TradeWiz Security Incident: What Happened and What Users Should Know

TradeWiz has not publicly described the incident as a hack. Its Security Notice said a “limited private key exposure” occurred in the SOL PVP private key export feature.TradeWiz Security Notice

Its October 1 update calls it a “security incident”, and also refers to “the attack” and to “stolen funds”.TradeWiz October 1 update Independent analysts report that wallets were drained. What is not yet known is how the keys were exposed: TradeWiz has not published a full technical explanation.

TradeWiz has published three statements about the incident on its X account. The first was a Security Notice on September 30:

It followed with a refund update a few hours later, and an update on the investigation the next morning. Both are quoted in the sections below. The statements so far, in order, next to the third-party reports that appeared between them:

TradeWiz has not published a technical explanation of how the keys were exposed, how many wallets were involved, or how much was taken.

TradeWiz names one product and one feature:

• The product: SOL PVP. This is TradeWiz’s copy trading web app for Solana. It launched in July 2026 as “TradeWiz PVP Web”, which TradeWiz described as “a separate product with its own accounts, copy settings, positions, and trading data”, distinct from the existing TradeWiz Bot.TradeWiz PVP launch post
• The feature: private key export. Exporting a key means copying it out of the app, usually to use the wallet somewhere else. TradeWiz says the exposure occurred in this feature and has not explained how.

A private key controls a wallet. Anyone who holds it can move everything in that wallet, and the key can never be changed. Our cross-chain trading guide explains how trading bots manage wallet keys. So an exposed wallet cannot be repaired, only abandoned, which is TradeWiz’s instruction to SOL PVP users:

TradeWiz says its other products were not part of the incident:

SOL Bot is TradeWiz’s Solana Telegram bot. Robin PVP and BSC PVP are its copy trading products on Robinhood Chain and BNB Chain.

About three and a half hours later, the refund update added a precaution:

TradeWiz did not list the paused products by name. Robinhood Chain and BNB Chain are both EVM networks, so the pause appears to cover Robin PVP and BSC PVP. TradeWiz has not said publicly whether those services have resumed.

These are TradeWiz’s own statements. We have not seen an independent review of its other products, and the notice does not mention its browser extension or its other Solana web app.

TradeWiz has not published a loss figure. The numbers in circulation come from independent on-chain analysts, and TradeWiz has not confirmed them.

The analysis shared by Wazz dates the drains to September 28 and September 30, 2026. At the time of its figures, it showed almost all of the funds still sitting in the attacker’s wallets.Wazz on-chain analysis

The $438,900 figure was picked up by news sites after SolanaFloor relayed it.SolanaFloor post It is an estimate from public blockchain data, not a number from TradeWiz, and it may change as losses are verified.

TradeWiz has committed to full compensation in all three statements. The most detailed is the refund update of September 30:

The October 1 update repeated the commitment: “All verified user losses will be fully compensated.”TradeWiz October 1 update

What that does and does not tell users:

• Refunds depend on verification. TradeWiz says each claim is checked before it is paid. It has not published how claims are verified.
• There is no public claim form or deadline. TradeWiz says its account managers contact affected users directly. For questions, the Security Notice names one support contact, @TradeWiz_MoonQ.TradeWiz Security Notice
• No totals have been given. TradeWiz has not said how many users were refunded in the first wave, how much was paid, or when the rest will follow.

On October 1, TradeWiz said the incident had been reported to the police:

TradeWiz did not name the police force or the jurisdiction, and we have not found a public comment from any authority.

In the same update, TradeWiz addressed whoever carried out the attack, urging them to return the assets and saying that if they fully cooperate it “will consider refraining from further legal action to the extent permitted by law.” It also said it will give the community daily updates on its progress.

Only the first step is TradeWiz’s instruction. The rest are our own precautions.

As of the last update, TradeWiz has not said:

• How the private keys were exposed, and for how long the export feature was vulnerable.
• How many wallets and users were affected, and the total amount lost.
• How many users have been refunded, how much has been paid, and when the remaining claims will be settled.
• Which products the EVM pause covers, and whether those services have resumed.
• Which police force is involved, and whether any stolen funds have been frozen or recovered.
• Whether an independent security review has been or will be carried out.

This page is updated as TradeWiz and independent analysts publish more. TradeWiz is not one of the bots listed in the CrossMeme bot directory.

Update log

• October 1, 2026: Article published, covering TradeWiz’s three public statements through 07:34 UTC on October 1.

Sources

• TradeWiz Security Notice on X, September 30, 2026, 14:41 UTC
• TradeWiz refund update on X, September 30, 2026, 18:08 UTC
• TradeWiz Security Incident Update on X, October 1, 2026, 07:34 UTC
• TradeWiz PVP Web launch post on X, July 2, 2026
• TradeWiz documentation: Support
• Wazz (@WazzCrypto) on X, September 30, 2026, 19:04 UTC
• Rune (@RuneCrypto_) on X, September 30, 2026, 15:20 UTC
• SolanaFloor on X, September 30, 2026, 20:26 UTC