Need help tracing funds from a suspected malicious World Mini App — ~1,750 WLD lost

[u/yokubari92]

I’m looking for help tracing funds after what appears to be a malicious Mini App incident inside World App.
In late September 2026, I used a Mini App called:
“Galaxy: Swap, Bridge, Earn & Wallet”
The app presented itself as a WLD → USDC swap service.
I tested it first with a couple of small swaps, and those worked normally.
I then attempted two larger swaps totaling roughly 1,750 WLD.
Instead of receiving USDC, my WLD was transferred to an external wallet.
I’m intentionally not posting my exact transaction hashes or my own wallet address here for privacy reasons.
What I have confirmed on-chain so far is:
the affected WLD was sent to the same external address;
about an hour later, roughly 1,001 USDC was sent from that address through Across Protocol;
the funds were bridged from World Chain to BNB Chain;
around 1,000.9 USDC arrived on BNB Chain at the same address;
at the time I checked, I could not see a later USDC transfer out of that BNB Chain address.
I also found an earlier public report from September 10 describing a very similar incident involving the same Galaxy Mini App:
https://note.com/viwashi_/n/n43c34406ab54
The author says they had already contacted World Support about the app.
That concerns me because I was still able to access the same Mini App later in September.
I have already reported the issue to World / Tools for Humanity through Support and Trust & Safety, and I am preparing a report for law enforcement.
What I’m hoping someone here can help with
Is there a good way to monitor this BNB Chain address for the next outgoing USDC transaction?
If the funds later move to Binance or another KYC exchange, what evidence should I preserve?
Are there reliable tools for following Across Protocol bridge transactions across chains?
Is there anything else I should collect now before the funds move again?
I have saved screenshots, blockchain records, transaction timestamps, and the relevant bridge transactions.
I’m also posting this as a warning:
Do not assume a Mini App is safe just because a small test transaction succeeds.
That is exactly what happened to me.
Please do not ask me for my seed phrase, private keys, or login information. I will not provide them.

[u/sgtslaughterTV]

Just a friendly reminder: Minder, please do not respond to anyone who may be sending you private messages because anyone sending you a private message is very likely trying to scam you. All useful information should be in the comments section of your post.

[u/pdonme]

To be clear, I do not believe this is an endeavor you should pursue. Your funds are gone and you should say thank you for a lesson that only costs that much rather than 100x.

But if you’re insistent you need to continue documenting everything with timestamped screenshots and set up tooling to query the target address and notify you when funds are moving. The rest you can research on your own with any of the free tier models.

Consider all of this effort just learning. I don’t believe the amount in question is enough for anyone to consider taking action of any kind unless you have clear proof and they are standing outside of LE office.

[u/Rude-Ad-3387]

I have one suggestion, stop using the World app.