Update: @tether has frozen ~$2.2M linked to the @CoinDCX exploit
Both parked addresses from our last post moved one hop before the freeze: TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V ($720K) → TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG ($401K) + TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs ($319K) C2YExGDQYD5 ($665K) → TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a ($665K)
All three are now frozen. ~$800K more is frozen across 5 other addresses
Both parked addresses from our last post moved one hop before the freeze: TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V ($720K) → TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG ($401K) + TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs ($319K) C2YExGDQYD5 ($665K) → TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a ($665K)
All three are now frozen. ~$800K more is frozen across 5 other addresses
Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large entified services
~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet
We are actively monitoring this case
1
1
6
Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large entified services
~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet
We are actively monitoring this case
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT
Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large entified services
~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet
We are actively monitoring this case
4
2
21
1/ Many crypto crime reports focus on publicly known incidents. AMLBot's 2026 report draws on 250+ investigations, including cases reported directly by victims to its team.
Private data that's not shown in public cases reveals that claimed losses rose 41% from Q1 to Q3, while 9%.
Private data that's not shown in public cases reveals that claimed losses rose 41% from Q1 to Q3, while 9%.
1
0
0
Ethereum (36%) and TRON (33%), the two main networks for USDT transfers, dominate case counts. Ethereum cases carried the largest total: $135.3M.
Bitcoin cases are fewer but bigger: involved in 20% of cases, with the highest median loss of the four most-involved networks, $364K.
Bitcoin cases are fewer but bigger: involved in 20% of cases, with the highest median loss of the four most-involved networks, $364K.
1
0
0
Reported losses climbed every quarter: $62.9M in Q1, $75.9M in Q2 and $88.7M in Q3, up 41% in two quarters.
The typical case moved the other way. The median loss rose from $200K in Q1 to $223K in Q2, then fell 49% to $113K in Q3.
The pattern points to a handful of very large day losses.
The typical case moved the other way. The median loss rose from $200K in Q1 to $223K in Q2, then fell 49% to $113K in Q3.
The pattern points to a handful of very large day losses.
1
0
0
Europe remains the center of gravity: 40% of cases from January to September and 35% of reported losses.
Losses tell a different story. Asia was 10% of cases but 30% of losses, and the Middle East 9% of cases but 20% of losses. Four cases above $15M each were recorded in the urope.
These shares show where incidents were recorded, not where offenders operate.
Losses tell a different story. Asia was 10% of cases but 30% of losses, and the Middle East 9% of cases but 20% of losses. Four cases above $15M each were recorded in the urope.
These shares show where incidents were recorded, not where offenders operate.
2
0
0
Individual users were the target in 77% of cases and carried 51.6% of reported losses.
Exchanges were only 7% of cases but nearly a fifth of reported losses (18.8%). For them, the threat is hacks: 81% of exchange cases were hacks and exploits.
Hacks are not only an though. Individual users were the target in 40% of them.
Exchanges were only 7% of cases but nearly a fifth of reported losses (18.8%). For them, the threat is hacks: 81% of exchange cases were hacks and exploits.
Hacks are not only an though. Individual users were the target in 40% of them.
2
0
0
BiFi @BiFi_lending USDT lending market on Ethereum was drained of ~$165.6K
A white-hat MEV bot (c0ffeebabe.eth) front-ran the original attacker in the next block and captured the proceeds
The funds did not stay with the MEV bot. On Oct 18 at 17:21 UTC, c0ffeebabe.eth returned i USDT market contract, completing a white-hat recovery in tx 0x9702900bc441039c7e6937a3f3e94251072bda380bdcba38ecf6c7c3e6efeaeb. The original attacker never executed and got nothing
A white-hat MEV bot (c0ffeebabe.eth) front-ran the original attacker in the next block and captured the proceeds
The funds did not stay with the MEV bot. On Oct 18 at 17:21 UTC, c0ffeebabe.eth returned i USDT market contract, completing a white-hat recovery in tx 0x9702900bc441039c7e6937a3f3e94251072bda380bdcba38ecf6c7c3e6efeaeb. The original attacker never executed and got nothing
🚨 Defimon detected an exploit on @bifi_lending which lost $165.4K on Ethereum
BiFi's USDT market had been idle for about 264K blocks (~36 days). TokenHandler._checkFirstAction stores that gap as inactiveActionDelta and freezes actionEXR once per block. After that, every action ns interestModel.getInterestAmount, which computes globalEXR = actionEXR × (1 + rate × 264K). The rate comes from live deposit/borrow totals, so the attacker sets the utilization and the 36-day interest is charged at that rate on every call.
