with solana_swaps AS ( SELECT SWAP_PROGRAM, BLOCK_TIMESTAMP, BLOCK_ID, TX_ID, SUCCEEDED, SWAPPER, SWAP_FROM_AMOUNT, SWAP_FROM_MINT, a.address_name as from_asset, SWAP_TO_AMOUNT, SWAP_TO_MINT, b.address_name as to_asset, SWAP_TO_AMOUNT / SWAP_FROM_AMOUNT as ratio FROM solana.core.fact_swaps LEFT JOIN solana.core.dim_labels a ON SWAP_FROM_MINT = a.address LEFT JOIN solana.core.dim_labels b ON SWAP_TO_MINT = b.address WHERE SUCCEEDED = 'TRUE' AND block_timestamp > '2022-01-01' ), stables AS ( SELECT address, label, address_name FROM solana.core.dim_labels WHERE label_subtype = 'token_contract' and address_name LIKE '%usd%' ), price as ( SELECT date(block_timestamp) as swap_date, swap_from_mint, -- token address nvl(from_asset, swap_from_mint) as token, sum(swap_from_amount) as sold, -- tokens sold sum(swap_to_amount) as stables, stables / sold as token_swap_price_avg_usd, median(ratio) as token_swap_price_median_usd FROM solana_swaps WHERE swap_to_mint IN ( SELECT address FROM stables ) --- use receiving as stables AND swap_to_amount > 10 -- filter out swaps with USD prices that are too low GROUP BY 1, 2, 3 ), to_hacker as ( select block_timestamp, tx_id, label, mint, amount, tx_to as hacker_addr, tx_from, TOKEN_SWAP_PRICE_AVG_USD from solana.core.fact_transfers t left join solana.core.dim_labels l on t.mint = l.address left join price p on t.mint = p.swap_from_mint and t.block_timestamp :: date = p.swap_date :: date where tx_to in ( 'Htp9MGP8Tig923ZFY7Qf2zzbMUmYneFRAhSp7vSg4wxV', 'CEzN7mqP9xoxn2HdyW6fjEJ73t7qaX9Rp2zyS6hb3iEu', '5WwBYgQG6BdErM2nNNyUmQXfcUnB68b6kesxBywh1J3n', 'GeEccGJ9BEzVbVor1njkBCCiqXJbXVeDHaXDCrBDbmuy' ) -- HACKER WALLETS and TOKEN_SWAP_PRICE_AVG_USD is not null ), usd_amounts as ( select tx_from as compromised_address, sum(TOKEN_SWAP_PRICE_AVG_USD * amount) as Compromised_USD from to_hacker group by tx_from ) select count(compromised_address) as compromised_addresses, case when Compromised_USD < 1 then '1.Loss < $1' when Compromised_USD < 10 then '2.Loss < $10' when Compromised_USD < 100 then '3.Loss < $100' when Compromised_USD < 1000 then '4.Loss < $1k' when Compromised_USD < 10000 then '5.Loss < $10k' else '6.Loss > $10k' end as type from usd_amounts group by type

Solana Exploited Incident Analysis