IOC Investigations

🕵️‍♂️ It really feels great to help people during dark times Today we helped @NiwinEth, a proud owner of @cryptopunks #8832! Their wallet was compromised, which saw the theft of the Punk among other assets! 😱 This is how it started ⬇️ Then @lorepunk got in touch on Niwin's behalf and we didn't hesitate! 1️⃣ The first priority is always secure any remaining assets. 2️⃣ Then we set about doing what we do best - Tracing 3️⃣ We also need to try to understand the cause! 4️⃣ Next, we watch and wait. This is where the break came from. The Punk was sold for 40 ETH and that was deposited to @okx 5️⃣ Now it's all about timing and luck. Luckily on this occasion, we caught it in time. 6️⃣ OKX didn't hesitate either - they were successful in freezing the proceeds. 7️⃣ Now its all about law enforcement - They NEED to get involved. @NiwinEth is working hard to achieve this! Here is how it is now! Still work to do but Niwin now has a much higher chance of success. Best of luck @NiwinEth 💙

Address poisoning has gone from nuisance to background noise on Ethereum. Goldsky's data: about a third of Ethereum stablecoin transfer events in its 2026 sample came from contracts that behave like address poisoners, up from 7% in 2025. One verified contract, literally named "Poisoner", sent roughly 1 in 12 of all the events it sampled. The trick is simple. Attackers send tiny or zero-value transfers from addresses that match the first and last characters of ones you already use, then wait for you to copy the wrong one from your history. Etherscan has launched a Lookalike Address Warning (beta) that highlights lookalike addresses on the same page. Useful, but it's a backstop, not a process. In the cases we investigate, the loss usually comes down to one copy-paste from transaction history. Address books, whitelists and a small test transaction still beat any warning banner. What does your team's address-verification step actually look like? Curious how others handle it. If anyone is impacted by address poisoning, reach out for free help to @ioc_support

Binance withdrawals have restarted in phases. Scammers will use it. No one needs to 'verify a balance', 're-enable withdrawals' or claim a refund via a link or DM. Use only the official Binance app. Targeted or lost funds? Free help: @ioc_support

The "profits" on a fake trading site are just numbers on a screen. This week a 44-year-old Chinese national was extradited from the Netherlands and arraigned in California over an alleged pig-butchering ring that US prosecutors say took more than $36.9 million from 174 victims. Eight co-conspirators have already pleaded guilty. According to the Department of Justice, the group: 1. Contacted people through unsolicited texts, social media, phone calls and dating sites, and built trust over time. 2. Pointed them to fake websites that looked like real crypto trading platforms. 3. Showed their "investments" growing, while the money was actually converted to USDT and moved to scam-centre bosses in Cambodia. Warning signs to share with family and friends: - Someone you met online steers the conversation to crypto investing. - The platform is one you've never heard of, reached by a link they sent. - Withdrawals need a "tax", "fee" or "unlock deposit" first. That is the scam taking one more payment. If this has happened to you or someone you know: stop sending money, save every message, wallet address and transaction ID, and report it (in the US, ic3.gov). Then expect a second wave of "recovery" offers. Anyone asking for an upfront fee to get your crypto back is running another scam. IOC.support offers a free, no-obligation case assessment from real blockchain investigators. The FBI says investment scams cost Americans more than $8.6 billion in 2025. Want to learn how investigators follow the money? Start with our Level 1 Crypto Investigations course: intelligenceonchain.com/cour…

SlowMist has published analysis of a tampered version of the Udesk customer-service script, the kind of chat widget many exchanges and fintech sites embed without a second thought. The modified script quietly loaded a second payload from a lookalike domain (udeskqlobal[.]com, with a "q", not a "g"). On any site that loaded it, it collected cookies, browser storage and anything typed into login, sign-up and password forms. On three specific crypto exchange sites it went further: it replaced the deposit addresses shown on the page across six networks (BTC, EVM, TRON, Solana, LTC, DOGE) and hijacked the copy button and clipboard. That last detail is the one I'd want every user to understand. The usual advice is "check the address you pasted matches the one on screen". Here, both were the attacker's. For platforms: third-party scripts run with the same access as your own code. Pin versions, use integrity checks and restrict where scripts can send data. For users: confirm a deposit address on a second device or in the official app, and compare it against a previous deposit before sending anything large. What's your second check before you send to a deposit address?

Predict[.]fun, a prediction market on BNB Chain, has now confirmed roughly 400,000 USDT taken from a small number of user wallets. Its preliminary view is that its API documentation site, hosted by a third party, may have been compromised. The site is offline, full reimbursement is promised, and a post-mortem is coming. What stands out from the on-chain work: independent analysts say each withdrawal was signed with the victim's own wallet key, just not through the app. One tracker counts this as the second hit in five days. No smart-contract bug and no bad approval. Someone was able to sign for those accounts. That is the uncomfortable pattern this month. Bloom (a third-party module), NGRAVE (a third-party notification service), Keystone (a third-party monitoring tool) and now Predict.fun: the weak point sat next to the user, not with the user. If a platform holds or generates your keys, its suppliers are part of your security. If you were affected: rotate any key that touched the platform's API, and treat every "claim your refund" message or link as hostile. A genuine refund comes through the platform itself. Where do you draw the line on trusting platform-managed wallets?

Are crypto recovery services legit? Red flags: ❌ they contacted you first ❌ upfront fee ❌ they promise your money back ❌ they want your seed phrase That's a recovery scam. Free case assessment from Intelligence On Chain (IOC) @ioc_support

Your iPhone's iOS version is now part of your wallet security. SlowMist says the DarkSword exploit kit can grab crypto wallet data just from opening a malicious page in Safari. Window: iOS 18.6–18.7.2 and 26.0–26.1. When did you last update? 👇