I sniff out dev wallets, insider clusters and hidden flows

Joined October 2026
SCAMMERS CAN NOW BE WATCHED. EVERY WALLET ON OUR WANTED BOARD IS CHECKED EVERY 6 HOURS. THE MOMENT THE MONEY MOVES, YOU SEE WHERE IT WENT. here's the problem every victim knows. you post the scammer's address. people retweet it. a week later everyone forgot. and the scammer just waits. then moves the money when nobody is looking. not anymore. > you post the scam on the wanted board: the addresses, what you lost, a reward > tracehound checks those wallets every 6 hours > money leaves the wallet -> it shows up on the board > where it landed: a fresh wallet, a bridge, a mixer, or an exchange > if the next wallet forwards to an exchange, we flag it as that exchange's deposit address > you get a telegram message > every move links to its transaction why the exchange part matters: an exchange deposit is the one place stolen money can still be frozen. but only if someone asks fast. with the tx, the address, the amount and the time. that's what this gives you. we ran it on the bybit hacker's wallets. 4 addresses. 57 moves. every one on chain, every one with its tx. the video is that. the scammer stopped being anonymous the moment they touched the chain. now they can't move quietly either. got scammed? put it on the wanted board.
1
2
2
14
925
TraceHound retweeted
TRACEHOUND ROADMAP: WE'RE HIRING ON-CHAIN ANALYSTS AND BUILDING 14 NEW WAYS TO HUNT SCAMMERS our DMs are full. hacked wallets. drained savings. rug pulls. fake exchanges. "investment managers" who vanished. every message ends the same way: "can you find them?" we read every one of them. and we can't answer them fast enough. so we're hiring. > ON-CHAIN ANALYSTS WANTED tools find the trail. people close the case. we're building a team that takes every request from our DMs and the wanted board and traces it end to end: - every request read by a human, not a bot - hop by hop: swaps, splits, bridges, all the way to the exchange, the tx and the deposit address - a report the victim can actually hand to the exchange and the police - public case files when the victim agrees trace wallets for fun or for work? DM us. show us a trail you followed. > ALREADY LIVE - hack trace on 9 chains: ethereum, base, arbitrum, bsc, polygon, optimism, solana, tron, bitcoin - crosses bridges: thorchain, cctp, across, wormhole, stargate, debridge, mayan - exchange deposits found and labeled - token check, rug radar, wanted board, exit liquidity score, telegram bot, public API > NEXT. FROM THE COOLEST DOWN 02 "scammer moved": wanted wallets under watch. the second the money moves, we post it 03 check before you send: paste an address before sending. tied to a scam? you know first 04 freeze request kit: tx, deposit address, amounts, times. one click, formatted for exchange compliance 05 case desk: submit a case, track it like a parcel. received -> tracing -> exchange found -> report ready 06 operator files: different scams, different chains, same person. one file per operator 07 was I drained?: which drainer, which approval, what to revoke right now 08 address poisoning alarm: looks like your contact. isn't. flagged before you copy it > LATER 09 hunter leaderboard: tips that found the exchange, ranked in public 10 drainer & phishing database, open to everyone 11 scams of the week: fresh scams, traced and explained 12 AI case report: the whole trace told as a story 13 new chains: TON, hyperliquid, sui, XRP 14 telegram mini app 15 sharper verdicts: every red flag with its real hit rate > THE GOAL right now a victim hears "sorry, crypto is untraceable." it isn't. it never was. every scam should end with a file: the trail. the exit. the name. got scammed? DM us or post it on the wanted board. want to hunt with us? DM us too. the blockchain never forgets.
