Realio's Derek Boirun, on 25 August:
"Reminder, do not buy RIO on Stellar or Algorand. You will lose your money."The attacker is selling into these pools. While a position is open, the pool trades your ETH or BNB for his RIO, and you end up holding the RIO. There are only three that matter, all concentrated-liquidity pools:
Ethereum · Uniswap V3 RIO/WETH 1% · 0xba2a013b…c1bda0c3 · about $54,700This is a judgement about risk, not advice, and it is yours to make. We are pointing at it because it is the one thing in this incident an ordinary holder can still act on.
Since 03:31 UTC on 25 August, roughly 127.9M RIO has moved out of Realio-controlled wallets and holder accounts across five chains, Ethereum, BNB Chain, Algorand, Stellar and the Realio native chain, into accounts created that morning. This is not finished. A second wave began on the evening of 25 August and was still taking wallets on Ethereum at 05:47 UTC on 26 August. The fastest cash-out route was closed within hours, after community members raised the alarm and MEXC and KuCoin suspended RIO deposits on Algorand, and the native chain was halted 23 minutes after its sweep stopped. This page records what the public chain data shows, with every address and transaction ID, so anyone can check it independently.
A second wave is under way, and it is larger than the first. Reading at 05:50 UTC on 26 August: wallets are still being emptied on Ethereum, most recently at 05:47:59, three minutes before we looked. On BNB Chain a second sweep ran to 00:08:03 and took 2,976,241 RIO from 1,574 accounts, more than the entire first BNB sweep. On Ethereum the sweep resumed at 22:39 on 25 August and has taken 1,431 accounts that were not touched the first time.
Everything taken still comes from wallets held inside realio.fund. The platform interface has been deactivated for users, so this is not something an individual holder can act on. What it does mean is that the signing access was never cut: nearly 24 hours after the first sweep, the same address is still able to move holder balances on two chains.
Selling continues alongside it. The Stellar account has now sold 3,305,366 RIO across 546 trades for 126,819 XLM, most recently at 02:59:08 on 26 August, and still holds 68,955,694 RIO. Overnight the attacker also moved 141,000 ALGO and 2,172 USDC off Algorand. The Algorand RIO pile is close to unchanged at 43,379,824.
Other figures on this page are a point-in-time reading as at 25 August 2026, 13:06 UTC, the last complete snapshot. The native chain stopped producing blocks at 10:38:05 UTC at height 19,573,265, 23 minutes after that sweep's last transfer, and we confirmed at 19:44 UTC that it is still stopped at that same height, over nine hours later. Realio's lead developer requested the halt, and has since told validators the chain will stay down possibly for several days while the team investigates, makes sure no further damage can be done, and works out the path forward with the validator set. The 5,732,041 swept on native is frozen for as long as that lasts.
The headline is 127.9M RIO. The number that matters for market cap is far smaller, because most of what was taken had already been excluded from circulating supply. Here is the split.
| Where it came from | RIO taken | Share | In circulating supply? |
|---|---|---|---|
| Algorand ASA reserve wallet | 43,850,860 | 34.3% | No, already excluded |
| Stellar treasury (realio.fund) | 69,869,352 | 54.6% | No, already excluded |
| Reserve and treasury | 113,720,212 | 88.9% | Never counted as float |
| Native chain holder accounts2,374 accounts swept between 09:29 and 10:15 UTC on 25 August | 5,732,041 | 4.5% | Yes |
| BNB Chain holder accounts1,675 accounts across two sweeps: 163 on 25 August, then 1,574 more ending 00:08 on 26 August | 5,180,223 | 4.0% | Yes |
| User wallets, Algorand and Stellar8,908 Algorand custodial accounts, plus Stellar deposits swept after the main drain | 2,122,810 | 1.7% | Yes |
| Ethereum holder accounts1,576 accounts across two sweeps: 121 on 25 August, then 1,431 more from 22:39 on 25 August and still running | 1,163,502 | 0.9% | Yes |
| Taken from usersCounted in circulating supply before 25 August | 14,198,576 | 11.1% | Yes |
| Total taken | 127,918,788 | 100% |
The 14.20M taken from users is 4.34% of the 327.3M circulating supply recorded before the incident. Measured against all RIO in existence, roughly 489.3M across every chain, the full 127.9M is about 26%. A further 976,657 of the deprecated Ethereum RIO was taken from 1,410 accounts; it is a separate asset and is not in these totals.
This table says where tokens sit, not who is owed what. Those are different questions and it is worth keeping them apart. Two things follow that are easy to miss. First, the 5.73M native portion may not be a permanent loss at all: it is frozen on a halted chain, and a Cosmos network that restarts from a pre-incident height would reverse those transfers outright, which is a well-established recovery route and squarely the team's decision. Second, if Realio compensates holders from treasury, that would be previously excluded RIO moving into public hands, a new event rather than an unwinding of this one, so it would not change the arithmetic above. We measure what the chain shows today and will update the moment it shows something else.
| Reading | Circulating supply | Change |
|---|---|---|
| 24 Aug, 06:40 UTC, before the incident | 327,292,172 | |
| 25 Aug, 13:06 UTC, after the incident | 330,451,591 | +3,159,419 (+0.97%) |
Circulating supply. Tokens that were already excluded before the sweep stay excluded: the 43,850,860 Algorand reserve and the 69,869,352 Stellar treasury. The 7,854,851 that came out of holder wallets is still counted as float, being 5,732,041 from native holders, 1,646,125 from Algorand holders and 476,685 from Stellar depositors. On that basis 25 August reads 330,451,591, up 0.97% on 24 August. The figure keeps moving while the attacker keeps selling.
