Match Systems

We've launched a new Telegram channel. For technical reasons we can no longer run our previous one, so if you followed us there, please join us here: t.me/MatchSystems_News We'll cover key events in crypto security, including major hacks, fraud schemes and investigations.

🚨 Walix-Wallet Hack Investigation: Xhash.cash / NEAR Intents We are currently investigating the Walix-Wallet security breach of July 25, 2026, which resulted in the theft of several million dollars' worth of crypto assets. Our investigation indicates that more than $1 million in stolen funds appears to have been laundered through Xhash.cash, a privacy-focused exchange service. According to our findings, Xhash.cash accepts deposits for Any Crypto → XMR swaps directly to deposit addresses associated with NEAR Intents, using the 1Click API. The funds are subsequently transferred to operational addresses associated with the exchange in the Solana network, including: • 2WJ98iXf8DwBzhQeL6zsXq9Tze8VjN6zNUijHAdrPCrJ • BTm25S9wbLdvU64K5dGBPsAVxnPRhSJnPB3XCf6mq6bc • 2giAscgqYx8U5teiQ78NrmmcmYJHFGHtZofe8kBW9nhX From these addresses, the assets are further transferred to several centralized exchanges supporting Monero (XMR) trading pairs. In cooperation with law enforcement agencies, operational addresses involved in the laundering of the stolen assets have been identified and labeled in blockchain analytics platforms and added to NEAR Intents protocol blocklists. As a result, we are now observing transactions associated with Xhash.cash operational infrastructure being blocked or suspended by NEAR Intents. One recent example involves approximately 5 BTC, which has remained in PROCESSING status for more than three days: 1click.chaindefuser.com/v0/s… This case demonstrates why rapid information sharing between investigators, law enforcement, blockchain analytics providers, protocols, and centralized exchanges is critical. Infrastructure used to launder stolen assets can be identified, labeled, and disrupted even across complex cross-chain routes and privacy-focused conversion mechanisms. The investigation remains ongoing. We encourage infrastructure providers and exchanges that may have interacted with the addresses above to preserve all relevant transaction and user data and cooperate with authorized law enforcement requests. @near_intents

🎁 Get 10 FREE AML checks in @MsAmlBot. But first, answer one question: 🚨 How would you lose your crypto? We’ve launched the Match Systems Security Trainer — an interactive crypto security simulator that tests your ability to recognize real-world threats and identify your weakest point before scammers do. Every decision affects your: 💰 Funds 🔐 Security ⚖️ Legal risks 📊 Reputation Complete the simulation without a catastrophic loss and receive a promo code for 10 free AML checks. ▶️ Start now: t.me/MS_SecurityTrainerBot #AML #KYT #Crypto #Bitcoin #Ethereum #USDT #CryptoSecurity #Blockchain #CryptoScam #ScamAlert #CyberSecurity #Web3 #DeFi #BlockchainSecurity #WalletSecurity

The teams that need compliance and security the most are the ones just starting out. @hexens Builder Support Program fixes that — top-tier tooling for early-stage protocols, at builder-stage prices. Time to show what we bring to this partnership. For teams accepted into the program — Match Systems perks: ▸ AML/KYT — risk scoring built on real investigative experience: we don't just flag risks, we trace fund origins, transaction links, and full operation context ▸ KYB — counterparty verification before you trust anyone with your infrastructure ▸ Incident Response — funds stolen or wallets compromised? We launch immediately: on-chain tracing, blockchain investigations, recovery support Special rates on all services for Builder Support participants. Apply: hexens.io/pages/builder-supp…

The UK just sanctioned HTX - one of the largest crypto exchanges by volume. 55M users, $3.3T in 2025 trading volume. This isn't just about the exchange. AML systems retroactively re-label historical transactions. Millions of clean addresses may turn red through no fault of their own. What does your transaction history look like? 👇 matchsystems.com/htx-sanctio… #HTX #sanctions #AML #crypto

🔓 Tether unfroze 497 USDT addresses in one day — $79.2M total. Not a glitch. Not an error. The result of months of dispute work hitting completion at the same time. We broke down exactly how it works 👇 matchsystems.com/tether-unfr… #USDT #Tether #TetherFreeze #USDTFrozen #CryptoCompliance #BlockchainForensics #AML #CryptoInvestigation

In 2026, you don't have to be a criminal to get frozen. You just have to accept USDT from the wrong counterparty. Tether has frozen $4.4B+ to date — coordinated with OFAC and law enforcement, no advance notice, no appeal window. One tainted hop upstream. One blocked wallet. Months of dispute ahead. We help companies screen before it happens — and navigate recovery when it already has. #USDT #Tether #AML #KYT #Blockchain #Investigations #Crypto #Compliance

$577M in April: Why Stablecoin Issuers Failed to Freeze Stolen Funds, and What It Changes cryptotimes.io/insights/577m… via @CryptoTimes_io