2
2
3
21
2,714
TRACEHOUND ROADMAP: WE'RE HIRING ON-CHAIN ANALYSTS AND BUILDING 14 NEW WAYS TO HUNT SCAMMERS our DMs are full. hacked wallets. drained savings. rug pulls. fake exchanges. "investment managers" who vanished. every message ends the same way: "can you find them?" we read every one of them. and we can't answer them fast enough. so we're hiring. > ON-CHAIN ANALYSTS WANTED tools find the trail. people close the case. we're building a team that takes every request from our DMs and the wanted board and traces it end to end: - every request read by a human, not a bot - hop by hop: swaps, splits, bridges, all the way to the exchange, the tx and the deposit address - a report the victim can actually hand to the exchange and the police - public case files when the victim agrees trace wallets for fun or for work? DM us. show us a trail you followed. > ALREADY LIVE - hack trace on 9 chains: ethereum, base, arbitrum, bsc, polygon, optimism, solana, tron, bitcoin - crosses bridges: thorchain, cctp, across, wormhole, stargate, debridge, mayan - exchange deposits found and labeled - token check, rug radar, wanted board, exit liquidity score, telegram bot, public API > NEXT. FROM THE COOLEST DOWN 02 "scammer moved": wanted wallets under watch. the second the money moves, we post it 03 check before you send: paste an address before sending. tied to a scam? you know first 04 freeze request kit: tx, deposit address, amounts, times. one click, formatted for exchange compliance 05 case desk: submit a case, track it like a parcel. received -> tracing -> exchange found -> report ready 06 operator files: different scams, different chains, same person. one file per operator 07 was I drained?: which drainer, which approval, what to revoke right now 08 address poisoning alarm: looks like your contact. isn't. flagged before you copy it > LATER 09 hunter leaderboard: tips that found the exchange, ranked in public 10 drainer & phishing database, open to everyone 11 scams of the week: fresh scams, traced and explained 12 AI case report: the whole trace told as a story 13 new chains: TON, hyperliquid, sui, XRP 14 telegram mini app 15 sharper verdicts: every red flag with its real hit rate > THE GOAL right now a victim hears "sorry, crypto is untraceable." it isn't. it never was. every scam should end with a file: the trail. the exit. the name. got scammed? DM us or post it on the wanted board. want to hunt with us? DM us too. the blockchain never forgets.
2
2
3
21
2,714
RADIANT CAPITAL LOST ~$50M TO NORTH KOREA. THE LAUNDERING WAS COMPETENT. IT STILL FAILED, FOR A REASON MOST PEOPLE MISS. laundering doesn't destroy information. it can't. every swap, bridge and split is a public state change. all laundering can do is add noise and hope nobody separates it from the signal. which creates a brutal asymmetry: the launderer has to break every path between the theft and the cash-out. the tracer only needs one path to survive. I ran the Radiant exploiter through tracehound to see which paths survived. 2 chains. 33 wallets. 89 flows. 11 findings. 169 seconds. the tricks weren't the problem. the habits were > 1. THE SWAP THAT POINTS TO ITS OWN EXIT the exploiter routed swaps through aggregators and had the output paid to a fresh wallet instead of back to itself. on an explorer, the funds appear to vanish into a contract. but a swap is a single atomic transaction. input and recipient live in the same tx. you can't swap into a stranger without writing the stranger's address on-chain. CCTP burns on the source chain and mints on the destination. the two events are cryptographically paired, by design. Across works the same way: every deposit carries an index that resolves to its fill. bridges are built to be verifiable, because users need to prove their funds arrived. that same property makes them traceable. you can't have one without the other. > 3. THE MISTAKE THAT ACTUALLY MATTERED: ONE KEY, TWO CHAINS here's the part most people miss. an EVM address is derived from a private key, and that key works on every EVM chain. same key, same address, everywhere. so when the same addresses show up on arbitrum AND ethereum, that's not a coincidence. that's the same key holder: - 0x3904…7ebc received swap outputs on both chains - 0x5703…dba6 received direct transfers on both chains, plus all three bridge exits - 0x97a0…e4e8 and 0x8b75…0887 got 12.13k ETH each on arbitrum, and are labeled Radiant Capital Exploiter 2 and 3 on ethereum hopping chains doesn't give you a new identity if you bring your keys with you. > 4. SYMMETRY IS A SIGNATURE on ethereum, exploiter wallets 2, 3 and 4 each received exactly 707.05 ETH. on arbitrum, two of the same wallets each received exactly 12.13k ETH. humans don't split money into identical parts across multiple chains. scripts do. and scripts are reproducible, which is the opposite of what you want when hiding. > 5. SILENCE IS DATA TOO, WEAKLY across 79 transactions, the main wallet never moved between 09:00 and 17:00 UTC. that's a hint, not evidence. tracehound marks it low confidence, and so should you. the honest way to trace is to separate what the chain proves from what it suggests. > THE GENERAL PRINCIPLE every obfuscation technique attacks one type of link: - swaps attack the token link - bridges attack the chain link - fresh wallets attack the address link - time delays attack the timing link but attribution doesn't rest on one link type. it rests on redundancy. cut the token link and the address link remains. change addresses and the amounts still rhyme. jump chains and the key comes with you. to disappear, you have to break all of them, on every hop, every time. Radiant's launderers broke some of them, on some hops, some of the time. and the trail is still live: the funds on these addresses were still moving in 2026. that's what tracehound is built for. not the hop you can see on an explorer, but the links between hops that survive every trick. which hack should I break down next?
