB Chain and Stellar are all at zero. That fall is not a recovery. It is RIO sold into markets that could not absorb it, most of it for a fraction of a cent. There is no venue open to them deep enough to turn much of that into money, and after three days of selling there is markedly less than there was. Every RIO pool we can measure on Ethereum and BNB Chain now holds about $46,800 of buyable assets between them, against roughly 2.1M RIO sitting inside those same pools. The deepest pool anywhere, Uniswap V3 RIO/WETH on Ethereum, is down to 11.37 WETH. Across the whole run the Stellar sales cleared at an 88% discount to spot, and the BNB Chain sales on 26 August at about 65%. One figure is missing and cannot be recovered from chain data: 2,066,161 RIO was deposited to MEXC, and what it sold for, if anything, happened on an exchange's internal books.
The 64.87 ETH is the largest single item and it is not RIO proceeds. That address held zero ETH at 03:30 UTC, sixteen minutes before the sweep began, so all of it arrived with the attack. The 263 Ethereum victims lost 32.63 ETH between them. The remaining 32 ETH we cannot yet source, and we are not going to guess at it.
A small realised total is not the same as getting away with it. All four receiving addresses are published on this page, and everything that moves out of them is written to a public ledger permanently. There is no later point at which this becomes private or reversible. The 46.1M RIO still held sits in two of those addresses and cannot be sold at anything near its quoted price on the venues open to it. Four days of selling on Stellar, 71,883,151 RIO across 1,057 trades, produced 184,824 XLM, about $34,000. That is the whole Stellar position, sold for roughly half a percent of its quoted value. The one route that did reach an exchange ended at a hot wallet run by a venue that performs identity checks, and Realio has said it is in contact with MEXC and KuCoin and intends to work with law enforcement. Whether anything is recovered is not a question chain data can answer. What chain data does guarantee is that the trail is complete and stays that way.
There are two RIO contracts on Ethereum, and both were swept. Alongside 0x94a8b4ee…09f51aa0, the one this site tracks, there is 0xf21661d0…ae4097: same name, same RIO symbol, 74,488,102 supply. It is the old pre-migration token and the market prices it as such, at about $0.00257, roughly 5% of current RIO. The attacker has taken 976,657 of it from 1,410 accounts, but at that price the whole lot is worth about $2,500. It changes the number of people affected, not the money.
The Ethereum leg is now 1,576 addresses. Across both contracts, 1,576 addresses have lost their tokens, in two waves: 121 on the morning of 25 August, then 1,431 more from 22:39 that evening, ending at 03:12 on 26 August. The 1,163,502 RIO figure counts only the tracked contract, and all of it has since been sold. We do not count the legacy contract as RIO supply, and we checked rather than assumed: 74.4M of it sits with real holders rather than in a burn address, but at 5% of RIO’s price it is a separate deprecated asset, and folding it in would overstate supply by about 74M.
Nothing on this page needs to be taken on trust. Every claim above is a public record.
The BNB Chain leg is reproducible with one query. Take every Transfer log emitted by the RIO contract 0x94a8b4ee5cd64c79d0ee816f467ea73009f51aa0 between blocks 117,900,109 and 118,012,072, group them by recipient, and count how many distinct senders each recipient received from. One address stands out with 163 senders and exactly one transfer from each. Most free BNB Chain endpoints will refuse the query, which is why we missed this leg on the first pass; bsc.rpc.blxrbdn.com serves it in 5,000-block chunks. We publish the block range so the count can be reproduced exactly rather than approximately.