How the Bet Died

The rapper had placed the wager through crypto casino Stake at +245 odds, sharing the slip with his 140 million-plus Instagram followers ahead of the July 19 final. A win inside regulation or extra time would have returned roughly $5.175 million, a profit of about $3.67 million. Bitcoin.com News covered the wager before kickoff, noting Spain entered as the clear favorite on prediction markets.

The match delivered the same scenario, with the European giant dominating much of the duel despite not being able to break through Argentina goalkeeper Emiliano Martínez until the game turned in second-half stoppage time, when Argentina was reduced to ten men by a red card. Ferran Torres then scored the winner just 39 seconds into the second half of extra time, handing Spain a 1-0 victory and its second World Cup title.

Onchain Winners and Losers

The final settled enormous positions across crypto prediction markets and Polymarket’s World Cup winner contract alone drew $4.28 billion in volume (with Spain priced at 59 cents per share before the match, meaning traders collectively saw the outcome coming).

Blockchain analytics firm Lookonchain flagged the night’s sharpest contrast. A mysterious whale created a fresh wallet ten hours before the final and bet $1.95 million on Spain at 59.1% odds, walking away with a $1.35 million profit in just a few hours.

On the other side, a gambler known as gud.hl staked $1.23 million on Argentina when the odds were just 10%, chasing a potential $12.35 million payout.

The final capped off a tournament that completely transformed crypto betting venues, registering a $5.5 billion wagering frenzy heading into the final (with celebrities from Drake to Conor McGregor turning their predictions into public theater).

The Drake Curse Rolls on

For Drake, the loss extends one of the most documented losing streaks in celebrity gambling. The rapper has placed 87 tracked public bets since February 2022, wagering $38.72 million and collecting $37.17 million in returns, a net loss of $1.56 million at a 36.8% win rate, with an average stake of $445,080. Since April 30, 2024, his public bets have bled $5.7 million, including $1.67 million on soccer alone.

The pattern has spawned its own folklore, being referred to as the “Drake curse,” in which the teams he backs seem destined to lose. Argentina and Lionel Messi, who rated among the final’s poorest performers, became its latest victims.

The list spans staking infrastructure, a token wrapping contract, five exchange wallets, two layer two ( L2) bridges, and one address unlabeled on Etherscan but identified through Arkham Intelligence. Together, they show where concentrated ETH sits across the network, and why two of the top spots are not “holders” in the traditional sense.

Beacon Contract Tops the List, But It Is Not a Whale

As of this weekend, the Ethereum Beacon Deposit Contract holds 88,289,814 ETH, equal to 73.16% of the top 12 wallets combined. The contract does not belong to a person, fund, or company. Every validator staking ETH to secure the network through proof-of-stake (PoS) sends funds through this single address, which functions as protocol-level escrow rather than discretionary holdings.

Curiously, the Beacon Deposit Contract also holds $109,690 worth of the ERC-20 token PIKA, after 7.112 trillion of the coins found their way into the address. It also holds roughly $8,500 worth of USDT for reasons that remain unclear, alongside dozens of largely meaningless ERC-20 tokens.

The Wrapped Ether contract ranks second with 2,443,063 ETH, or 2.02% of the total. It works the same way. ETH gets locked as collateral so it can circulate as an ERC-20 token called WETH across decentralized exchange ( DEX) platforms and lending platforms. Neither the Beacon Contract nor Wrapped Ether represents an entity with control over how the funds move. Wrapped ether (WETH) is simply an ERC-20 representation of ether.

Binance Holds Three Spots on the List

Binance controls more separate addresses than any other exchange. The wallet dubbed “Binance 7” ranks third with 1,996,008 ETH and around 2,481 transactions, a pattern consistent with a wallet used for large, infrequent transfers rather than daily retail flow.

