Analysis on the Recent Incident Happened to Glyph

Executive summary

On July 30, 2026, Glyph suffered a major financial loss during a proposed investment and over-the-counter transaction with two outside counterparties.

The proposed business relationship included:

• An OTC purchase of GLYPH alpha;
• An equity investment in Glyph; and
• Funding for agreed marketing activities.

The total stated value of the proposed arrangement was approximately US$6.5 million.

Members of the Glyph team met the counterparty and their partner in person in Spain. Before the main transaction, we also completed a small test OTC transfer. These steps, together with the continuing investment discussions, increased our confidence that the counterparties intended to complete the agreement.

To prepare for the main OTC transaction, the Glyph team consolidated GLYPH alpha into the wallet provided by the counterparties. The agreed payment was never delivered.

Instead, the transferred alpha was fully unstaked into TAO. The resulting funds were moved rapidly through several intermediary wallets and ultimately divided between two wallets identified to us as exchange-related accounts:

• Approximately 2,277.5520 TAO reached the wallet identified to us as connected to Binance.
• Approximately 1,201.9758 TAO reached the wallet identified to us as connected to MEXC.

The counterparties subsequently stopped responding.

Our detailed analysis indicates that approximately 3,479.5278 TAO reached the two identified exchange wallets. We currently estimate the total loss at approximately 3,479.5278 TAO.

The Glyph team suffered the overwhelming majority of the loss. A limited number of community members and personal contacts were also affected, but their combined losses were substantially smaller than the team's loss.

Based on the test activity, the counterparties' representations, the timing of the transactions, and the structured movement of funds, Glyph believes this was an intentional and prepared fraud—not an accidental transaction, a misunderstanding, or an investment that simply failed.

This remains Glyph's assessment based on the evidence currently available. Final attribution and legal characterization will be determined through the appropriate investigative and legal processes.

Background

The Glyph team entered into discussions with two outside parties regarding a proposed OTC transaction and broader investment relationship.

Members of our team met the counterparty and their partner in person while they were visiting Spain. We spent time together and discussed the proposed OTC purchase, equity investment, marketing support, and long-term commercial relationship.

Throughout these discussions, the counterparties repeatedly represented that they had limited knowledge of Bittensor. Our team therefore spent considerable time explaining:

• How the Bittensor network operates;
• How subnet alpha works;
• How alpha can be transferred and unstaked;
• How Bittensor wallets and hotkeys operate;
• How liquidity and conversions work; and
• How the proposed OTC transaction would be completed.

Before proceeding with the larger transaction, a small test was conducted on July 7, 2026. The receiving wallet was sent 1,500 GLYPH alpha and a small amount of TAO for transaction costs. It then performed several small unstake and restake operations.

Most of the test alpha remained in the wallet for approximately three weeks.

The apparent success of this test, together with our in-person meeting and the ongoing discussions, increased our confidence that the counterparties were acting in good faith.

Preparation for the primary transaction

On July 30, 2026, the Glyph team prepared the alpha required for the proposed OTC deal.

Between 14:13 and 16:01 UTC, the counterparty-provided wallet received 13 separate alpha stake transfers from 13 addresses. These transfers totaled approximately:

508,918.539409 GLYPH alpha

When combined with the remaining balance from the July 7 test and subsequent subnet emissions, the wallet held approximately:

510,355.350031 GLYPH alpha

immediately before the position was unstaked.

The transferred assets came primarily from the Glyph team. A limited number of personal contacts and community participants also contributed assets in preparation for the transaction.

Conversion of the alpha

Shortly before the alpha was unstaked, the wallet also received two direct TAO deposits from the same funding address:

The wallet then unstaked the entire GLYPH alpha position in three transactions:

The final transaction fully closed the wallet's subnet-117 position.

Together, the direct deposits and the proceeds from unstaking produced approximately 3,479.5654 TAO for withdrawal.

Effect on the GLYPH alpha price

Assembling the amount of alpha required for the deal meant acquiring and staking a large amount of TAO into GLYPH over the days before July 30 — buying pressure that pushed the alpha price up well beyond its normal range. Once the counterparty had the alpha in hand and unstaked all of it at once, that same size worked in reverse: the price collapsed within minutes.

This chart is built directly from on-chain pool state at the time each block was produced — not a third-party market feed — so every point on it is independently reproducible. See the on-chain analysis for the zoomed-in view of July 30 and the exact figures.

Initial withdrawal

Between 16:24:48 and 16:29:36 UTC, the wallet transferred approximately 3,479.565385571 TAO to two first-hop wallets.

First-hop wallet A

The following transfers were sent to: 5DWnCJqfSBt2c8S7Ud7nLWHysGyoWGUBYGbq7gHDpWvqSHwe

The initial 1 TAO transfer appears consistent with a small test before the larger transfer.

