{"id":6506,"date":"2026-07-17T13:42:58","date_gmt":"2026-07-17T13:42:58","guid":{"rendered":"https:\/\/tokenmetrics.com\/blog\/nguyen-van-thanh-tmai-security-incident-wallet-evidence\/"},"modified":"2026-07-18T01:54:24","modified_gmt":"2026-07-18T01:54:24","slug":"nguyen-van-thanh-tmai-security-incident-wallet-evidence","status":"publish","type":"post","link":"https:\/\/tokenmetrics.com\/blog\/nguyen-van-thanh-tmai-security-incident-wallet-evidence\/","title":{"rendered":"Nguyen Van Thanh Warning: 2.11B TMAI Hack and $42K+ Traced Cash-Outs"},"content":{"rendered":"<p><!-- TM-INCIDENT-DRAFT:NGUYEN-VAN-THANH-2026-07-17 --><\/p>\n<div class=\"tm-risk-summary\" style=\"border-left:5px solid #d4af37;background:#f8f8f8;padding:20px;margin:24px 0;\">\n<p><strong>Counterparty warning:<\/strong> Token Metrics recommends enhanced due diligence before giving <strong>Nguyen Van Thanh, also known as Th\u00e0nh Nguy\u1ec5n<\/strong>, access to source code, credentials, wallets, smart contracts, trading systems, or other sensitive infrastructure.<\/p>\n<\/div>\n<p>Thanh completed a Token Metrics contractor\/work trial from December 5\u201316, 2025. In February and March 2026, Token Metrics\u2019 administrative\/deployer key was used to remove approximately <strong>2.11 billion TMAI<\/strong> from three Base contracts. The tokens were transferred to a Gnosis Safe and sold through CoW Protocol. Token Metrics traced at least <strong>42,094.28 USDC<\/strong> in four cash-outs from the incident-linked Safe and cash-out infrastructure.<\/p>\n<p><strong>The $42K+ figure describes documented traced cash-outs, not the complete market value of the 2.11 billion TMAI removed.<\/strong><\/p>\n<p>Token Metrics\u2019 investigation identified Thanh as a specific attribution lead. This was not based on a random name or wallet adjacency.<\/p>\n<figure class=\"wp-block-image size-large\">\n<img decoding=\"async\" src=\"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/07\/thanh-arkham-wallet-scaled.png\" alt=\"Arkham screenshot showing the wallet labeled thanh081101 on Polymarket and a transfer to the identified Binance deposit address\" title=\"\"><figcaption>Arkham screenshot preserved by Token Metrics showing wallet 0x4BA\u2026 labeled \u201cthanh081101\u201d on Polymarket and its exchange activity. <a href=\"https:\/\/intel.arkm.com\/explorer\/address\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\">Open the wallet on Arkham<\/a>.<\/figcaption><\/figure>\n<h2>Why Token Metrics identified Nguyen Van Thanh<\/h2>\n<ul>\n<li>Wallet <a href=\"https:\/\/etherscan.io\/address\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\"><code>0x4BA938F3541191A824A71198B9DFAD464C27338c<\/code><\/a> was cryptographically linked to the Polymarket username <strong>thanh081101<\/strong>.<\/li>\n<li>The username matches Thanh\u2019s name and the November 8, 2001 date of birth in his Token Metrics onboarding record.<\/li>\n<li>Drain-linked infrastructure sent approximately 10 USDC to that wallet after the incident.<\/li>\n<li>The wallet repeatedly transferred assets to Binance deposit address <a href=\"https:\/\/etherscan.io\/address\/0x8Aa6e8A46B458d15702E1Ea120D6A7Fd11daCce1\" target=\"_blank\" rel=\"noopener\"><code>0x8Aa6e8A46B458d15702E1Ea120D6A7Fd11daCce1<\/code><\/a>.<\/li>\n<li>Thanh later confirmed in writing that he owns both the personal wallet and the Binance deposit address.<\/li>\n<li>His own Binance export corroborated his control of that deposit endpoint.<\/li>\n<\/ul>\n<figure class=\"wp-block-image size-large\">\n<img decoding=\"async\" src=\"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/07\/nguyen-polymarket-thanh081101-label.jpg\" alt=\"Preserved Arkham label showing thanh081101 on Polymarket for wallet 0x4BA\" title=\"\"><figcaption>Preserved Arkham label showing <strong>\u201cthanh081101\u201d on Polymarket<\/strong> for wallet <code>0x4BA\u2026<\/code>. Source: <a href=\"https:\/\/intel.arkm.com\/explorer\/address\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\">Arkham<\/a>.