Another address labeled “Binance Hot Wallet 20” holds 739,595 ETH with 20,981 transactions, supporting active withdrawal liquidity. A third address known as “Binance-Peg Tokens” holds 454,999 ETH, collateral backing wrapped versions of ETH that Binance issues on other chains such as BNB Chain.

Combined, Binance’s three wallets hold 3,190,602 ETH, worth roughly $5.9 billion at $1,860 per coin. That makes Binance the single largest exchange holder among the top 12 wallets by a wide margin.

Robinhood, Upbit, Bitfinex and Gemini Round Out Exchange Custody

Robinhood holds ETH across two separate wallets. Its main operational address ranks fourth with 1,220,494 ETH. A second wallet, unlabeled on Etherscan but identified by Arkham as Robinhood’s cold storage, ranks 12th with 368,050 ETH. Combined, the two addresses hold 1,588,545 ETH, worth about $2.9 billion.

Upbit, South Korea’s largest exchange by volume, holds 1,046,015 ETH in a wallet tagged as “Upbit 41.” That address logged 54,671 transactions, the highest transaction count of any exchange wallet among the top 12, pointing to heavy retail deposit and withdrawal activity from its user base.

Bitfinex holds 450,118 ETH in the address known as “Bitfinex 19.” It is worth noting that the aforementioned exchanges listed among Ethereum’s largest holders also rank among bitcoin’s largest holders. In 11th place, Gemini keeps 385,262 ETH in a cold wallet that recorded just 945 transactions, a low figure typical of offline storage that moves infrequently for security reasons.

L2 Bridges Lock Over 1.6 Million ETH

Presently, two Ethereum scaling networks also made the top 12. Arbitrum Bridge holds 819,716 ether, backing ETH that circulates on the Arbitrum network. Base Portal, operated for the Coinbase-incubated L2 network, holds 807,076 ETH and logged 1,140,867 transactions, the second-highest transaction count on the entire list behind only the WETH contract.

The size of these bridge balances tracks growing activity on both networks, as traders and applications continue moving funds off Ethereum’s base layer in search of lower fees and faster settlement.

What the Concentration Means for Traders

Setting aside the Beacon Contract and Wrapped Ether as network infrastructure, the remaining 10 wallets hold 8,287,337.60 ETH combined. Of that, exchange-controlled wallets alone account for 6,660,544 ETH, or roughly 5.52% of a 120,682,850 ETH reference supply.

For traders who track exchange reserves as a signal of selling or accumulation pressure, the data shows custody split across multiple addresses per exchange rather than concentrated in one. Binance and Robinhood both operate separate hot and cold wallets, meaning analysts need visibility into all of an exchange’s tagged addresses, not just the most active one, to draw accurate conclusions about reserve trends.

The bridge wallets add a separate signal. Rising balances at Arbitrum and Base point to sustained L2 activity, a trend that has shaped trading volume and gas costs across the Ethereum ecosystem.

Global cybersecurity firm Kaspersky has identified a malware framework called OkoBot that targets crypto users by stealing wallet seed phrases, credentials and other sensitive data through a collection of more than 20 malicious components.

The campaign, first identified in January 2026, has compromised hundreds of victims across more than 25 countries, with Brazil, Vietnam, Canada, Mexico and Türkiye among the most affected.

During the investigation, researchers found that attackers distribute the malware through ClickFix social engineering schemes and fake software downloads hosted on GitHub, allowing the framework to infect devices and deploy additional malware, including the Rilide browser stealer.

The framework consists of more than 20 payloads capable of stealing crypto wallets, harvesting credentials, recording video, downloading malicious browser extensions and executing remote commands.

Among OkoBot’s components are TookPS, which exfiltrates wallet seed phrases, OkoSpyware, which monitors Chromium-based browsers and records user activity, and SeedHunter, which injects malicious code into Trezor and Ledger wallet software to display phishing pages requesting recovery phrases.

Kaspersky said the campaign is still active and while its operators have not been identified, its techniques and code artifacts suggest links to Russian-speaking cybercriminals.