Nothing was minted anywhere. The Algorand asset has been fixed at 100,000,000 and immutable since July 2020, Stellar's RIO total is unchanged, and native supply moved only by scheduled emission. Any chart showing a supply increase on 25 August is showing an accounting artefact, not new tokens.
What we have and have not checked. Ethereum, BNB Chain, Algorand, Stellar and the native chain have each been read transaction by transaction, BNB Chain across 111,964 blocks with no gap. Base and Solana have not. We have not found a log endpoint that serves those queries without a paid key, and we will not call a chain clean on a contract total alone, which is the check that missed Ethereum, BNB Chain and native.
Alongside the RIO the receiving accounts also took 137,340 ALGO, 72,565 XLM, 1,813 USDC, and the rUSD and realioUSD balances. Those last two were essentially the entire unissued supply of each asset, sitting in treasury rather than in user hands, and neither trades on any market, so neither is a realised loss.
On all five chains the dividing line is realio.fund. What was emptied was the reserve and treasury it controlled, plus the wallets its users held RIO in. RIO sitting in a wallet with no realio.fund connection does not appear in any of the five sweeps we traced.
On Ethereum 121 accounts lost their RIO and their ETH between 03:46 and 04:31 UTC. On BNB Chain 163 lost their RIO between 04:15 and 05:01. On the native chain 2,374 were swept between 09:29 and 10:15. Checking costs nothing.
Every entry is a public on-chain event with a transaction or ledger reference. Times are UTC on 25 August 2026.
We describe only what the chain data supports. The cause has not been confirmed by anyone, and we are not asserting one.
Every Algorand source account we sampled holds exactly 0.20 ALGO. That is the protocol minimum for an account (0.1) plus one asset opt-in (0.1). Thousands of accounts sitting at precisely the minimum, each opted into a single Realio asset, is the shape of automatically created custodial sub-accounts, one per user, not of independent self-custody wallets.
Algorand lets an account hand signing authority to another key, which is the signature of a phishing or approval-drainer campaign. We checked a sample of swept accounts and found no rekeying: auth-addr was null on every one. Whoever moved the funds could already sign for them.
The Stellar receiving account was created by the treasury at 03:31, the Algorand one at 04:52, and the last sweeps on both chains land 18 minutes apart. Two separate chains with separate key systems were drained inside the same window.
Both drained wallets continued receiving inbound transfers after they were emptied, and those later deposits were swept too. Whatever front end feeds those addresses was still accepting funds while the drain was in progress.
Taken together this points to compromise of signing keys held by the platform, rather than an exploit of a smart contract or a campaign against individual users. Realio has since indicated that realio.fund wallets were drained, which is consistent with what the chain data shows. The precise route in has not been made public, and we are not speculating about it.
As at 11:50 UTC. Both receiving accounts are listed in full so anyone can follow them live.
The Algorand route was closed, and that part worked. MEXC and KuCoin suspended RIO deposits on the Algorand network after community members spotted the movement and raised it with the exchanges. Exchange policy is not something on-chain data can show directly, but the effect is: no meaningful RIO has left the Algorand receiving account since 08:29:02 UTC, and the balance there stands at 43,379,824 RIO.
Stellar has no equivalent switch. An exchange can suspend deposits because a company decides to. The Stellar DEX is part of the ledger itself: there is no deposit step, no listing to pull, and nobody to ask. The account has paused and resumed repeatedly: a pause around 09:47, back at 12:00, heaviest through the afternoon, a pause at 18:14:51, then selling again overnight to 02:59 on 26 August. It still holds 68,955,694 RIO.
So the honest scoreboard, in two different currencies. In tokens: of the 127.9M taken, roughly 9.1M has reached an exchange, a pool or a buyer. It is made up of 3,305,366 sold on the Stellar DEX, 2,678,982 moved on BNB Chain, 2,066,161 routed off Algorand to an exchange and 1,009,472 dispersed on Ethereum. In money, far less than that sounds. The Stellar sales raised about $23,300. Counting every liquid asset the attacker holds across all five chains, plus what has already been moved out, the total comes to about $263,600 against a nominal $5.9M of RIO taken, roughly 4%. The largest single item is 64.88 ETH on Ethereum, which is not RIO proceeds. The reason is liquidity. Every RIO pool on both EVM chains is a concentrated-liquidity pool, and they are small: about $54,700 in the Uniswap V3 RIO/WETH pool on Ethereum, $30,700 in the PancakeSwap V3 RIO/WBNB pool on BNB Chain and $4,000 in a Uniswap V3 RIO/USDT pool there. Roughly $90,000 of on-chain depth in total, against 118.1M RIO still held. We are not modelling the slippage, because these are not constant-product pools and a formula would give a false precision; the measured outcome is enough. The BNB Chain leg realised about $0.011 per RIO against spot, an 80% discount. The BNB Chain portion was gone before anyone raised the alarm at all, swept and sold between 04:15 and 05:47. This is not a recovery and it is not a freeze. The only portion genuinely immobilised is the 5,732,041 on the native chain, and only while that chain stays halted.
