More than $1 million of cryptocurrency stolen in the July 25, 2026 Walix-Wallet hack appears to have moved through infrastructure potentially linked to Xhash.cash and NEAR Intents, based on blockchain analysis shared by Match Systems. The firm said the stolen assets crossed multiple blockchains, with transaction patterns resembling Xhash.cash flows for converting various tokens into Monero, a privacy-focused cryptocurrency. Match Systems identified three Solana addresses in that route and said some funds were later sent to centralized exchanges that support Monero trading pairs. The company said its work with law enforcement led to those addresses being labeled on blockchain analytics platforms and added to blocklists used by NEAR Intents, after which some related transactions were reportedly blocked or suspended. One transaction involving about 5 BTC has remained in "PROCESSING" status for more than three days, Match Systems said. The firm added that its investigation is continuing and stressed that its findings do not show that Xhash.cash or NEAR Intents knowingly participated in the theft or knowingly helped move stolen funds.