<\/figcaption><\/figure>\n<p><strong>Polymarket evidence:<\/strong> <a href=\"https:\/\/polymarket.com\/profile\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\">open the wallet\u2019s Polymarket profile<\/a>. The profile currently displays as \u201cAnon\u201d; Token Metrics preserved the earlier <strong>thanh081101<\/strong> association, which remains visible in <a href=\"https:\/\/intel.arkm.com\/explorer\/address\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\">Arkham\u2019s wallet label<\/a> and the screenshots above.<\/p>\n<h2>Companies and roles listed on his LinkedIn profile<\/h2>\n<p>Nguyen Van Thanh\u2019s public LinkedIn profile lists the following companies and roles:<\/p>\n<ul>\n<li><strong>Talyxion LLC<\/strong> \u2014 Co-Founder; self-employed; March 2023\u2013present.<\/li>\n<li><strong>BeeTrade<\/strong> \u2014 Graduate Research Fellow; part-time; June 2025\u2013March 2026.<\/li>\n<li><strong>CoinLion<\/strong> \u2014 Senior Quantitative Trader; contract; June 2025\u2013March 2026.<\/li>\n<li><strong>Clean Asset Management LLC<\/strong> \u2014 AI Solutions Architect, Intangible Asset Commercialization; contract; June 2025\u2013January 2026.<\/li>\n<li><strong>WorldQuant<\/strong> \u2014 Quantitative Consultant; part-time; March 2023\u2013March 2025.<\/li>\n<\/ul>\n<p>His LinkedIn headline also describes him as a <strong>Quant Strategies Provider<\/strong> and a <strong>PhD Candidate at Tsinghua University<\/strong>.<\/p>\n<figure class=\"wp-block-image size-large\">\n<img decoding=\"async\" src=\"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/07\/nguyen-linkedin-experience-cropped.jpg\" alt=\"Screenshot of Nguyen Van Thanh&#039;s public LinkedIn experience section listing Talyxion, BeeTrade, CoinLion, Clean Asset Management and WorldQuant\" title=\"\"><figcaption>Screenshot of the public LinkedIn experience section supplied to Token Metrics. <a href=\"https:\/\/www.linkedin.com\/in\/v4nth4nh08112k1\/\" target=\"_blank\" rel=\"noopener\">Open the public LinkedIn profile<\/a>.<\/figcaption><\/figure>\n<h2>Four addresses to verify<\/h2>\n<ol>\n<li><strong>TMAI recipient Safe:<\/strong> <a href=\"https:\/\/basescan.org\/address\/0x4fB5EfE430cb915fCFE784e922c460F256405946\" target=\"_blank\" rel=\"noopener\"><code>0x4fB5EfE430cb915fCFE784e922c460F256405946<\/code><\/a><\/li>\n<li><strong>Base cash-out address:<\/strong> <a href=\"https:\/\/basescan.org\/address\/0xA149044aBB619622b86Fc520823f2d711A465FeF\" target=\"_blank\" rel=\"noopener\"><code>0xA149044aBB619622b86Fc520823f2d711A465FeF<\/code><\/a><\/li>\n<li><strong>Thanh\u2019s acknowledged personal wallet:<\/strong> <a href=\"https:\/\/etherscan.io\/address\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\"><code>0x4BA938F3541191A824A71198B9DFAD464C27338c<\/code><\/a><\/li>\n<li><strong>Thanh\u2019s acknowledged Binance deposit address:<\/strong> <a href=\"https:\/\/etherscan.io\/address\/0x8Aa6e8A46B458d15702E1Ea120D6A7Fd11daCce1\" target=\"_blank\" rel=\"noopener\"><code>0x8Aa6e8A46B458d15702E1Ea120D6A7Fd11daCce1<\/code><\/a><\/li>\n<\/ol>\n<h2>Token Metrics\u2019 position<\/h2>\n<p>The evidence firmly establishes that Token Metrics identified the correct owner of the personal wallet and Binance endpoint. It also establishes a direct on-chain intersection between drain-linked infrastructure and his wallet.<\/p>\n<p><strong>This warning is intended for companies considering Nguyen Van Thanh for roles involving source code, credentials, wallets, smart contracts, trading systems, or other sensitive infrastructure.<\/strong> Those companies should review the linked evidence and perform enhanced due diligence before granting access.<\/p>\n<p><strong>Token Metrics has reported Nguyen Van Thanh to United States and Vietnamese authorities as a person of interest in its TMAI investigation.<\/strong><\/p>\n<p><em>This is a documented counterparty-risk warning reflecting Token Metrics\u2019 investigation and the supporting wallet evidence.