Neither the Algorand asset nor the Stellar asset has clawback enabled. On Stellar the issuer carries auth_clawback_enabled: false and auth_immutable: true, so that cannot be changed later. There is no on-chain mechanism by which these transfers can be reversed.
Out of 127.9M RIO taken, worth about $5.9M at the current price, the attacker has realised roughly $263,596. That is 4.4%, or about one dollar in every twenty-three. RIO taken is not money made, and on these chains the gap between the two is enormous. What follows is everything they actually got: the liquid assets still sitting in their addresses, plus the USDT already moved out to an exchange, priced at market. Read at 05:50 UTC on 26 August, with ETH at $2,464, BNB at $696, XLM at $0.1836, ALGO at $0.0905 and RIO at $0.0465.
| Chain | Held | Value |
|---|---|---|
| Ethereum | 64.88 ETH | $159,824 |
| Ethereum | 5,773 USDC | $5,773 |
| Stellar | 81,733 XLM | $15,004 |
| BNB Chain | 87.84 BNB | $61,119 |
| BNB Chain | 6,128 USDT, already sent to an exchange | $6,128 |
| Algorand | 141,000 ALGO, moved out overnight | $12,758 |
| Algorand | 2,172 USDC, moved out overnight | $2,172 |
| Algorand | 6,601 ALGO | $597 |
| Base | 0.089 ETH | $221 |
| Total realised | $263,596 |
Set that against the 127.9M RIO taken, nominally about $5.9M at the $0.0465 price above. They still hold roughly $5.5M of RIO at quoted prices, 69.0M on Stellar, 43.4M on Algorand and 5.7M frozen on the halted native chain, and there is no venue on any of these chains deep enough to turn much of it into money. The Stellar sales cleared at an 86% discount to spot, and every RIO liquidity pool on Ethereum and BNB Chain put together holds roughly $90,000. One figure is missing and cannot be recovered from chain data: 2,066,161 RIO was deposited to MEXC, and what it sold for, if anything, happened on an exchange's internal books.
The 64.87 ETH is the largest single item and it is not RIO proceeds. That address held zero ETH at 03:30 UTC, sixteen minutes before the sweep began, so all of it arrived with the attack. The 263 Ethereum victims lost 32.63 ETH between them. The remaining 32 ETH we cannot yet source, and we are not going to guess at it.
A small realised total is not the same as getting away with it. All four receiving addresses are published on this page, and everything that moves out of them is written to a public ledger permanently. There is no later point at which this becomes private or reversible. The 118.1M RIO still held sits in three of those addresses and cannot be sold at anything near its quoted price on the venues open to it, which is why two days of selling produced about $23,300. The one route that did reach an exchange ended at a hot wallet run by a venue that performs identity checks, and Realio has said it is in contact with MEXC and KuCoin and intends to work with law enforcement. Whether anything is recovered is not a question chain data can answer. What chain data does guarantee is that the trail is complete and stays that way.
There are two RIO contracts on Ethereum, and both were swept. Alongside 0x94a8b4ee…09f51aa0, the one this site tracks, there is 0xf21661d0…ae4097: same name, same RIO symbol, 74,488,102 supply. It is the old pre-migration token and the market prices it as such, at about $0.00257, roughly 5% of current RIO. The attacker has taken 976,657 of it from 1,410 accounts, but at that price the whole lot is worth about $2,500. It changes the number of people affected, not the money.
The Ethereum leg is now 1,576 addresses. Across both contracts, 1,576 addresses have lost their tokens, in two waves: 121 on the morning of 25 August, then 1,431 more from 22:39 that evening, still running at 05:47 on 26 August. The 1,163,502 RIO in the table above counts only the tracked contract. We do not count the legacy contract as RIO supply, and we checked rather than assumed: 74.4M of it sits with real holders rather than in a burn address, but at 5% of RIO’s price it is a separate deprecated asset, and folding it in would overstate supply by about 74M.
Nothing on this page needs to be taken on trust. Every claim above is a public record.
The BNB Chain leg is reproducible with one query. Take every Transfer log emitted by the RIO contract 0x94a8b4ee5cd64c79d0ee816f467ea73009f51aa0 between blocks 117,900,109 and 118,012,072, group them by recipient, and count how many distinct senders each recipient received from. One address stands out with 163 senders and exactly one transfer from each. Most free BNB Chain endpoints will refuse the query, which is why we missed this leg on the first pass; bsc.rpc.blxrbdn.com serves it in 5,000-block chunks. We publish the block range so the count can be reproduced exactly rather than approximately.