Most of the money became a Monero token.
In 39 new Hyperliquid accounts, the thief swapped $2.16M into XMR1, a token that tracks Monero.
On the morning of 19 October, none of it had been sold or withdrawn.
In 39 new Hyperliquid accounts, the thief swapped $2.16M into XMR1, a token that tracks Monero.
On the morning of 19 October, none of it had been sold or withdrawn.
1
0
1
One set of recovery words opens your wallets on every chain your device supports.
A thief with your words can empty them all at once. In one burst, the thief emptied XRP, Ethereum, Solana and Stellar wallets within 90 seconds.
We count six chains hit that night.
A thief with your words can empty them all at once. In one burst, the thief emptied XRP, Ethereum, Solana and Stellar wallets within 90 seconds.
We count six chains hit that night.
1
0
0
One thief took $2.65M from 84 wallets in one night, after fake alerts from NGRAVE's own app.
The alert said your portfolio had been synced on a new phone in Moscow. The page behind it asked for your recovery words.
We followed the money. Here is where most of it went.
The alert said your portfolio had been synced on a new phone in Moscow. The page behind it asked for your recovery words.
We followed the money. Here is where most of it went.
1
3
7
One market did grow: lending.
On Morpho, USDC borrowed against Circle’s tokenized bitcoin went from $0 to $190M in a month.
97% of the supplied USDC is now lent out.
On Morpho, USDC borrowed against Circle’s tokenized bitcoin went from $0 to $190M in a month.
97% of the supplied USDC is now lent out.
1
0
1
Arc’s trading looked healthy. In week four, DEX volume averaged $64M per day.
Now remove the bots, the wallet farms, and one wallet that trades with itself.
Real volume: $3.6M per day. That is about 6% of the headline.
Now remove the bots, the wallet farms, and one wallet that trades with itself.
Real volume: $3.6M per day. That is about 6% of the headline.
1
2
4
Circle’s Arc blockchain launched one month ago.
Day one: 406,006 active wallets.
Week four: 24,678 per day.
That is a 94% drop.
We followed every block to see where everyone went. 🧵
Day one: 406,006 active wallets.
Week four: 24,678 per day.
That is a 94% drop.
We followed every block to see where everyone went. 🧵
1
2
4
Median daily gap between each tokenized stock traded in various chains, between September 13 and October 13.
0
0
2
Different Nvidia tokenized stock issuers and their volume, traders, and average trade size over the last 30 days.
Robinhood has volume, but Solana has actual traders.
Robinhood has volume, but Solana has actual traders.
1
0
1
We're proud to be a data partner of Ardence, TRM Labs' new AI investigation platform. Learn more: trmlink.info/3Wb8iL3
Investigations depend on connecting the dots. Today, as we launch Ardence, we're thanking the intelligence partners who help investigators make those connections.
Meet Ardence: trmlink.info/4zBgCCx
0
0
0
Devs sell fast.
On 65% of new Pump.fun coins, the dev's first sale came within a minute of launch. On 90%, it came within a day.
On 65% of new Pump.fun coins, the dev's first sale came within a minute of launch. On 90%, it came within a day.
1
0
1
The dev launches a coin and buys from several more wallets in the same bundle, so no single wallet looks big.
On 21% of new Pump.fun coins, the dev's own wallets bought in block 0 this way. They took a median 10% of all tokens at the launch price.
On 21% of new Pump.fun coins, the dev's own wallets bought in block 0 this way. They took a median 10% of all tokens at the launch price.
2
1
2
Pump.fun devs and their bundled wallets made at least $579M on launches up to 30 June.
Sniper bots made $31.5M over the same months.
The first wallets to buy a new coin after the dev are often the dev's own.
Sniper bots made $31.5M over the same months.
The first wallets to buy a new coin after the dev are often the dev's own.
1
1
3
How many active wallets trade on Solana each month?
5.9 to 17.3 million wallets traded on Solana each month.
By our tests, 4.6 to 10.2 million of them behaved like people.
bitquery.io/investigations…
0
1
1
Bots also prey on other bots.
39% of what the sandwich bots took came out of trades by snipers, high-volume wallets and rival sandwich bots.
The rest came from everyone else.
39% of what the sandwich bots took came out of trades by snipers, high-volume wallets and rival sandwich bots.
The rest came from everyone else.
1
0
1
The attacks keep growing.
In late 2025, bots made about 3,400 sandwiches per day. By September 2026, they made 51,900 per day.
Almost all of them hit coins on Pump Fun.
In late 2025, bots made about 3,400 sandwiches per day. By September 2026, they made 51,900 per day.
Almost all of them hit coins on Pump Fun.
1
0
0
Sandwich bots took $29.7M from Solana memecoin buyers in 11 months.
The trick is simple. A bot buys just before your swap, so you pay a higher price, and then it sells right after.
