Pinned Tweet
New Product: AI Tracer is Live 🔍
A self-serve crypto investigation tool, built for everyone. Paste a TxID and AI traces where the funds went — every wallet, bridge, and exchange along the path, across 14 chains. A visual map in minutes. No analyst skills needed.
First Trace wcxk72z
A self-serve crypto investigation tool, built for everyone. Paste a TxID and AI traces where the funds went — every wallet, bridge, and exchange along the path, across 14 chains. A visual map in minutes. No analyst skills needed.
First Trace wcxk72z
5
3
23
4,566
3/ The report breaks this down by target, network and attack type. Download the full report:
blog.amlbot.com/crypto-crime-i…
blog.amlbot.com/crypto-crime-i…
0
0
0
49
Update: @tether has frozen ~$2.2M linked to the @CoinDCX exploit
Both parked addresses from our last post moved one hop before the freeze: TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V ($720K) → TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG ($401K) + TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs ($319K) C2YExGDQYD5 ($665K) → TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a ($665K)
All three are now frozen. ~$800K more is frozen across 5 other addresses
Both parked addresses from our last post moved one hop before the freeze: TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V ($720K) → TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG ($401K) + TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs ($319K) C2YExGDQYD5 ($665K) → TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a ($665K)
All three are now frozen. ~$800K more is frozen across 5 other addresses
Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large entified services
~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet
We are actively monitoring this case
1
1
6
1,077
Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large entified services
~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet
We are actively monitoring this case
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large entified services
~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet
We are actively monitoring this case
4
2
21
3,983
AMLBot Plan Update ⚡️
We've made our plans better for you: there are now two, with more features, and each one is built around what you need.
🔹 Personal (formerly Lite) is for checking wallets yourself. Same risk assessment as Business, plus a detailed breakdown of each address you check.
🔹 Business (formerly PRO+) is for VASPs and crypto companies. Our most powerful plan, now with Travel Rule.
See what's in each plan: blog.amlbot.com/amlbot-plans-e…
We've made our plans better for you: there are now two, with more features, and each one is built around what you need.
🔹 Personal (formerly Lite) is for checking wallets yourself. Same risk assessment as Business, plus a detailed breakdown of each address you check.
🔹 Business (formerly PRO+) is for VASPs and crypto companies. Our most powerful plan, now with Travel Rule.
See what's in each plan: blog.amlbot.com/amlbot-plans-e…
0
0
1
273
1/ Many crypto crime reports focus on publicly known incidents. AMLBot's 2026 report draws on 250+ investigations, including cases reported directly by victims to its team.
Private data that's not shown in public cases reveals that claimed losses rose 41% from Q1 to Q3, while 9%.
Private data that's not shown in public cases reveals that claimed losses rose 41% from Q1 to Q3, while 9%.
1
0
0
363
3/ It’s a victim-side view of crypto crime, built from investigations as well as public cases.
Download the full report:
blog.amlbot.com/crypto-crime-i…
Download the full report:
blog.amlbot.com/crypto-crime-i…
0
0
0
53
Ethereum (36%) and TRON (33%), the two main networks for USDT transfers, dominate case counts. Ethereum cases carried the largest total: $135.3M.
Bitcoin cases are fewer but bigger: involved in 20% of cases, with the highest median loss of the four most-involved networks, $364K.
Bitcoin cases are fewer but bigger: involved in 20% of cases, with the highest median loss of the four most-involved networks, $364K.