First-hop wallet B

The remaining funds were sent to: 5C8AKi6eoD24CwP3A8Z6dXJ7xLhdw7WY2khFvguLHfye258N

The 10 TAO transfer was followed one minute later by 1,500 TAO and then by a final sweep of the wallet's remaining balance.

Downstream routing

The two first-hop wallets were not the final destinations. Both forwarded the funds through additional relay wallets before the TAO reached the two exchange-related addresses.

Route identified as the Binance flow

First-hop wallet B sent approximately 2,277.552989584 TAO to a dedicated relay wallet: 5FELR9923w7JcbQtRj2kN4X3KrgAwtxiLgu4x7Ngc8fi8WjN

The funds were divided into 13 transfers, and the relay wallet forwarded approximately 2,277.551962732 TAO onward in six batches to 5GBnPzvPghS8AuCoo6bfnK7JUFHuyUhWSFD4woBNsKnPiEUi — the address Glyph identifies as connected to the Binance account used in the incident. The full chunk-by-chunk breakdown is in the on-chain analysis.

The difference of approximately 0.001 TAO between the amount received by the relay and the amount forwarded is consistent with transaction costs.

Route identified as the MEXC flow

The remaining funds followed two paths that eventually merged at the same relay wallet.

First-hop wallet A forwarded approximately 100.99 TAO to 5EAQuf9wgNPsnqKxhxGTXPYQkxFXTobtZfeNHXWMykk4D66a.

Separately, first-hop wallet B sent 1,101 TAO to an additional router: 5GuJeAGyKKyh1t7BgouMwBMCc4QKik6hkRNCSxqzP1u8DhLy

This address was not part of the transaction path initially known to us. It was discovered by tracing every outgoing transfer from first-hop wallet B.

The router forwarded approximately 1,100.988459722 TAO to the same MEXC-bound relay wallet through ten transactions. After both paths merged, the relay forwarded approximately 1,201.975796722 TAO to 5FqBL928choLPmeFz5UVAvonBD5k7K2mZSXVC9RkFzLxoy2s — the address Glyph identifies as connected to the MEXC account used in the incident.

Reconciliation of the funds

The complete on-chain analysis produced the following reconciliation:

Approximately 65% of the traced TAO reached the wallet identified as Binance, while approximately 35% reached the wallet identified as MEXC.

The principal Binance-bound sequence began within minutes of the initial withdrawal and reached its final documented destination approximately 63 minutes later. The MEXC-bound sequence continued for several additional hours, with the final documented transfer occurring at 21:36:12 UTC.

By the end of the routing process, the intermediary wallets had been reduced to zero or dust balances.

Why we believe the incident was planned

We do not believe the evidence is consistent with an accidental transaction, a commercial disagreement, or an investment that merely failed.

The counterparties had repeatedly claimed that they were not familiar with Bittensor. Our team spent considerable time teaching them how Bittensor, subnet alpha, staking, wallet transfers, and liquidity worked.

Their conduct before and during the incident was materially inconsistent with those claims.

The on-chain evidence shows:

• A small test transfer approximately three weeks before the main incident;
• Small test unstakes and a root-restake operation from the receiving wallet;
• A three-week period during which most of the test position remained untouched;
• Consolidation of the primary alpha position from 13 addresses;
• Complete unstaking of approximately 510,355 alpha;
• Small test-sized TAO transfers before larger withdrawals;
• Rapid division of the resulting TAO between multiple wallets;
• Repeated transfers in structured and increasing amounts;
• Use of dedicated pass-through and merging relay wallets;
• Six periodic sweeps toward the wallet identified as Binance;
• A separate multi-hop route toward the wallet identified as MEXC;
• Near-complete depletion of the intermediary wallets; and
• The counterparties ending communication after the funds were moved.

This activity required significant operational knowledge of Bittensor—or advance coordination with someone who possessed that knowledge.

The earlier test was not limited to passively receiving alpha. The receiving wallet actively tested unstaking, conversion, and restaking mechanics. This occurred weeks before the primary transaction.

In our assessment, this contradicts the counterparties' claimed lack of familiarity with Bittensor. We believe those representations were materially misleading.

We further believe the small test transaction and relationship-building process may have been used to establish trust before obtaining control of the substantially larger transfer.

For these reasons, Glyph considers the incident to be an intentional and prepared fraud.

This conclusion is Glyph's present assessment based on the combined contractual, communications, in-person, and on-chain evidence. The blockchain establishes what the wallets did, but it does not independently prove the identity of every person operating them. Final legal responsibility will be determined through the appropriate investigative and legal processes.

Impact on the team and community

The Glyph team provided and controlled the substantial majority of the assets involved. The team therefore suffered the overwhelming majority of the financial loss.

A limited number of community members and personal contacts also contributed assets used to prepare for the transaction. Thankfully, the number of community participants directly affected was relatively small, and their combined losses were substantially smaller than the team's loss.

We do not say this to minimize anyone's experience. Every loss matters, regardless of size. We are communicating with affected participants and reconciling the precise amount attributable to each person.