Tether froze USDT of people who did nothing wrong. No hack. No scam. Just received funds from the wrong person - and now their balance is locked with no explanation. Cases like this have multiplied in 2026. Innocent users stuck. Why it happens and what actually works 👇 matchsystems.com/tether-froz… Has this happened to you or someone you know? #USDT #Tether #Freeze #Block #CryptoCompliance #AML #CryptoSecurity #BlockchainInvestigation #CryptoRecovery

🤝 Our partners @FixedFloat published a practical guide: what to do if your crypto is stolen. → ff.io/en/blog/guides/if-cryp… Covers the most common attack vectors — phishing, seed phrase leaks, address poisoning — and step-by-step actions in the first hours after an incident. Includes a section on our joint investigations and how coordinated blockchain analysis leads to real asset recovery. #CryptoTheft #BlockchainForensics #CryptoRecovery #PhishingAttack #AddressPoisoning #MatchSystems

🛡 Our Case. Episode 6 600K in One Transaction: How Deep Analytics Revealed a "Hidden" Block In one of our cases, a client lost over $3 million to theft. We immediately performed AML tagging so the assets would be flagged as stolen across exchange AML systems. One address stood out from the rest: approximately $600,000 in Bitcoin had been sitting in a separate wallet for an extended period — with no visible connection to any crypto service. No public links. A genuinely complex situation. We applied advanced investigative methods and additional checks, including clustering of related addresses. Eventually, we identified that this "invisible" address belonged to one of the major exchanges. The funds were blocked based on our AML tagging. We received confirmation of the block from the service and, together with the victim's law enforcement authorities, initiated the recovery process. Conclusion Basic analytics isn't always enough. Some blocks triggered by AML tagging remain hidden — and without deep analysis and specialized techniques, certain addresses simply cannot be attributed to an exchange at all.

🔐 Crypto Theft Schemes in 2026 — And How to Protect Your Assets Crypto scammers never sleep. While you're reading this, someone is losing funds to drainers, phishing attacks, SIM swaps, or a months-long "pig butchering" con. We broke down the most common attack schemes tracked by Match Systems analysts: 🪤 Crypto Drainers — you sign the permission yourself, thinking it's a routine action. The script handles the rest. 🎣 Phishing & Fake AML Checks — pixel-perfect clones of real services that ask you to "connect your wallet." Legitimate AML checks never require wallet access. Ever. 📋 Clipboard Hijacking — you copy a wallet address, but malware has already swapped it for the attacker's. The first and last characters often match — so you won't notice. 🐷 Pig Butchering — weeks of "friendship" or "romance," a too-good-to-be-true investment platform, then the withdrawal freezes and your new "friend" vanishes. 💸 Recovery Scammers — already been robbed? That's when "blockchain specialists" appear, promising to get your funds back — for an upfront fee. It's the second hit. Plus: OTC traps, dust attacks, fake ICOs, Ponzi schemes, and more. 3 rules that actually work: ✅ Slow down — urgency is a scammer's favorite weapon ✅ Separate your wallets by purpose — never use your main holdings wallet for day-to-day activity ✅ Keep your holdings private — in crypto, oversharing is an open invitation Full breakdown of every scheme, protection tips, and a step-by-step guide on what to do if you've been hacked — on our website: matchsystems.com/crypto-thef…

Fake USDT is becoming a real problem in crypto. Scammers create tokens that look identical to USDT and send them to victims hoping they won’t notice the difference. In this article for @CryptoTimes_io , we explain: • how fake USDT works • how scammers trick users • what to check before accepting a transaction If you work with crypto — it’s worth knowing how this scheme works. Read the full guide: cryptotimes.io/learn/fake-us…

Stolen crypto? Report the incident and help flag the attacker’s wallet across the ecosystem. Our team has already helped recover $80M+ in stolen crypto. Report the case → matchsystems.com

🛡 Our Case. Episode 5 The Long-Term Effect of AML Tagging: Blocks Still in Place a Year After the Theft In 2024, a major Asian exchange became the victim of a high-profile hack that media outlets linked to the so-called North Korean “crypto army.” Hundreds of millions of dollars were stolen. At the initial stage, the exchange chose to conduct the investigation independently. We continued monitoring the case for research purposes. Throughout this period, we tagged newly related addresses and tracked further fund movements. Nearly a year later, the exchange returned to us for assistance. At that point, the key outcome became clear: the previously established AML tagging was still effective. Assets continued to be blocked across multiple exchanges, despite the time that had passed. Large platforms strictly follow their AML policies and maintain restrictions on assets when relevant tagging is present. As a result, even months later, a portion of the funds remained frozen and available for transfer back to the affected party. Conclusion This case shows that AML tagging is not only about speed in the first hours after an incident. It is about creating a durable trail that continues to work months later. #AML #CryptoRecovery #CryptoScam #Scam #ScamAlert #scammers