Nguyen Van Thanh Warning: 2.11B TMAI Hack and $42K+ Traced Cash-Outs

Token Metrics’ counterparty warning concerning Nguyen Van Thanh, the 2.11B TMAI hack, $42K+ in traced cash-outs, and linked-wallet evidence. Token Metrics has formally notified relevant regulators and law-enforcement authorities.
Public LinkedIn profile photograph attributed to Nguyen Van Thanh, also known as Thành Nguyễn
Public LinkedIn profile photograph attributed to Nguyen Van Thanh.
Share

Counterparty warning: Token Metrics recommends enhanced due diligence before giving Nguyen Van Thanh, also known as Thành Nguyễn, access to source code, credentials, wallets, smart contracts, trading systems, or other sensitive infrastructure.

Thanh completed a Token Metrics contractor/work trial from December 5–16, 2025. In February and March 2026, Token Metrics’ administrative/deployer key was used to remove approximately 2.11 billion TMAI from three Base contracts. The tokens were transferred to a Gnosis Safe and sold through CoW Protocol. Token Metrics traced at least 42,094.28 USDC in four cash-outs from the incident-linked Safe and cash-out infrastructure.

The $42K+ figure describes documented traced cash-outs, not the complete market value of the 2.11 billion TMAI removed.

Token Metrics’ investigation identified Thanh as a specific attribution lead. This was not based on a random name or wallet adjacency.

Arkham screenshot showing the wallet labeled thanh081101 on Polymarket and a transfer to the identified Binance deposit address
Arkham screenshot preserved by Token Metrics showing wallet 0x4BA… labeled “thanh081101” on Polymarket and its exchange activity. Open the wallet on Arkham.

Why Token Metrics identified Nguyen Van Thanh

  • Wallet 0x4BA938F3541191A824A71198B9DFAD464C27338c was cryptographically linked to the Polymarket username thanh081101.
  • The username matches Thanh’s name and the November 8, 2001 date of birth in his Token Metrics onboarding record.
  • Drain-linked infrastructure sent approximately 10 USDC to that wallet after the incident.
  • The wallet repeatedly transferred assets to Binance deposit address 0x8Aa6e8A46B458d15702E1Ea120D6A7Fd11daCce1.
  • Thanh later confirmed in writing that he owns both the personal wallet and the Binance deposit address.
  • His own Binance export corroborated his control of that deposit endpoint.
Preserved Arkham label showing thanh081101 on Polymarket for wallet 0x4BA
Preserved Arkham label showing “thanh081101” on Polymarket for wallet 0x4BA…. Source: Arkham.

Polymarket evidence: open the wallet’s Polymarket profile. The profile currently displays as “Anon”; Token Metrics preserved the earlier thanh081101 association, which remains visible in Arkham’s wallet label and the screenshots above.

Companies and roles listed on his LinkedIn profile

Nguyen Van Thanh’s public LinkedIn profile lists the following companies and roles:

  • Talyxion LLC — Co-Founder; self-employed; March 2023–present.
  • BeeTrade — Graduate Research Fellow; part-time; June 2025–March 2026.
  • CoinLion — Senior Quantitative Trader; contract; June 2025–March 2026.
  • Clean Asset Management LLC — AI Solutions Architect, Intangible Asset Commercialization; contract; June 2025–January 2026.
  • WorldQuant — Quantitative Consultant; part-time; March 2023–March 2025.

His LinkedIn headline also describes him as a Quant Strategies Provider and a PhD Candidate at Tsinghua University.

Screenshot of Nguyen Van Thanh's public LinkedIn experience section listing Talyxion, BeeTrade, CoinLion, Clean Asset Management and WorldQuant
Screenshot of the public LinkedIn experience section supplied to Token Metrics. Open the public LinkedIn profile.

Four addresses to verify

  1. TMAI recipient Safe: 0x4fB5EfE430cb915fCFE784e922c460F256405946
  2. Base cash-out address: 0xA149044aBB619622b86Fc520823f2d711A465FeF
  3. Thanh’s acknowledged personal wallet: 0x4BA938F3541191A824A71198B9DFAD464C27338c
  4. Thanh’s acknowledged Binance deposit address: 0x8Aa6e8A46B458d15702E1Ea120D6A7Fd11daCce1

Token Metrics’ position

The evidence firmly establishes that Token Metrics identified the correct owner of the personal wallet and Binance endpoint. It also establishes a direct on-chain intersection between drain-linked infrastructure and his wallet.

This warning is intended for companies considering Nguyen Van Thanh for roles involving source code, credentials, wallets, smart contracts, trading systems, or other sensitive infrastructure. Those companies should review the linked evidence and perform enhanced due diligence before granting access.

Token Metrics has reported Nguyen Van Thanh to United States and Vietnamese authorities as a person of interest in its TMAI investigation.

This is a documented counterparty-risk warning reflecting Token Metrics’ investigation and the supporting wallet evidence.

Primary links