We counted 6.9 million of these attacks.
The trick is simple. A bot buys just before your swap, so you pay a higher price, and then it sells right after.
We counted 6.9 million of these attacks.
3
0
0
The miss that made the most money was Wisconsin's Democratic gubernatorial primary.
On the morning of the vote, Francesca Hong's shares cost 96 cents. David Crowley's cost 4 cents.
Crowley won by less than a point.
On the morning of the vote, Francesca Hong's shares cost 96 cents. David Crowley's cost 4 cents.
Crowley won by less than a point.
1
0
0
When Polymarket was very sure, it was nearly always right: favorites at 90 cents or more won 177 of 182 races.
Closer calls fell short. Favorites priced at 50 to 90 cents cost 77 cents on average, a 77% chance. They won only 71% of the time.
Closer calls fell short. Favorites priced at 50 to 90 cents cost 77 cents on average, a 77% chance. They won only 71% of the time.
1
0
0
How accurate is Polymarket?
We checked its prices on the morning of each vote against the results in 273 primaries this year.
The favorite won 238 of them. That's 87%.
We checked its prices on the morning of each vote against the results in 273 primaries this year.
The favorite won 238 of them. That's 87%.
1
0
0
In Texas, the Democrats went from long shot to favorite.
Last November, traders gave them about 1 chance in 5 of winning the Senate seat.
Now their nominee, James Talarico, trades at 64% against Ken Paxton.
Last November, traders gave them about 1 chance in 5 of winning the Senate seat.
Now their nominee, James Talarico, trades at 64% against Ken Paxton.
1
0
0
Who moved the odds? The crowd.
Since September, wallets of every size together bought 210,000 more Democratic shares than they sold in the Senate market.
One account took the whole other side: lomneivan, with $1.03M riding on the GOP across the Senate map.
Since September, wallets of every size together bought 210,000 more Democratic shares than they sold in the Senate market.
One account took the whole other side: lomneivan, with $1.03M riding on the GOP across the Senate map.
1
0
0
Polymarket traders now favor Democrats to win the Senate.
In January, they gave the GOP a 66% chance of keeping it. Now: 35%.
We went through a year of on-chain trades behind the midterm markets to see who moved the odds.
In January, they gave the GOP a 66% chance of keeping it. Now: 35%.
We went through a year of on-chain trades behind the midterm markets to see who moved the odds.
1
0
0
After the drain, the team took the switch away from its hot wallet but left it with the deployer.
The next day, the team gave the same switch to a new wallet. A dry run shows that either one can still pull 95% of the coins left in the pool.
The next day, the team gave the same switch to a new wallet. A dry run shows that either one can still pull 95% of the coins left in the pool.
1
0
0
Two pulls took 1 million coins out of the pool in 4 seconds. Nobody paid for them.
The price jumped from $8.15 to $22.73 without a single buyer. Then the coins were sold for the pool's dollars.
The price jumped from $8.15 to $22.73 without a single buyer. Then the coins were sold for the pool's dollars.
1
0
0
79AU on BNB Chain lost $14.35M on 7 October.
No code was broken. The token had a built-in switch that let one key take coins out of its PancakeSwap pool for free.
The coins were then sold right back in.
No code was broken. The token had a built-in switch that let one key take coins out of its PancakeSwap pool for free.
The coins were then sold right back in.
2
0
0
The team's document names its market makers: G20, GSR, and Wintermute. Our labels match the report's two to GSR and Wintermute.
The GSR-linked wallet supplied every token in the launch pool. 3 minutes in, it took $649k out of a single position.
The GSR-linked wallet supplied every token in the launch pool. 3 minutes in, it took $649k out of a single position.
1
0
0
3 of those team wallets sent about 48M LAPTOP toward exchanges in the 2 weeks before the team's report.
23M of it fits the team's own published plan: airdrops and market making.
25M from a wallet that is either the treasury or the charity fund does not.
23M of it fits the team's own published plan: airdrops and market making.
25M from a wallet that is either the treasury or the charity fund does not.
1
0
0
Hunter Biden says his team never sold $LAPTOP.
On-chain, that holds up. The founders' wallet still has all 300M tokens. It has never sent one.
But it is 1 of 7 team wallets run by the same keys. Here is what the other 6 did.
On-chain, that holds up. The founders' wallet still has all 300M tokens. It has never sent one.
But it is 1 of 7 team wallets run by the same keys. Here is what the other 6 did.
1
0
1
We went through all 8.1M.
The count holds up: about 8.05M wallets hold USDT0 on Polygon.
But 48% hold less than 1 cent, and only ~720k hold $10 or more.
Full breakdown: bitquery.io/investigations…
The count holds up: about 8.05M wallets hold USDT0 on Polygon.
But 48% hold less than 1 cent, and only ~720k hold $10 or more.