The original attacker first deployed an exploit contract. One block later, c0ffeebabe.eth front-ran it, replaying the attack from its own contract. That attack flash-loaned 40.5M USDT from Morpho, deposited it in growing tranches, then borrowed 30M to push utilization up. A repay/withdraw loop then cashed out the inflated deposit interest. Running the cycle twice drained 165.6K USDT, swapped to WETH.
Initial attacker: etherscan.io/address/0x7c78…
Exploit deployment (block 26210255): etherscan.io/tx/0x15b47e2c0…
Front-run TX (block 26210256): etherscan.io/tx/0x756c68055…
MEV-bot: etherscan.io/address/0xc0ff…
Victim: etherscan.io/address/0x808c…
Real-time alerts: defimon.xyz
12
4
46
@Bybit_Official adopts AMLBot Tracer as an independent verification layer in its on-chain investigations.
In blockchain forensics, no single tool is the source of truth, so Bybit’s investigators cross-check findings before acting on them.
Full Story: blog.amlbot.com/bybit-adopts-a…
In blockchain forensics, no single tool is the source of truth, so Bybit’s investigators cross-check findings before acting on them.
Full Story: blog.amlbot.com/bybit-adopts-a…
0
0
6
At least $755K taken from @rrealist in a UK wrench attack
Tracing shows ~719K USDC was deposited to @hitbtc within hours. The SOL was swapped to ~14.7 ETH via @near_intents and is now sitting untouched at 0xeec36e6b1dad28331e457d1abf532265d6ee700f
We are actively monitoring this case
Tracing shows ~719K USDC was deposited to @hitbtc within hours. The SOL was swapped to ~14.7 ETH via @near_intents and is now sitting untouched at 0xeec36e6b1dad28331e457d1abf532265d6ee700f
We are actively monitoring this case
if you live in the uk and do crypto get the fuck out
just got my house invaded, taped up held at knife point & robbed for $800k
in so much shock i dont know what the fuck to do, fuck this country. No this is not satire, i fucking wish it was.
wallet with stolen funds
solscan.io/account/B3pMs3…
0
1
11
Update on the @Ledger drained devices incident, linked to devices reportedly sold through reseller @cryptobilis. Our tracing puts total losses at over $80M
Roughly two-thirds of the stolen value is still on-chain: ~20.2K ETH is lying dormant across 14 ETH addresses and 92.5 BTC has since frozen ~11% of the total in USDT on TRON
Most of the remaining TRON USDT was bridged and swapped into ETH via @USDT0_to, @THORChain, @RelayProtocol, @Chainflip, @BitgetWallet, HiFiSwap and @near_intents. Around one fifth of the stolen funds has since been deposited into Tornado Cash and laundering is ongoing
We are actively monitoring this case
Roughly two-thirds of the stolen value is still on-chain: ~20.2K ETH is lying dormant across 14 ETH addresses and 92.5 BTC has since frozen ~11% of the total in USDT on TRON
Most of the remaining TRON USDT was bridged and swapped into ETH via @USDT0_to, @THORChain, @RelayProtocol, @Chainflip, @BitgetWallet, HiFiSwap and @near_intents. Around one fifth of the stolen funds has since been deposited into Tornado Cash and laundering is ongoing
We are actively monitoring this case
Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
19
4
50
Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
20
9
44
The reported @frogmanhaha drain netted the attacker roughly $2.4M after the stolen assets were sold
Tracing shows ~13,241 SOL, currently worth ~$1.54M, entered @theprivacycash. Another ~$815K deposited to Hyperliquid and was converted into XMR through @PerpetualCow XMR1
A SOL (~$18.6K) reached a @kucoincom deposit address, while ~80 SOL (~$9.3K) was commingled by an unidentified service.
We are actively monitoring this case
Tracing shows ~13,241 SOL, currently worth ~$1.54M, entered @theprivacycash. Another ~$815K deposited to Hyperliquid and was converted into XMR through @PerpetualCow XMR1
A SOL (~$18.6K) reached a @kucoincom deposit address, while ~80 SOL (~$9.3K) was commingled by an unidentified service.
We are actively monitoring this case
Was drained for $4m+ USD this morning at 4:30am while I was asleep
Not sure how it happened yet, but I'm in Singapore and met a lot of new people
Thank you to the teams and individuals who are helping with the investigation. Will share more when I can
16
11
77
Impressive work by @zachxbt ! Interestingly enough, it looks like Chinese launderers couldn't care less where the funds are coming from... 349.7K USDC came straight from zachxbt.eth on Base via @debridge
4/ On Mar 6, 2025, I funded a new address with 349.7K USDC on Ethereum in preparation to conduct several transactions with Jimmy Green.