1
0
0
49
BiFi @BiFi_lending USDT lending market on Ethereum was drained of ~$165.6K
A white-hat MEV bot (c0ffeebabe.eth) front-ran the original attacker in the next block and captured the proceeds
The funds did not stay with the MEV bot. On Oct 18 at 17:21 UTC, c0ffeebabe.eth returned i USDT market contract, completing a white-hat recovery in tx 0x9702900bc441039c7e6937a3f3e94251072bda380bdcba38ecf6c7c3e6efeaeb. The original attacker never executed and got nothing
A white-hat MEV bot (c0ffeebabe.eth) front-ran the original attacker in the next block and captured the proceeds
The funds did not stay with the MEV bot. On Oct 18 at 17:21 UTC, c0ffeebabe.eth returned i USDT market contract, completing a white-hat recovery in tx 0x9702900bc441039c7e6937a3f3e94251072bda380bdcba38ecf6c7c3e6efeaeb. The original attacker never executed and got nothing
🚨 Defimon detected an exploit on @BiFi_lending which lost $165.4K on Ethereum
BiFi's USDT market had been idle for about 264K blocks (~36 days). TokenHandler._checkFirstAction stores that gap as inactiveActionDelta and freezes actionEXR once per block. After that, every action ns interestModel.getInterestAmount, which computes globalEXR = actionEXR × (1 + rate × 264K). The rate comes from live deposit/borrow totals, so the attacker sets the utilization and the 36-day interest is charged at that rate on every call.
The original attacker first deployed an exploit contract. One block later, c0ffeebabe.eth front-ran it, replaying the attack from its own contract. That attack flash-loaned 40.5M USDT from Morpho, deposited it in growing tranches, then borrowed 30M to push utilization up. A repay/withdraw loop then cashed out the inflated deposit interest. Running the cycle twice drained 165.6K USDT, swapped to WETH.
Initial attacker: etherscan.io/address/0x7c78…
Exploit deployment (block 26210255): etherscan.io/tx/0x15b47e2c0…
Front-run TX (block 26210256): etherscan.io/tx/0x756c68055…
MEV-bot: etherscan.io/address/0xc0ff…
Victim: etherscan.io/address/0x808c…
Real-time alerts: defimon.xyz
12
4
46
2,554
At least $755K taken from @rrealist in a UK wrench attack
Tracing shows ~719K USDC was deposited to @hitbtc within hours. The SOL was swapped to ~14.7 ETH via @near_intents and is now sitting untouched at 0xeec36e6b1dad28331e457d1abf532265d6ee700f
We are actively monitoring this case
Tracing shows ~719K USDC was deposited to @hitbtc within hours. The SOL was swapped to ~14.7 ETH via @near_intents and is now sitting untouched at 0xeec36e6b1dad28331e457d1abf532265d6ee700f
We are actively monitoring this case
if you live in the uk and do crypto get the fuck out
just got my house invaded, taped up held at knife point & robbed for $800k
in so much shock i dont know what the fuck to do, fuck this country. No this is not satire, i fucking wish it was.
wallet with stolen funds
solscan.io/account/B3pMs3…
0
1
11
1,609
AMLBot retweeted
Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
20
9
44
5,559
Update on the @Ledger drained devices incident, linked to devices reportedly sold through reseller @cryptobilis. Our tracing puts total losses at over $80M
Roughly two-thirds of the stolen value is still on-chain: ~20.2K ETH is lying dormant across 14 ETH addresses and 92.5 BTC has since frozen ~11% of the total in USDT on TRON
Most of the remaining TRON USDT was bridged and swapped into ETH via @USDT0_to, @THORChain, @RelayProtocol, @Chainflip, @BitgetWallet, HiFiSwap and @near_intents. Around one fifth of the stolen funds has since been deposited into Tornado Cash and laundering is ongoing
We are actively monitoring this case
Roughly two-thirds of the stolen value is still on-chain: ~20.2K ETH is lying dormant across 14 ETH addresses and 92.5 BTC has since frozen ~11% of the total in USDT on TRON
Most of the remaining TRON USDT was bridged and swapped into ETH via @USDT0_to, @THORChain, @RelayProtocol, @Chainflip, @BitgetWallet, HiFiSwap and @near_intents. Around one fifth of the stolen funds has since been deposited into Tornado Cash and laundering is ongoing
We are actively monitoring this case
Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
19
4
50
5,783
Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
20
9
44
5,559