Full breakdown: bitquery.io/investigations…
Three years of USDT0 growth: 8.1M+ on Polygon.
The largest holder base of any chain.
0
0
0
Who pays for Litecoin's security? Mostly Dogecoin.
The same miners mine both coins. In September, 85% of the miners' pay came from Dogecoin blocks.
Dogecoin blocks have paid more than Litecoin's every month since April 2021. Litecoin's 2027 halving will widen the gap.
The same miners mine both coins. In September, 85% of the miners' pay came from Dogecoin blocks.
Dogecoin blocks have paid more than Litecoin's every month since April 2021. Litecoin's 2027 halving will widen the gap.
1
0
1
MWEB, Litecoin's private pool, held 21 times as much LTC in mid-September as at the end of 2023.
In March a bug in the pool paid out 85,034 LTC against an input of about 1.2 LTC.
Eight days later the coins went back to the devs, minus an agreed 850 LTC bounty.
In March a bug in the pool paid out 85,034 LTC against an input of about 1.2 LTC.
Eight days later the coins went back to the devs, minus an agreed 850 LTC bounty.
1
0
0
Is Litecoin dead?
We have read every block since October 2011. The chain is alive. In September, it carried 6.8x as many transactions as Dogecoin.
But its use is shrinking. That month, about 260,000 addresses were active per day, the fewest since October 2023.
We have read every block since October 2011. The chain is alive. In September, it carried 6.8x as many transactions as Dogecoin.
But its use is shrinking. That month, about 260,000 addresses were active per day, the fewest since October 2023.
1
0
0
Where did the USDt go?
Back to Tether. Its treasury took back $1.2 billion more USDt than it handed out, and USDt there doesn't circulate.
Tether minted $1.5 billion of USDt on Avalanche in 2024. It has minted none there since.
Back to Tether. Its treasury took back $1.2 billion more USDt than it handed out, and USDt there doesn't circulate.
Tether minted $1.5 billion of USDt on Avalanche in 2024. It has minted none there since.
1
0
0
Whose USDt was it?
Exchanges held three quarters of the supply.
Binance's and OKX's wallets alone lost $1.2 billion of stablecoins. That is more than the $1.1 billion the whole chain lost.
Exchanges held three quarters of the supply.
Binance's and OKX's wallets alone lost $1.2 billion of stablecoins. That is more than the $1.1 billion the whole chain lost.
1
0
0
Avalanche's stablecoin supply has fallen from $2.13 billion to $998 million since January 2025.
We split it by coin and by who holds it.
One coin made the whole drop: USDt in circulation fell 77%.
We split it by coin and by who holds it.
One coin made the whole drop: USDt in circulation fell 77%.
1
0
0
In late September, Avalanche raised its minimum fee.
Everyone else cut their swaps by 64%.
The two clusters kept going.
They pay about a third of all the gas fees the chain burns.
Everyone else cut their swaps by 64%.
The two clusters kept going.
They pay about a third of all the gas fees the chain burns.
1
0
0
They trade like arbitrage bots.
In 8 of every 10 minutes they traded, they bought AVAX on Avalanche when its price rose on Binance, and sold when it fell.
Binance moves first. The clusters follow.
In 8 of every 10 minutes they traded, they bought AVAX on Avalanche when its price rose on Binance, and sold when it fell.
Binance moves first. The clusters follow.
1
0
0
Who actually trades on Avalanche's DEXs?
We traced every swap back to its sender.
In the 8 days to 4 October, 65% of the dollars came from two clusters of bot wallets. Each cluster was funded by one address.
We traced every swap back to its sender.
In the 8 days to 4 October, 65% of the dollars came from two clusters of bot wallets. Each cluster was funded by one address.
1
0
0
Weekend pools can also break.
Robinhood's token for a gold fund went from $411 to $1,900 over one weekend. The fund itself barely moved.
The token fell back on Sunday night.
Robinhood's token for a gold fund went from $411 to $1,900 over one weekend. The fund itself barely moved.
The token fell back on Sunday night.
1
0
0
Most of the rest arrives overnight.
US stock futures reopen at 6pm Sunday. After that, tokens catch up.
By 3am Monday they had priced in 53% of the move. By 9am, 85%.
US stock futures reopen at 6pm Sunday. After that, tokens catch up.
By 3am Monday they had priced in 53% of the move. By 9am, 85%.
1
0
0
Tokenized stocks trade all weekend. Does their weekend price see Monday coming?
We checked 13 weekends across 6 issuers.
By 6pm Sunday New York time, the typical token had moved just 10% of the way to its stock's Monday open.
We checked 13 weekends across 6 issuers.
By 6pm Sunday New York time, the typical token had moved just 10% of the way to its stock's Monday open.
2
0
0
Who holds the fund tokens on Avalanche? Very few.
The six fund and stock tokens we checked have 39 holders between them.
