ACTFUN discloses exposed deployment key as Bitquery traces 591M ACT on Arc day one
By 8bitcrypto
September 16, 2026
ACTFUN disclosed that a private key used in its deployment setup had been exposed, pausing claims while the team reviewed code control, admin rights, treasury wallets, and payout logic. The notice landed on the same calendar day Circle took Arc to public mainnet, putting a brand-new launchpad environment under a stress test few NFT desks wanted this early. Bitquery Research later published a chain-level investigation that separates what the ledgers prove from what social posts still assert.
The on-chain sequence Bitquery maps is blunt. Three contracts named by the live ACTFUN app — a fixed claim contract, a Genesis NFT claim contract, and a sale registry — sent their full ACT balances to wallet 0x08235e…8009 within about thirteen seconds. That address is the same wallet the app labels as its launch admin. The confirmed total is 590,957,595.96 ACT: 450,000,000 from the fixed claim address, 100,000,000 from the Genesis NFT claim address, and 40,957,595.959596 from the sale registry. After those transfers, the three source balances sat at zero.
Bitquery is careful about attribution. The three source transfers line up in time and scope with ACTFUN’s disclosure, and the live app names both the contracts and the receiving admin wallet. ACTFUN has not published those transaction hashes as the illicit set, so the link is reasoned from timing and app data rather than a courtroom confession. For collectors watching Genesis NFT claim rails, that distinction matters: the desk can say the contracts emptied; it cannot invent a named attacker from a hash alone.
What happened next is where rumor and ledger diverge. Bitquery finds no direct ACT swap in its Arc DEX records that lists the admin wallet or a later ten-million-ACT receiver as the transaction sender. The admin wallet did place ACT and USDC into a market pool, add and remove liquidity across two cycles, and leave a large net ACT balance in the pool while taking out more USDC than it deposited. Once tokens mix inside a pool, the record can measure share shifts, but it cannot cleanly say how much of the key-wallet ACT was sold as a discrete dump.
Cross-chain, Bitquery confirms about 50,178.32 USDC leaving Arc through two Relay routes, with ETH paid to the same launch-admin path on Base — roughly 20.8421 ETH in the mapped outputs. Later holdings in the traced tree include ETH parked on Base, USDC on Base, and USDT on BNB Chain. Exact snapshot balances Bitquery published for its cut-off include roughly 17.43 ETH at a later Base wallet, about 3,998.52 USDC on Base, and about 4,027.27 USDT on BNB Chain, while most of the ACT still sat at the Arc admin wallet and a second Arc wallet still held 10,000,000 ACT. Those figures are holdings, not a verdict on who owns the keys behind every hop.
The dollar headline is the part this desk will not inflate. Some posts floated an over $1 million stolen line. Bitquery’s finding is explicit: that claim remains unconfirmed. Even at the highest ACT/USDC mark in Bitquery’s measured window, the marked value of the 590.96 million ACT moved from the three source wallets peaked around $766,867.71 and stayed below one million dollars. The later USDC route cannot simply be added on top of that mark without double-counting value that may already sit inside the pool share. ACTFUN may yet name other affected assets outside Bitquery’s mapped addresses, but those would be additional disclosures, not numbers this article invents.
Context makes the timing sharper for NFT readers. Arc’s public mainnet day was supposed to be a stablecoin L1 celebration, with marketplace rails and claim contracts coming online for day-one experiments. Genesis NFT claim machinery sitting inside that first wave means a key exposure is not only a treasury story; it is a collectibles-access story. When claim contracts empty into an admin label, every pending claim and every NFT-linked distribution schedule becomes a recovery-room problem until the team republishes what is still safe to call.
Recovery hygiene for anyone who touched ACTFUN rails is the same checklist that shows up after other leaked-key incidents. Treat official claim portals as frozen until the team names replacement contracts and signing keys. Do not chase “recovery” DMs, fake bridge helpers, or lookalike claim sites that appear during the pause. Screenshot any claim receipts and transaction hashes you already have. Watch for ACTFUN to confirm whether the Bitquery-mapped transfers are the full incident set, and whether Genesis NFT claim users need a migration path.
The Rug & Recovery Room read is that deployment keys remain a single point of failure even when the marketing stack is a fresh L1 and a shiny launchpad. Circle shipping Arc to public mainnet does not immunize day-one apps from operational mistakes. Bitquery’s audit posture — state balances over noisy event logs, pool mixing treated as a hard stop for clean ownership claims, busy wallets ending the naming trail — is the standard this desk will keep using when screenshots outrun the chain.
Until ACTFUN publishes a fuller loss total and confirms the hashes, the proved desk facts stay narrow. A deployment private key was exposed. Claims were paused. Three live contracts sent about 590,957,595.96 ACT to the launch admin wallet inside roughly thirteen seconds. Later traces show about 50,178.32 USDC across chains plus ETH, USDC, and USDT holdings in downstream wallets. Over $1 million stolen remains unconfirmed per Bitquery. Everything else is still work for the recovery room, not copy for a viral loss ticker.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
