Crypto investigations focused on results. Rapid incident response, stolen asset tracing, successful freezes, and crypto recovery.
Joined July 2022
- Tweets322
- Following595
- Followers737
- Likes84
Update: @etherscan have tagged the attacker's addresses. Thank you for the fast reply! We'll keep an eye on the cluster of attacker addresses and let you know if we see any new ones. Thanks for working with us to fight illicit activity!
🚨86,477 USDT stolen: 2 attempts to launder it via Railgun stopped
On Nov 9, a crypto service lost 86,477 USDT (TRC-20) due to unauthorised access to its infrastructure.
The attacker used a no-KYC exchanger to swap the funds from Tron to Ethereum, then tried to launder them via Railgun (twice). The second time, a part of the funds was swapped to USDC using NEAR Intents infrastructure, and transferred to a new address. Both attempts failed and the deposits were blocked, which meant the attacker had to return the funds to the original addresses.
This is where @RAILGUN_Project’s Private Proofs of Innocence (PPOI) system comes in. PPOI reacts quickly to the attacker's transactions, not letting stolen funds get any further inside Railgun - the only option left is to withdraw them back.
@aml_crypto is working on this case with @officer_secret. We continue to monitor the funds. The investigation is ongoing. We are working on the digital traces left by the attacker on the server and on the infrastructure behind the IP addresses used during the attack.
7
1,827
🚨86,477 USDT stolen: 2 attempts to launder it via Railgun stopped
On Nov 9, a crypto service lost 86,477 USDT (TRC-20) due to unauthorised access to its infrastructure.
The attacker used a no-KYC exchanger to swap the funds from Tron to Ethereum, then tried to launder them via Railgun (twice). The second time, a part of the funds was swapped to USDC using NEAR Intents infrastructure, and transferred to a new address. Both attempts failed and the deposits were blocked, which meant the attacker had to return the funds to the original addresses.
This is where @RAILGUN_Project’s Private Proofs of Innocence (PPOI) system comes in. PPOI reacts quickly to the attacker's transactions, not letting stolen funds get any further inside Railgun - the only option left is to withdraw them back.
@aml_crypto is working on this case with @officer_secret. We continue to monitor the funds. The investigation is ongoing. We are working on the digital traces left by the attacker on the server and on the infrastructure behind the IP addresses used during the attack.
1/8 We've seen a Robin Hood in crypto thieves, someone who doesn't take it all?!
On September 6, 2026, 1,000,500 USDT was moved out of a TRON wallet with 1.5M USDT in it. The seed was known to a number of people. Looks like somebody took a lot, but left enough to keep the business going.
1
1
251
7/8 The investigation continues. 7/ 538,479 DAI are located at 6 Ethereum addresses we attribute to the attacker as of November 6, 2026.
Exchanges and swap services: if you see them in your deposits, DM us.
1
1
34
8/8 As of 6 November 2026, stolen assets are held on 6 Ethereum addresses we attribute to the attacker: 538,479 DAI 👇
0xfdc62d081bf6890b2a724c69f6b7f02e6ba28669 0xf11e0a4acab784ed1b0dc1d2de796b7c07633bb8 0x7972a7dd2f8c3719635db61a639c20d197d46364 0x39285e15834d03e5113a9fd14771abdc7c5ca6f9 0x655cd93a31b47964979b308837b3611dbfeebeb2 0x9e5fca21eb3a90ec7542b78125b721edb9f5bfbc
1
29
TRX theft: the attacker transfers the funds
On Nov 5, 2026, the attacker started moving stolen funds from TFssrAF788Aa98VBYcMDzUp4SNWBXvLnch. In one day, 2.2M TRX was moved out of the address, about 3.2M TRX remains.
- 2.2M TRX traded for ~300 ETH on THORChain. Funds received on:
0xea0465bebd62a0925b583f3b5bd21ff67aebc44c 0x14a9a2615989809a97116e27bd97737c5b68b3a9
- From 0xea04, 26 ETH swapped to ZEC on THORChain.
- Another 124 ETH from address 0xea04 is moving to ZEC via Wagyu.
Forensic examination of the victim’s device confirmed that the theft was conducted with the help of malware. Work is still underway on the attacker’s digital identifiers.
Another TRON address (~$106K) was hijacked in the same way, still active Oct 12, 2026, 15:32:51 UTC
Do not paste commands from chat or websites into a terminal. Keep your antivirus running, update software regularly, verify calls on a different channel. We fight crime and investigate together with @officer_secret. OPSec tips in his profile.
1
94
How it occurred. The screenshots show the victim’s chat with the attacker, with the images translated.