BlackRock's BUIDL has six holders, and one wallet holds 90%.
The six fund and stock tokens we checked have 39 holders between them.
BlackRock's BUIDL has six holders, and one wallet holds 90%.
1
0
0
BlackRock's BUIDL fund on Avalanche more than doubled in size in July.
The jump was one mint of 500 million tokens to one wallet.
Since the peak, BUIDL on Avalanche has lost 47% as holders redeemed.
The jump was one mint of 500 million tokens to one wallet.
Since the peak, BUIDL on Avalanche has lost 47% as holders redeemed.
1
0
0
News this summer said Avalanche held over $11 billion in real-world assets.
Most of that $11 billion is one copper and gold token, AZX1.
97% of AZX1 still sits in the one wallet it was minted to.
Most of that $11 billion is one copper and gold token, AZX1.
97% of AZX1 still sits in the one wallet it was minted to.
1
0
2
In late September, Avalanche validators voted in a minimum gas price of 5 gwei.
Bots sent less than half as many transactions.
People kept sending about 75,000 transactions per day, as before.
Bots sent less than half as many transactions.
People kept sending about 75,000 transactions per day, as before.
1
0
0
Now leave out the farm and every wallet that sends like a bot.
In August, 21,506 wallets used Avalanche on 5 or more days.
That is the lowest in our data, which starts in 2023, and a quarter of the June 2023 high.
In August, 21,506 wallets used Avalanche on 5 or more days.
That is the lowest in our data, which starts in 2023, and a quarter of the June 2023 high.
1
0
0
Who really used Avalanche in 2026?
On paper, 2026 is Avalanche's busiest year yet.
But from April to June, 95% of the addresses active on a typical day were wallets of one farm.
One address funded all 1.19 million farm wallets.
On paper, 2026 is Avalanche's busiest year yet.
But from April to June, 95% of the addresses active on a typical day were wallets of one farm.
One address funded all 1.19 million farm wallets.
1
0
0
That group trades the gap. It buys the token when it is cheaper than the stock and sells when it costs more.
In US market hours it bought 0.08% below the share on average and sold 0.10% above it.
Each trade pulls the token back toward the stock.
In US market hours it bought 0.08% below the share on average and sold 0.10% above it.
Each trade pulls the token back toward the stock.
1
0
0
So who trades them?
One group of 108 wallets did 37% of all the trading over 30 days.
Every one of its trades settled with a wallet our labels identify as Wintermute's.
One group of 108 wallets did 37% of all the trading over 30 days.
Every one of its trades settled with a wallet our labels identify as Wintermute's.
1
0
0
We compared tokenized stocks from 6 issuers.
Coinbase's track the real share price most closely.
In US market hours they typically sat 0.09% from the stock. Robinhood's sat 0.17%.
Coinbase's track the real share price most closely.
In US market hours they typically sat 0.09% from the stock. Robinhood's sat 0.17%.
2
0
0
Take out that app and that scam.
5,082 wallets used Algorand on 5 or more days in September.
Three years ago the count was 9,703.
5,082 wallets used Algorand on 5 or more days in September.
Three years ago the count was 9,703.
1
0
0
527,746 wallets sent a transaction on Algorand in September.
Half came from one payments app in Afghanistan. Most of those wallets were new and still empty.
A third were fake addresses made by one scam.
Half came from one payments app in Afghanistan. Most of those wallets were new and still empty.
A third were fake addresses made by one scam.
1
0
0
Is Algorand dead?
We read every block since 2019.
In September, 32% of all transactions sent on Algorand were copies of chess games. All came from one wallet.
The wallet posts about 3 results per second, each from a game played on Lichess.
We read every block since 2019.
In September, 32% of all transactions sent on Algorand were copies of chess games. All came from one wallet.
The wallet posts about 3 results per second, each from a game played on Lichess.
1
1
2
One account sets the fee and collects it.
On Oct. 1 it took about $232k in 3 minutes.
PreStocks' terms say it is "not obliged to publish" a fee or a change to one.
On Oct. 1 it took about $232k in 3 minutes.
PreStocks' terms say it is "not obliged to publish" a fee or a change to one.
1
0
1
The fee sits inside the token. A buy pays it. A sell pays it again.
Put in $100 and $97 arrives. Sell straight back and you get about $94.
At 5%, that round trip costs $9.75.
Put in $100 and $97 arrives. Sell straight back and you get about $94.
At 5%, that round trip costs $9.75.
1
0
0
PreStocks' Solana tokens that track OpenAI and Anthropic stock had no transfer fee on Sept. 9.
By Sept. 26 every transfer cost 3%.
A 5% rate is already set in the tokens, due late on Oct. 2 UTC.
By Sept. 26 every transfer cost 3%.
A 5% rate is already set in the tokens, due late on Oct. 2 UTC.
1
0
1