My address:
0x073256b50d66a7eb005f2a504d0a4fb6ea62a276
11
8
129
The @bitget hacker seems to have fumbled ~$700K while laundering the stolen funds😂
Our tracing shows the attacker sent funds to @Chainflip deposit channels on the wrong chains:
~267K USDC was swapped via CoW Swap and paid on Ethereum to a channel that only exists on Arbitrum. en blacklisted by @circle
~160 ETH (~$430K) was bridged to Arbitrum and sent to a channel that only exists on Ethereum. No contract on Arbitrum can sweep it, so the funds are stuck
Both deposits were likely automated, with only seconds between hops. It appears their laundering script mixed up Ethereum and Arbitrum, twice
Our tracing shows the attacker sent funds to @Chainflip deposit channels on the wrong chains:
~267K USDC was swapped via CoW Swap and paid on Ethereum to a channel that only exists on Arbitrum. en blacklisted by @circle
~160 ETH (~$430K) was bridged to Arbitrum and sent to a channel that only exists on Ethereum. No contract on Arbitrum can sweep it, so the funds are stuck
Both deposits were likely automated, with only seconds between hops. It appears their laundering script mixed up Ethereum and Arbitrum, twice
Bitget exploiters are laundering through @THORChain affiliates they appear to control themselves
Our tracing shows 3 affiliates were used only by @bitget attacker wallets: ~3.7K swaps worth ~$58.7M, mostly XRP/ETH to BTC. No swaps from any other users at all
The affiliates $245K) in fees. One cashed out ~132K USDT and ~0.56 BTC, all of which ended up at @okx. Another swapped its fees straight back into an attacker wallet
One affiliate is still holding ~72K RUNE (~$54K), unmoved
thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4
thor1rj9f7m7n72nwslau7jzla09u0l4zr4ru8277d2
thor199tl2t4fkxqn7pawk8dgera79dl70rnczu6jsl
17
6
63
🚨 Suspicious activity involving @near_intents: ~$4M in withdrawals
Our monitoring has flagged a series of suspicious withdrawals totaling approximately $4M
At this stage, it is not clear whether this is an exploit of the protocol or whether the funds may be connected to cious txs:
0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a
Our tracing indicates that funds are currently moving toward @kucoincom, with some funds bridged to BTC
We are actively monitoring the situation and will share updates as they become available, pending official confirmation of security incident from NEAR Intents
Our monitoring has flagged a series of suspicious withdrawals totaling approximately $4M
At this stage, it is not clear whether this is an exploit of the protocol or whether the funds may be connected to cious txs:
0x9fe58e031f73bbd880c782bc9e7446bcda32cadb304a729209871a4a81856c4c
0x0381265d6a1bb09de899f49f410a8b907cd548358a7e3c91076c3a52656b8220
0x69d1c68c7e961a0199d3c9f3b6a31cb168ed775ef34b51a42762253ac1efcceb
0x9c10b967da0c85631ec105e3b322c0a851fcd01b69ff390ff58f860e5cce003a
Our tracing indicates that funds are currently moving toward @kucoincom, with some funds bridged to BTC
We are actively monitoring the situation and will share updates as they become available, pending official confirmation of security incident from NEAR Intents
4
4
41
Bitget exploiters are laundering through @THORChain affiliates they appear to control themselves
Our tracing shows 3 affiliates were used only by @bitget attacker wallets: ~3.7K swaps worth ~$58.7M, mostly XRP/ETH to BTC. No swaps from any other users at all
The affiliates $245K) in fees. One cashed out ~132K USDT and ~0.56 BTC, all of which ended up at @okx. Another swapped its fees straight back into an attacker wallet
One affiliate is still holding ~72K RUNE (~$54K), unmoved
thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4
thor1rj9f7m7n72nwslau7jzla09u0l4zr4ru8277d2
thor199tl2t4fkxqn7pawk8dgera79dl70rnczu6jsl
Our tracing shows 3 affiliates were used only by @bitget attacker wallets: ~3.7K swaps worth ~$58.7M, mostly XRP/ETH to BTC. No swaps from any other users at all
The affiliates $245K) in fees. One cashed out ~132K USDT and ~0.56 BTC, all of which ended up at @okx. Another swapped its fees straight back into an attacker wallet
One affiliate is still holding ~72K RUNE (~$54K), unmoved
thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4
thor1rj9f7m7n72nwslau7jzla09u0l4zr4ru8277d2
thor199tl2t4fkxqn7pawk8dgera79dl70rnczu6jsl
Update: It seems stolen funds from the @bitget hack have started to be laundered through Wasabi CoinJoin (mixer)
Our tracing links ~4 BTC in a CoinJoin round back to a Bitget TRON wallet. The funds were swapped from TRX to USDT, bridged to Ethereum via @USDT0_to, swapped to ~145 @THORChain to ~4.59 BTC. The BTC was then split and prepared before entering the CoinJoin
We have blacklisted the related addresses and are monitoring the attacker's BTC for further CoinJoin activity
19
4
37
A fake chain impersonating @GIWA_by_Upbit was listed with a bridge/RPC and drained ~768 ETH ($2.07M) in ~13 hours
Our analysis shows around 1,350 unique wallets were affected. The operator deployed a real-looking bridge using the OP Stack, but kept admin control of it. Once swapped the bridge code, took all ETH, then switched it back, all in a single transaction
~407 ETH has since been deposited to Tornado Cash. ~358 ETH is lying dormant across three addresses holding 221, 107 and 30 ETH. We are monitoring the related wallets
Interestingly the contract deployer has gas funding from @Changehero_io
Only bridge via official links. Stay vigilant!
