CEO & Lead Crypto Investigator at @Intell_on_Chain | Blockchain Forensics, OSINT & Crypto Crime Investigations | Victim of crypto crime? @IOC_Support
Scammed? 👉
Joined December 2021
- Tweets8.1K
- Following1.1K
- Followers51.8K
- Likes6.5K
The bad actors in cases like this are incredibly convincing. It's always worth asking for a number you can call back to verify. They won't give you one
They prey on urgency.
Today is the first day of the NEW Crypto Tracing Challenge (CTC) - a capture-the-flag type of event!
I've worked hard behind the scenes to build a Leaderboard to go along with it. All you do is register (along with 50+ people) and submit your responses before the deadline.
Once the event has finished, I'll personally run you through our investigation during a FREE class for participants.
You're all welcome to join! Links below (🔗👇) or scan the QR code
Recently, I was invited by a multi-billion dollar company to talk about the impact on AI, for both good and bad actors!
This is might just be the largest automated money laundering loop that we’ve seen!
Thanks for sharing @chainalysis
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
Since 20:10 this evening (London), Binance has seen withdrawals of upto $5.8 Billion - By far the world's largest exploit. This continued up until around 23:05
Here's the latest
Roughly $3.3–3.5 billion on Ethereum alone (including ~167k+ ETH plus large USDT/USDC and dozens of other tokens).
Multi-chain tallies (Ethereum + Bitcoin + Tron and others) reach as high as ~$5.5–5.8 billion in tracked movements or attacker-linked holdings, according to analysts and platforms like Arkham. Exact net stolen amounts remain unconfirmed.
Tether froze more than ~$1.567 billion in USDT and Circle froze ~$823 million in USDC tied to the receiving addresses (combined freezes reported in the ~$1.8–2.3+ billion range). Additional freezes involved assets from Ripple and others. Law enforcement coordination has been noted by Circle.
Tether froze more than ~$1.567 billion in USDT and Circle froze ~$823 million in USDC tied to the receiving addresses (combined freezes reported in the ~$1.8–2.3+ billion range). Additional freezes involved assets from Ripple and others. Law enforcement coordination has been noted by Circle.
Would you reply to this text?
"Hi, is this Alex? It's Sam from the gallery evening. Still on for Thursday?"
You're not Alex. You're polite, so you say so. They apologise, they're charming, and somehow the chat keeps going. Weeks later, your new friend mentions a trading platform that's been doing very nicely for them...
That's how many "pig butchering" (relationship investment) scams begin. Not with a pitch, but with a wrong number and a lot of patience. The money comes much later, once trust is built and the "platform" is showing impressive, entirely fake gains. Then a withdrawal suddenly needs a "tax" or a "fee".
It doesn't work because people are stupid. It works because people are kind, busy, sometimes lonely, and well-mannered. That's why clever people get caught.
Three habits that help:
• Don't keep chatting to friendly wrong-number strangers
• Never move money to a platform recommended by someone you've only met online
• If a withdrawal needs a fee first, stop and talk to someone you trust
If this is happening to you or someone you know, IOC Support (ioc.support) offers a free case assessment from our investigators.
Honest question: would you have replied to that first message? And what would have made you stop?
I use AI in my investigative work. A lot.
It can help me work through large amounts of information, structure data, identify things worth looking at, analyse code, compare behaviours and turn hours of repetitive work into minutes.
I think investigators who learn how to use it properly are going to have a significant advantage.
But there's a line I don't think we should cross.
AI identifying something interesting doesn't make it evidence.
If an AI tells me two wallets appear related, I still want to know why.
If it suggests an attribution, I want the underlying evidence.
If it identifies a pattern, I want to understand the methodology that produced it.
And if I couldn't explain the conclusion without saying “the AI told me”, then I'm probably not ready to make that conclusion.
That's particularly important in crypto investigations, where an incorrect assumption can propagate through an entire transaction graph.
For me, AI should make an investigator faster and more capable.
It shouldn't replace the investigator's judgement.
JP retweeted
I know with all the other shit going on everyone has forgotten about the implanted Ledgers in the wild.
But if you know of any (drained or not) please keep sharing information, photos, purchase date + location, etc.
Come to @SEAL_911. Tag me. Tag @MagicalTux. Tag @Ledger. 🙏
I found a SIM implant in my friend's @Ledger Flex. He set it up but never used it, so no funds were lost.
He bought it from @cryptobilis at their May 22 2026 Global Pizza Party, Raintree Club Kuala Lumpur.
nRF9151 LTE module, eSIM module, v1.1 UFL antenna
cc @MagicalTux
Tornado Cash question for investigators 🌪️
When linking a deposit to a withdrawal, which signal do you trust MOST?
1️⃣ Timing
2️⃣ Denomination patterns
3️⃣ Relayer / gas behaviour
4️⃣ Where the funds go next
Reply with a number. I'll share how I weigh them.
JP retweeted
🇰🇵
For a few months, I posed as a recruiter and engaged a DPRK persona known as Jason Kwon, who appeared to be operating as hightechrun shortly after news of m00n was shared. He later introduced himself as Roy Hensley. At the present, there is a possibility his current alias is on a shared upwork profile. Without knowing when that profile was put into play, it’s unconfirmed if that alias has entered any projects or been exposed.