We will not publish anyone's personal or financial information without their permission.

Our responsibility

We take responsibility for the operational decisions that allowed this incident to occur.

The primary transfer was completed without independent escrow or an atomic-settlement mechanism that required payment and asset delivery to occur together.

We placed too much confidence in:

• Meeting the counterparties in person;
• The earlier test transaction;
• The continuing investment discussions;
• The apparent size of the proposed agreement; and
• The representations made to us during the relationship.

None of these factors justified transferring control of the primary assets before payment was secured.

This was a serious failure in our counterparty-risk and transaction-approval process. We must learn from it and correct the weaknesses that made the incident possible.

At the same time, our procedural failure does not authorize any counterparty to retain or dispose of assets without delivering the agreed consideration.

Actions underway

We have begun or are preparing the following actions:

• Preserving agreements, messages, identity information, meeting records, wallet data, and transaction evidence;
• Maintaining a transaction-level record of the complete fund flow;
• Seeking an independent blockchain-forensics review;
• Contacting the exchanges associated with the final destination wallets;
• Requesting preservation of relevant account, identity, and transaction records;
• Preparing reports for appropriate law-enforcement and regulatory authorities;
• Consulting legal counsel regarding recovery and potential civil proceedings;
• Reconciling the loss attributable to each team and community participant; and
• Investigating whether additional wallets, accounts, advisers, or other parties were involved.

Some information cannot yet be shared publicly because disclosure could interfere with exchange cooperation, recovery efforts, or a formal investigation.

Changes to our procedures

Effective immediately:

• No OTC transaction will be completed without reputable third-party escrow or an approved atomic-settlement mechanism.
• A successful test transaction will not be treated as sufficient evidence that a counterparty can be trusted with a larger transaction.
• Assets will not be released based on an in-person meeting, reputation claim, payment promise, screenshot, or purported proof of funds.
• Material transactions will require documented counterparty and beneficial-owner verification.
• Wallet ownership and source-of-funds information will be verified before settlement.
• Large transfers will require multiple internal approvals.
• Where practical, transactions will be divided into independently settled tranches.
• Legal review will be required for material OTC, investment, and cross-border agreements.
• Marketing, equity, and token transactions will be documented and settled separately unless legal counsel approves another structure.

Our commitment to Glyph

This is an extremely difficult time for the Glyph team.

We are dealing with a major financial loss while trying to understand the full situation, support everyone affected, preserve evidence, cooperate with relevant parties, and pursue possible recovery. The team is under significant financial and emotional pressure.

Despite this, our commitment to Glyph remains unchanged.

We are not abandoning the project. We will continue building, supporting the network, and working toward the goals we have shared with the community.

This incident will create challenges, and we do not want to pretend otherwise. But it does not change our belief in Glyph or our determination to continue.

What we ask from the community

Please do not threaten, harass, or attempt to identify private individuals based on speculation. Such actions could harm innocent people and interfere with formal recovery efforts.

If you have verifiable information concerning the listed wallet addresses or related transactions, please contact us through:

contact@glyph-research.org, or reach us via our Discord or X (Twitter).

Please include supporting evidence where possible and do not publish sensitive personal information.

Methodology and limitations

The on-chain analysis covered July 7 through July 30, 2026, using direct Bittensor Finney mainnet RPC queries.

Transactions were verified through decoded event logs, balance changes, and before-and-after stake queries. Downstream transfers were traced through every outgoing transaction from each relay wallet rather than relying only on the wallet sequence initially known to the team.

The analysis was taken at Bittensor block 8,779,480, corresponding to August 5, 2026 at approximately 17:20 UTC.

The blockchain evidence establishes transaction times, asset amounts, wallet addresses, stake activity, and the movement of funds. It does not independently establish the real-world identity of every wallet operator.

The Binance and MEXC labels in this report come from information available to the Glyph team. Neither final wallet has a registered Bittensor on-chain identity. Formal confirmation of exchange ownership and the associated customer accounts must come from the exchanges, an appropriate address-attribution provider, or the relevant authorities.

Read the complete on-chain analysis, with every transfer, block, and address →

Commitment to transparency

Transparency requires more than acknowledging that an incident occurred. It requires a clear account of what happened, responsibility for our own decisions, support for affected participants, and evidence of corrective action.

We will provide further updates when doing so will not compromise recovery or investigative efforts. Future updates may include:

• A confirmed loss calculation and valuation methodology;
• The status of reports submitted to exchanges and authorities;
• Information concerning any frozen or recovered assets;
• The verified impact on team and community participants; and
• Our progress in addressing that impact.

We are deeply sorry to everyone affected and to the broader community whose trust has been shaken by this incident.

We recognize the seriousness of our failure and are committed to responding openly, responsibly, and with urgency.

The Glyph team is going through a very difficult period, but our commitment remains unchanged:

We will keep building Glyph.

— The Glyph Team