Our analysis shows around 1,350 unique wallets were affected. The operator deployed a real-looking bridge using the OP Stack, but kept admin control of it. Once swapped the bridge code, took all ETH, then switched it back, all in a single transaction
~407 ETH has since been deposited to Tornado Cash. ~358 ETH is lying dormant across three addresses holding 221, 107 and 30 ETH. We are monitoring the related wallets
Interestingly the contract deployer has gas funding from @Changehero_io
Only bridge via official links. Stay vigilant!
2
2
16
Update: It seems stolen funds from the @bitget hack have started to be laundered through Wasabi CoinJoin (mixer)
Our tracing links ~4 BTC in a CoinJoin round back to a Bitget TRON wallet. The funds were swapped from TRX to USDT, bridged to Ethereum via @USDT0_to, swapped to ~145 @THORChain to ~4.59 BTC. The BTC was then split and prepared before entering the CoinJoin
We have blacklisted the related addresses and are monitoring the attacker's BTC for further CoinJoin activity
Our tracing links ~4 BTC in a CoinJoin round back to a Bitget TRON wallet. The funds were swapped from TRX to USDT, bridged to Ethereum via @USDT0_to, swapped to ~145 @THORChain to ~4.59 BTC. The BTC was then split and prepared before entering the CoinJoin
We have blacklisted the related addresses and are monitoring the attacker's BTC for further CoinJoin activity
~$343M (~88%) of the ~$389M stolen from @bitget has not moved
Our tracing shows 13 attacker wallets are lying dormant: ~68.3K ETH across 8 wallets on ETH Mainnet, ~83M XRP across 4 wallets and ~18.9K ZEC in 1. None of them has sent a single transaction since being funded
The hrough one active XRP wallet and the smaller branches. ~5.2M XRP has been peeled off so far, and the TRON, BNB and stablecoin proceeds are being swapped into BTC via @THORChain, @Bridgersxyz and @near_intents
Our team have blacklisted the related addresses and are actively monitoring them
4
12
74
Update: Tracing shows the exploiter behind @payy_link has moved almost all the funds to Tornado Cash
The second batch of ~$90.2K in USDC remains parked in the attacker’s wallet, with no action from @circle in the past two days
The second batch of ~$90.2K in USDC remains parked in the attacker’s wallet, with no action from @circle in the past two days
It seems like @payy_link was exploited for ~$1.9M in USDC
Our tracing shows the proceeds were swapped into ~683 ETH and split across four fresh wallets (~200 / ~280 / ~200 / 1 ETH). Those wallets have not moved since
A second batch of ~90.2k USDC is still parked in the . It remains there and was not blacklisted by @circle at our last check
Worth noting: the attack wallet's gas was seeded through Railgun two days before the drain
We are actively monitoring this case and will post updates if funds move
0
0
9
~$343M (~88%) of the ~$389M stolen from @bitget has not moved
Our tracing shows 13 attacker wallets are lying dormant: ~68.3K ETH across 8 wallets on ETH Mainnet, ~83M XRP across 4 wallets and ~18.9K ZEC in 1. None of them has sent a single transaction since being funded
The hrough one active XRP wallet and the smaller branches. ~5.2M XRP has been peeled off so far, and the TRON, BNB and stablecoin proceeds are being swapped into BTC via @THORChain, @Bridgersxyz and @near_intents
Our team have blacklisted the related addresses and are actively monitoring them
Our tracing shows 13 attacker wallets are lying dormant: ~68.3K ETH across 8 wallets on ETH Mainnet, ~83M XRP across 4 wallets and ~18.9K ZEC in 1. None of them has sent a single transaction since being funded
The hrough one active XRP wallet and the smaller branches. ~5.2M XRP has been peeled off so far, and the TRON, BNB and stablecoin proceeds are being swapped into BTC via @THORChain, @Bridgersxyz and @near_intents
Our team have blacklisted the related addresses and are actively monitoring them
0
3
24
Our CEO @demchukvm spoke with @incrypted about how AMLBot grew from a wallet checker into full AML infrastructure, what small compliance teams struggle with most, and where AI helps investigators and where it doesn't.