Some of this will be familiar to researchers who follow DPRK activity as this wasn’t attribution built from scratch. It started with existing research from @zachxbt being publicly shared and some tracking by @intell_on_chain (@rugpullfinder). During our conversations and conveniently in the Beanstalk discord, he shared the 0xm00n GitHub account and later explained it as an “agency” account.
I used decoy documents, and CanaryTokens to collect what was possible about working environments. The summary covers the identity changes I could follow and connections collected during the small engagement.
I’m publishing this now because I want to get back into documenting, not leaving helpful info sitting in DMs, screenshots, and drafts. Additional context can help someone else connect an account, recognize a recycled persona, or pick up a thread you couldn’t follow further.
Link to medium article ⬇️ and thanks to all involved in this. @0xfigo has recently shared some work done behind the scenes with @north_scan involving tracking DPRK so I’m mentioning that as a resource available for those doing work on our beloved IT Workers.
medium.com/@0xsaiyangod/meet…
Confirmed @BloomTrading exploit with nearly $1M in losses!
All victims to be re-imbursed
Official Statement | Security Incident Update
TL;DR: No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom.
Following our investigation, we have identified the exact attack vector and confirmed the scope of the incident.
The attack exploited a third-party module through a complex Remote Code Execution (RCE) vulnerability. No private keys were accessed or compromised, and we have ruled out broader exposure of users' wallets.
Incident Overview
Affected: 49 wallet addresses belonging to 9 users.
• Total losses: Approximately 9,408 SOL ($947,000).
• Root cause: Exploited third-party module enabling an RCE vulnerability.
• Refunds: Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users.
• We are also working to trace the stolen funds, explore recovery and freezing options, and identify the attacker.
Our team has been developing software since 2018 and operating in crypto since 2021. We are an established team, committed to building for the long term and protecting the trust of our users.
Security threats are an unfortunate reality of this industry, even with extensive precautions in place. Our commitment to user safety, transparency, and business continuity remains unchanged.
The Bloom Team
Anyone affected by this can reach out to @ioc_support for help!
We're ready and waiting to go!
. @BloomTrading is draining people now, possible exitscam.
bad actor wallet: solscan.io/account/7kY8qx8Mq…
@casino847 & @domyxbt got drained for $200k.
get your funds out asap.
Be honest 👇 I'm genuinely curious to see the responses
Where did you buy your hardware wallet?
54%Official manufacturer sit
15%Amazon / marketplace
0%Third-party reseller
31%I don't use one
13 votes • Final resultsSome of the most valuable things I've learned as an investigator have come from other investigators.
I've been fortunate enough to learn from some of the best in the industry, and I've always believed that when we share knowledge, everyone benefits.
A rising tide lifts all boats.
That's the thinking behind something we're launching tonight:
🔎 IOC Investigator Roundtables.
A free, monthly opportunity for investigators in the IOC community to come together behind closed doors in our Discord server.
The idea is simple.
Bring something useful to the table. A case, a tool, a technique, a piece of intelligence, a lesson learned, or even just a question you've been trying to answer.
Share what you know. Learn from what others have experienced. Help each other become better investigators.
Because no single investigator has all the answers, and some of the best learning happens through conversations with people doing the work.
I'm really looking forward to seeing what comes out of these sessions.
The first IOC Investigator Roundtable takes place tonight.
#BlockchainInvestigations #CryptoInvestigations #InvestigatorCommunity #KnowledgeSharing #OSInt
🚨 PSA: @cryptocom Phishing Campaign
The case below is linked directly to a phishing campaign that happened between the 22nd July and 30th July.
$3.2 Million lost.
The attackers ONLY removed ETH. Full chart and attacker outflow addresses posted below 👇
This quoted post is unavailable.
One of the outflow addresses: 0xd0e1eB55638e5216B11Cf8b55a7A2D9B7b63b86e
Is linked to a "CDC SendGrid Hack" reported through @_SEAL_Org
AI Description:
1. CDC Impersonation via Email Exploitation
During major health events, cybercriminals frequently orchestrate phishing scams by spoofing or compromising official communication channels. [1]
The Tactic: Attackers send fraudulent emails that appear to come from the CDC, leveraging fear and urgency regarding public health updates, directives, or critical alerts. [1]
The Mechanism: To guarantee that these emails bypass standard spam filters and achieve high delivery rates, attackers often abuse legitimate mass-email delivery platforms like Twilio SendGrid. Since SendGrid is a highly trusted domain, malicious emails can easily slip into a victim's main inbox. [1, 2]
2. Compromised SendGrid Accounts & API Keys
When SendGrid is mentioned in relation to a "hack," it is usually regarding Account Takeovers (ATOs) or compromised API keys rather than a direct breach of SendGrid's core infrastructure. [1, 2, 3]
How it happens: Attackers steal a company or agency's SendGrid credentials or API keys via malware, credential stuffing, or phishing.
The Abuse: Once they gain access, they use that legitimate account to send out massive waves of phishing emails. Because the account has properly configured SPF, DKIM, and DMARC settings, the fake "CDC" emails look completely authentic to recipient servers. [1, 2, 3, 4]