GoMining Hack Drains 600+ Wallets, Thieves Consolidate $2.8M in ETH

On September 4, 2026, on-chain monitor Specter flagged a coordinated drain targeting more than 600 wallets suspected to be linked to the GoMining hack, the Bitcoin mining and rewards platform.

Combined losses total approximately $2.8 million. Attackers moved fast, swapping and bridging stolen assets across multiple chains before consolidating everything into roughly 1,147 ETH.

What Happened: A Tagged Service Wallet, 600+ Addresses, One Exit Route

The bulk of the damage came from a single wallet. A service address tagged on-chain as GoMining lost approximately $2.79 million, almost the entire haul in one hit.

The remaining losses spread across 600-plus other addresses. Most of those wallets had one thing in common: a prior history of holding GMT, the platform’s native token for mining allocation and ecosystem access.

That shared token history is what led Specter to cluster them together.

That said, holding GMT alone does not confirm platform affiliation for every address. The link between the drained wallets and GoMining remains on-chain inference, not company confirmation.

The suspected theft address, 0xa73…4704, was flagged by CoinGabbar as the destination point of the initial drain.

Once the wallets were emptied, the attacker followed a pattern now familiar in 2026’s cluster exploits. Stolen tokens were swapped across assets, bridged across multiple networks, then settled as ~1,147 ETH.