Read the full interview ⬇️
Read the full interview ⬇️
1
0
3
It seems like @payy_link was exploited for ~$1.9M in USDC
Our tracing shows the proceeds were swapped into ~683 ETH and split across four fresh wallets (~200 / ~280 / ~200 / 1 ETH). Those wallets have not moved since
A second batch of ~90.2k USDC is still parked in the . It remains there and was not blacklisted by @circle at our last check
Worth noting: the attack wallet's gas was seeded through Railgun two days before the drain
We are actively monitoring this case and will post updates if funds move
Our tracing shows the proceeds were swapped into ~683 ETH and split across four fresh wallets (~200 / ~280 / ~200 / 1 ETH). Those wallets have not moved since
A second batch of ~90.2k USDC is still parked in the . It remains there and was not blacklisted by @circle at our last check
Worth noting: the attack wallet's gas was seeded through Railgun two days before the drain
We are actively monitoring this case and will post updates if funds move
0
3
19
Seems like the @Fetch_ai / @ASI_Alliance exploiter has started laundering the stolen funds
100 ETH was swapped to ~266K USDC, bridged via Circle CCTP to Arbitrum and deposited into Hyperliquid, then converted into "FXMR" which is likely a Monero variant
The other 100 ETH was re the broker rejected the deposit. The attacker was refunded and pivoted to @THORChain, swapped into ~3.28 BTC and began peeling it through a chain of Bitcoin addresses
The remaining ~433 ETH are still parked at the main address 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE
100 ETH was swapped to ~266K USDC, bridged via Circle CCTP to Arbitrum and deposited into Hyperliquid, then converted into "FXMR" which is likely a Monero variant
The other 100 ETH was re the broker rejected the deposit. The attacker was refunded and pivoted to @THORChain, swapped into ~3.28 BTC and began peeling it through a chain of Bitcoin addresses
The remaining ~433 ETH are still parked at the main address 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE
Multiple tokens in the @ASI_Alliance ecosystem were hit in an exploit on Ethereum - ethereum:0xaea46a60368a7bd060eec7df8cba43b7ef41ad85 drained and ethereum:0xf0d33beda4d734c72684b5f9abbebf715d0a7935 , $WMTX, ethereum:0x5b7533812759b45c2b44c19e320ba2cd2681b542 & $CGV minted
Trafunds were swapped into ETH and stablecoins. The main wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE holds ~$1.75M (632.9 ETH + 52.4K mUSD + 15.9 WETH). A second wallet 0x83F4424A401a9Bb75F90314f21ADAeA6a9cE09C5 holds ~$530K (92.4 ETH + 289.5K USDC)
Another 40M AGIX was parked in three dormant stash wallets that hold no gas
We are actively monitoring this case
0
2
26
@kimjh296759 Sorry for your loss. The funds are still sitting on the hacker's Solana address, and we've blacklisted the related addresses. Could you please DM us? We'd be glad to help trace them and work together on this case
0
0
4
Multiple tokens in the @ASI_Alliance ecosystem were hit in an exploit on Ethereum - ethereum:0xaea46a60368a7bd060eec7df8cba43b7ef41ad85 drained and ethereum:0xf0d33beda4d734c72684b5f9abbebf715d0a7935 , $WMTX, ethereum:0x5b7533812759b45c2b44c19e320ba2cd2681b542 & $CGV minted
Trafunds were swapped into ETH and stablecoins. The main wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE holds ~$1.75M (632.9 ETH + 52.4K mUSD + 15.9 WETH). A second wallet 0x83F4424A401a9Bb75F90314f21ADAeA6a9cE09C5 holds ~$530K (92.4 ETH + 289.5K USDC)
Another 40M AGIX was parked in three dormant stash wallets that hold no gas
We are actively monitoring this case
Trafunds were swapped into ETH and stablecoins. The main wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE holds ~$1.75M (632.9 ETH + 52.4K mUSD + 15.9 WETH). A second wallet 0x83F4424A401a9Bb75F90314f21ADAeA6a9cE09C5 holds ~$530K (92.4 ETH + 289.5K USDC)
Another 40M AGIX was parked in three dormant stash wallets that hold no gas
We are actively monitoring this case
0
0
2