The attackers wrote from the hacked Telegram account of a long-time acquaintance. They spent a month establishing confidence before they sent a calendar invite to meet.
The link led me to a fake Teams page: “access not permitted” on the phone, a “SDK update” prompt for the terminal on the laptop. The victim was travelling and less vigilant. The command installed malware and in an hour the attacker had taken over the TRON address. Loss: ~ $1.7M.
1
255
iOS updated? If you think your seed phrase may have leaked, move to a new wallet too.
Lost crypto? DM @aml_crypto or @officer_secret We'll see what the prospects are. We mark attacker addresses at least with proof of theft and wallet ownership. Sometimes that alone gets funds frozen.
Crypto is being massively stolen from users of various crypto wallets through… 18+ websites - victims have already lost $5,570,000 due to a vulnerability in iOS 18.
It’s all because of the DarkSword vulnerability: just open an infected website via Safari and malicious code is already running on your smartphone - passwords, messages, photos, and crypto wallet files (including private keys) are under attack.
Update iOS to the latest version as soon as possible. And never ever store photos of your seed phrase in the gallery or write it in Notes!
7
542
AML Crypto retweeted
Crypto is being massively stolen from users of various crypto wallets through… 18+ websites - victims have already lost $5,570,000 due to a vulnerability in iOS 18.
It’s all because of the DarkSword vulnerability: just open an infected website via Safari and malicious code is already running on your smartphone - passwords, messages, photos, and crypto wallet files (including private keys) are under attack.
Update iOS to the latest version as soon as possible. And never ever store photos of your seed phrase in the gallery or write it in Notes!
AML Crypto retweeted
What Happened with Binance and How to Protect Against Such Attacks
The Binance attack shows that attackers are no longer afraid to strike big structures and market players. The development of AI has led to an increase in the speed and complexity of attacks, and the targets that were once considered conditionally impregnable are no longer so.
This case is a signal that such attacks will happen on other major players, and at a much higher pace than before.
If we look at the facts available, the situation itself - when the compromise of a single devops engineer’s laptop makes it possible to steal billions of dollars - should not be possible in any circumstances.
The security team's job is not to make the company impossible to hack, but to make the attack chain leading to an unacceptable event as long as possible so that the team has time to respond. Based on what we currently know, the chain was not long enough to respond in time, even without the involvement of AI in the attack.
Which takes us back to the classic rules of information security:
• Know the possible attack scenarios.
• Make them as difficult as possible for attackers to get to.
• Configure the tools in such a way that it becomes possible to prevent the occurrence of the unacceptable event within the infrastructure, not the breach itself.
Here the count is in minutes, and this is not the speed of the people responding to the incident - it is a battle of the toolsets of those people who know how an attack happens and know how it can be prevented.
What to do next?
Historically, information security in the cyber industry has always been built around basic cryptographic systems, although this issue needs to be viewed much more broadly.
This is a new sphere for classical information security and a relevant problem for any financial structures working with cryptocurrencies.
We should change that!
New TRON Investigation Insights into Binance Exploiters
AML Crypto and @officer_secret continues to track where stolen assets go. “We can see a lot of activity on TRON with our analysis of transactions, with hundreds of addresses.
Major findings:
▪️ 2,831 outgoing transactions from 284 addresses associated with exploiter between October 29, 20:44 and October 30, 12:44.
▪️ The average time between transactions was 20.35 seconds, with a median of just 3 seconds. 1,099 consecutive transaction pairs had identical timestamps to the second.
▪️ Peak activity was observed on October 30, between 06:00 and 06:59 UTC: 865 transactions in one hour, or roughly one transaction every 4.2 seconds.
▪️ The volume and frequency of transfers indicate that attackers may be using automated tools to generate new addresses and move funds. Some addresses are recycled across transaction routes, making tracing even more difficult.
We found interactions between:
Bitget Wallet, LayerZero, Symbiosis Finance, @near_intents, Meson, Allbridge, and ChangeHero (@Changehero_io)
We also found un-attributed addresses that may relate to other service providers.
We call on @Changehero_io, @near_intents and @binance to take action.
We call on both sides to review the identified addresses and to block transactions associated with the exploiter to the extent technically feasible.
AML Crypto is ready to provide actionable intelligence on exploiter controlled addresses at no cost, including newly identified wallets as the investigation progresses.
We continue to investigate. bholder.amlcrypto.io/shared/… #Binance #TRON #CryptoForensics #AML
AML Crypto retweeted
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO.
Commingling address:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
Bitget exploit context: xitter.gq/zachxbt/status/2104528…
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
AML Crypto retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