<\/em><\/p>\n<h2>Primary links<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.linkedin.com\/in\/v4nth4nh08112k1\/\" target=\"_blank\" rel=\"noopener\">Nguyen Van Thanh\u2019s public LinkedIn profile<\/a><\/li>\n<li><a href=\"https:\/\/arxiv.org\/abs\/2505.00495\" target=\"_blank\" rel=\"noopener\">VNU Hanoi academic publication naming Nguyen Van Thanh<\/a><\/li>\n<li><a href=\"https:\/\/polymarket.com\/profile\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\">Polymarket wallet profile<\/a><\/li>\n<li><a href=\"https:\/\/intel.arkm.com\/explorer\/address\/0x4BA938F3541191A824A71198B9DFAD464C27338c\" target=\"_blank\" rel=\"noopener\">Arkham wallet page<\/a><\/li>\n<li><a href=\"https:\/\/tokenmetrics.com\/blog\/tmai-migration-solana\/\" target=\"_blank\" rel=\"noopener\">Original Token Metrics TMAI migration and incident article<\/a><\/li>\n<\/ul>\n<p><!-- TM-ARTICLE-SCHEMA-2026-07-17:START --><br \/>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"Article\",\"headline\":\"Nguyen Van Thanh Warning: 2.11B TMAI Hack and $42K+ Traced Cash-Outs\",\"description\":\"Token Metrics\u2019 counterparty warning concerning Nguyen Van Thanh, the 2.11B TMAI hack, $42K+ in traced cash-outs, and linked-wallet evidence. Token Metrics has formally notified relevant regulators and law-enforcement authorities.\",\"datePublished\":\"2026-07-17T13:42:58\",\"dateModified\":\"2026-07-18T01:54:23.491941+00:00\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"https:\/\/tokenmetrics.com\/blog\/nguyen-van-thanh-tmai-security-incident-wallet-evidence\/\"},\"image\":\"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/07\/nguyen-van-thanh-linkedin.jpg\",\"author\":{\"@type\":\"Organization\",\"name\":\"Token Metrics\",\"url\":\"https:\/\/tokenmetrics.com\/\"},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Token Metrics\",\"url\":\"https:\/\/tokenmetrics.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/01\/logo-black-3.png\"}},\"about\":{\"@type\":\"Person\",\"name\":\"Nguyen Van Thanh\",\"alternateName\":\"Th\u00e0nh Nguy\u1ec5n\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/v4nth4nh08112k1\/\",\"https:\/\/polymarket.com\/profile\/0x4BA938F3541191A824A71198B9DFAD464C27338c\"]}}<\/script><br \/>\n<!-- TM-ARTICLE-SCHEMA-2026-07-17:END --><\/p>\n","protected":false},"excerpt":{"rendered":"Token Metrics\u2019 counterparty warning concerning Nguyen Van Thanh, the 2.11B TMAI hack, $42K+ in traced cash-outs, and linked-wallet evidence. Token Metrics has formally notified relevant regulators and law-enforcement authorities.","protected":false},"author":1,"featured_media":6508,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_tm_paid_cta_tier":"","_tm_paid_cta_heading":"","_tm_paid_cta_body":"","csco_display_header_overlay":false,"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_reading_time":"","csco_page_toc_navigation":"","csco_post_video_location":[],"csco_post_video_location_hash":"","csco_post_video_url":"","csco_post_video_bg_start_time":0,"csco_post_video_bg_end_time":0,"csco_post_video_bg_volume":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[],"sections":[],"entities":[],"class_list":["post-6506","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security","cs-entry","cs-video-wrap"],"jetpack_featured_media_url":"https:\/\/tokenmetrics.com\/blog\/wp-content\/uploads\/2026\/07\/nguyen-van-thanh-linkedin.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/6506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/comments?post=6506"}],"version-history":[{"count":13,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/6506\/revisions"}],"predecessor-version":[{"id":6592,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/posts\/6506\/revisions\/6592"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/media\/6508"}],"wp:attachment":[{"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/media?parent=6506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/categories?post=6506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/tags?post=6506"},{"taxonomy":"section","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/sections?post=6506"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/tokenmetrics.com\/blog\/wp-json\/wp\/v2\/entities?post=6506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}