Starknet's @nostrafinance was drained of ~$3.5M after an oracle price manipulation attack
Our tracing shows the funds were swapped and exited to Ethereum through Near Intents, CCTP and Layerzero OFT
~$1.6M is still parked at the Starknet address 7c322096cd508e9034c8048783a6b438fc1344bc3, with no bridge activity yet. Another ~$1.9M sits in this Ethereum EOA: 0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37
We are actively monitoring this case and will update if the funds move
Our tracing shows the funds were swapped and exited to Ethereum through Near Intents, CCTP and Layerzero OFT
~$1.6M is still parked at the Starknet address 7c322096cd508e9034c8048783a6b438fc1344bc3, with no bridge activity yet. Another ~$1.9M sits in this Ethereum EOA: 0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37
We are actively monitoring this case and will update if the funds move
1
2
29
Two Safes using Makina modules on Ethereum were drained on Sep 15
Safe #1 lost 2,900 rsETH ($7.7M). An MEV bot intercepted the extraction in-block - 2,882 rsETH is now dormant at 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, likely the Yoink MEV address. The attacker got nothing lost ~$125K in USDC and DUSD. Those funds were swapped to ETH, bridged to Hyperliquid and converted to XMR. The attacker profited around $58K
Attacker wallet was seeded from Railgun and used to deploy the malicious contracts
Safe #1 lost 2,900 rsETH ($7.7M). An MEV bot intercepted the extraction in-block - 2,882 rsETH is now dormant at 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, likely the Yoink MEV address. The attacker got nothing lost ~$125K in USDC and DUSD. Those funds were swapped to ETH, bridged to Hyperliquid and converted to XMR. The attacker profited around $58K
Attacker wallet was seeded from Railgun and used to deploy the malicious contracts
0
1
2
On September 11, @symbiosis_fi syBTC was exploited. ~184.47B syBTC was minted to the attacker on each of BNB, Ethereum and Rootstock
Tracing shows attacker dumped all the tokens and bridged to Ethereum. The funds are now consolidated at 0x7cd28D8E6210E6E4A8b1947FC9b44DC01C600192 attacker's gas was funded via @ChangeNOW
We are actively monitoring this case and will post updates if the funds move
Tracing shows attacker dumped all the tokens and bridged to Ethereum. The funds are now consolidated at 0x7cd28D8E6210E6E4A8b1947FC9b44DC01C600192 attacker's gas was funded via @ChangeNOW
We are actively monitoring this case and will post updates if the funds move
0
1
13
Liquid Network @Liquid_BTC was reportedly exploited for ~4,000 BTC, currently worth ~$315M
The purpoted whitehat might have returned 3,400 BTC (~$268M) to the official Liquid Federation wallet, while retaining ~600 BTC (~$47M) as a potential bounty
The return transaction is firmed
mempool.space/tx/a6d697a2526…
The purpoted whitehat might have returned 3,400 BTC (~$268M) to the official Liquid Federation wallet, while retaining ~600 BTC (~$47M) as a potential bounty
The return transaction is firmed
mempool.space/tx/a6d697a2526…
1
1
8
Project @cozyfinance was exploited for $160K on @Optimism
The attacker bridged all the stolen proceeds (USDC) to Ethereum, swapped them to ETH, and deposited them into Tornado Cash
Notably, the attacker's gas funding also came from Tornado Cash, withdrawn on 27 August, 11 days before the exploit
The attacker bridged all the stolen proceeds (USDC) to Ethereum, swapped them to ETH, and deposited them into Tornado Cash
Notably, the attacker's gas funding also came from Tornado Cash, withdrawn on 27 August, 11 days before the exploit
3
1
14
We are sorry for your loss. We ran onchain tracing and found that part of the stolen funds (~$44.14k) was bridged to Ethereum via Mayan and currently sits at this address: 0xab5efd305cfe734d6dfcf54022c06a162568077d (17.40 ETH)
The remainder was converted to $ZEC through @near_intents
e related addresses and will continue monitoring for any movement of funds
The remainder was converted to $ZEC through @near_intents
e related addresses and will continue monitoring for any movement of funds
2
1
77
@gomtu_xyz Sorry for your loss. We have blacklisted the attacker address, it's still holding ~48.3K DAI, untouched
1
0
1
Project @TectonicFi on @CronosNetwork was exploited for ~$75M
Tracing shows the attacker bridged ~$6.5M to Ethereum via @RelayProtocol before Cronos halted the chain, freezing the remaining ~$60M in place on Cronos
On Ethereum, the attacker now holds ~2,592 ETH and ~182K USDC resses. The USDC remains freezable by Circle
We are actively monitoring this case
Tracing shows the attacker bridged ~$6.5M to Ethereum via @RelayProtocol before Cronos halted the chain, freezing the remaining ~$60M in place on Cronos
On Ethereum, the attacker now holds ~2,592 ETH and ~182K USDC resses. The USDC remains freezable by Circle
We are actively monitoring this case
1
0
1
@shahzzannn @Ledger @X @ledgerstatus @tether We are sorry for your losses. We did some tracing and found out that the funds were bridged off Tron through @near_intents
3
1
14
@MoonwellDeFi Note: this is at least Moonwell's 5th incident since Dec 2024, with the latest (~$8.7M on Aug 27) the biggest yet
0
2
4
DeFi Protocol @MoonwellDeFi was exploited for ~$8.7M on Base
Tracing shows the borrowed assets were swapped to USDC on Base, bridged to Ethereum via Circle CCTP in two ~$4.36M transfers, then consolidated into DAI on Ethereum mainnet
All ~$8.7M in DAI now sits unmoved at a 0xd71dd9b6e634412713c47fe7ae02c628e338c384
We are monitoring the case and will update if funds move
Tracing shows the borrowed assets were swapped to USDC on Base, bridged to Ethereum via Circle CCTP in two ~$4.36M transfers, then consolidated into DAI on Ethereum mainnet
All ~$8.7M in DAI now sits unmoved at a 0xd71dd9b6e634412713c47fe7ae02c628e338c384
We are monitoring the case and will update if funds move
1
0
3
Term Finance (@term_labs) hacker appears to have deposited 300 ETH (~$741K) into Tornado Cash
The main address still holds around 2,543 ETH and 1.68M DAI (~$7.97M)
The main address still holds around 2,543 ETH and 1.68M DAI (~$7.97M)
Term Finance (@term_labs) was exploited for ~$8.5M on Ethereum
Both attacker wallets appear to have been seeded with ~1 ETH each from Tornado Cash beforehand. Tracing shows the proceeds - ~2,842 WETH was unwrapped to ETH and the ~$1.68M USDC swapped to DAI via DEX
Both branches ss:
└ 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 now holding ~2,843 ETH + ~1.68M DAI (~$8.5M)
Funds are lying dormant - no mixer, no CEX. We are monitoring for movement
0
2
13
The @Maya_Protocol hacker appears to have begun depositing funds into Tornado Cash but the main bitcoin proceeds remain untouched
Project @Maya_Protocol was exploited for ~$1.36M
The attacker moved the stolen funds off MAYAChain, which now sit at two wallets:
BTC - 20.83 BTC (~$1.34M)
└ bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646
ARB - 6.03 ARB.ETH + ~99 ARB.LINK (~$13K)
└ d9F251383881A5E423e
We are monitoring both addresses for onward movement
0
0
2
Term Finance (@term_labs) was exploited for ~$8.5M on Ethereum
Both attacker wallets appear to have been seeded with ~1 ETH each from Tornado Cash beforehand. Tracing shows the proceeds - ~2,842 WETH was unwrapped to ETH and the ~$1.68M USDC swapped to DAI via DEX
Both branches ss:
└ 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 now holding ~2,843 ETH + ~1.68M DAI (~$8.5M)
Funds are lying dormant - no mixer, no CEX. We are monitoring for movement
Both attacker wallets appear to have been seeded with ~1 ETH each from Tornado Cash beforehand. Tracing shows the proceeds - ~2,842 WETH was unwrapped to ETH and the ~$1.68M USDC swapped to DAI via DEX
Both branches ss:
└ 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 now holding ~2,843 ETH + ~1.68M DAI (~$8.5M)
Funds are lying dormant - no mixer, no CEX. We are monitoring for movement
1
1
7
Project @TheSandboxGame (ethereum:0x3845badade8e6dff049820680d1f14bd3903a5d0) was exploited on Base. The attacker minted unbacked ethereum:0x3845badade8e6dff049820680d1f14bd3903a5d0 while also draining the SAND OFT adapter on Ethereum
Tracing shows the minted and drained SAND ss DEXes and consolidated into a single wallet on Ethereum, 0xac76b04397c9296dfc00e25c96d8e51b4edfaf29, which now holds ~396 ETH (~$958K) and is sitting dormant. Notably, the attacker's wallet was gas-funded from CCE.cash on Aug 21, shortly before the attack
We are tracing the flows and monitoring the wallet, and will update if it moves
Tracing shows the minted and drained SAND ss DEXes and consolidated into a single wallet on Ethereum, 0xac76b04397c9296dfc00e25c96d8e51b4edfaf29, which now holds ~396 ETH (~$958K) and is sitting dormant. Notably, the attacker's wallet was gas-funded from CCE.cash on Aug 21, shortly before the attack
We are tracing the flows and monitoring the wallet, and will update if it moves
0
1
13
Project @Allbridge_io 's Base CCTP router drained for ~$191K
Tracing shows the proceeds bridged off Base to ~99 ETH on Ethereum, now parked in the same wallet that funded the attacker's gas from Tornado Cash ~7 months earlier
0x1fb4cf26ce82ad4dcd8f055a4092c625cebbdb85 (~109 ETH, $253k)
Tracing shows the proceeds bridged off Base to ~99 ETH on Ethereum, now parked in the same wallet that funded the attacker's gas from Tornado Cash ~7 months earlier
0x1fb4cf26ce82ad4dcd8f055a4092c625cebbdb85 (~109 ETH, $253k)
0
1
14
Project @Maya_Protocol was exploited for ~$1.36M
The attacker moved the stolen funds off MAYAChain, which now sit at two wallets:
BTC - 20.83 BTC (~$1.34M)
└ bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646
ARB - 6.03 ARB.ETH + ~99 ARB.LINK (~$13K)
└ d9F251383881A5E423e
We are monitoring both addresses for onward movement
The attacker moved the stolen funds off MAYAChain, which now sit at two wallets:
BTC - 20.83 BTC (~$1.34M)
└ bc1q0hsgwunccczelq05ucpmfz268eyy5jr2y5l646
ARB - 6.03 ARB.ETH + ~99 ARB.LINK (~$13K)
└ d9F251383881A5E423e
We are monitoring both addresses for onward movement
1
0
6
Our tracing shows @foxmedia257236 attacker's wallet was gas-funded with 1 BNB from FixedFloat nearly two months ago
The ~119.14K USDT was then moved through multiple hops and now sits dormant at:
0x005806c04ec29fe0740eb508c5f431c230b031e2
The ~119.14K USDT was then moved through multiple hops and now sits dormant at:
0x005806c04ec29fe0740eb508c5f431c230b031e2
🚨 FoxMarket @foxmedia257236 - Loss ~$119K (2026-08-15)
Network: BNB Chain
Type: Oracle / Price Manipulation
FoxMarket was drained via its bonding pool. FoxLpBondsPool.stake() computes the minted amount as stakeAmount = usdtAmount * 1e18 / swapPrice, where swapPrice comes from p spot price (getSwapPrice → router.getAmountsOut). The only guard is a caller-supplied _swapPrice band, with no TWAP.
The attacker chained flashloans to crush the FOX/USDT spot price, collapsing swapPrice so stakeAmount and the 3% inviter reward inflated enormously. This minted ~91M FOX + ~89M stakedFOX (via Treasury.lpBonds), which were dumped through the FOX/USDT pools and StableSwap pools for stablecoins before repaying all loans in one tx.
TX: bscscan.com/tx/0x8e1775cbf…
Attacker: bscscan.com/address/0x5670…
Victim: bscscan.com/address/0x9fa6… (FoxLpBondsPool)
⚡ Detected 2026-08-15 11:33:01 UTC
⏱️ Real-time alerts: defimon.xyz
1
0
5
Protocol @harmonyprotocol was exploited on Aug 12. Public reporting indicates that an initial ~4B ONE was created through empty blocks, inflating supply by ~26%
Our investigation shows that ~97% moved through short intemediary paths to exchanges:
~3.49B ONE (~87%, $3.55M) to ~1.25%, $54K) to @binance
~322M ONE (~8.1%, $352K) to @changenow
In total, ~3.865B ONE (~97%, $3.96M) reached these attributed exchange and service wallets
Our investigation shows that ~97% moved through short intemediary paths to exchanges:
~3.49B ONE (~87%, $3.55M) to ~1.25%, $54K) to @binance
~322M ONE (~8.1%, $352K) to @changenow
In total, ~3.865B ONE (~97%, $3.96M) reached these attributed exchange and service wallets
1
0
12