3
2
21
6,394
introducing the tracehound wanted board. got scammed? post it. put a reward on it. > drop the scammer's addresses > say what you lost > offer a reward for information > anyone who knows something sends you a tip. only you see it > every address on the board is one click from a full trace rugged, drained, phished, hacked. 9 chains. no names, no doxxing. addresses, transactions and what happened. the reward is between you and whoever helps. we hold no money and take no cut. and if someone asks you to pay upfront to "recover" your funds, that's a scam too. the chain never forgets. now neither do we.
8
46
7
255
153,574
$625 million. The biggest DeFi hack in history. In March 2022, someone walked out of the Ronin Bridge with 173,600 ETH and 25.5M USDC. Nobody noticed for six days. We pasted the exploiter's address into tracehound and let it run. 53 seconds later, this is what came back. It started with 1.06 ETH. Before the attacker could move $300M, they needed gas. That gas came from a Binance withdrawal: 1.06 ETH, about $3,100 at the time. An exchange withdrawal means an exchange account, and an exchange knows who asked for it. Then the money moved. 103,854 ETH, $305.6M at the moment it left, went out in four pieces: -> 33,568 ETH -> 25,127 ETH -> 23,528 ETH -> 21,629 ETH Those four wallets split it again, into fifteen. And the fifteen started feeding a mixer in clean, round amounts: 7,000. 5,800. 8,700. 3,000. 3,000. 3,000. 3,000. Round numbers are not how people spend money. They're how people launder it. By May, 70,500 ETH ($175.6M) had gone into Tornado Cash. The full path, from the Binance withdrawal to the mixer, is on one graph: 22 wallets, 35 flows, every arrow a real transaction you can open. What tracehound found on its own: - The gas was funded by an exchange withdrawal (high confidence) - The suspect is a labeled exploiter: Ronin Bridge Exploiter - 70.5k ETH went into Tornado Cash, with the deposit transactions listed - A daily 8-hour window with no activity across every transaction. A weak hint at a timezone, and we label it that way. That's the job: find where the money came from, where it went, and which transactions prove it, then mark how sure we are about each claim. $625M heists get investigated by teams over weeks. This trace took less than a minute
2
1
2
4
3,957
New on Tracehound: Exit Liquidity Score. Paste a Solana wallet. Tracehound reads its last 500 transactions, finds every memecoin it bought, and counts the ones that are now 90%+ below its entry with the wallet still at a loss. We ran it on an active trader's wallet: > 403 SOL through 17 memecoins > 9 of them now worth next to nothing > net −34.9 SOL, worst single coin −20.2 SOL Then it opens a token check on the three coins that cost the most: > coin #1: the developer bought 37.6% of supply in the launch tx and sold all of it > coin #2: the developer's circle had launched 14 tokens before it, all 14 dead > coin #3: developer funded from KuCoin two hours before launch, launch bag fully sold Why it's useful: > see your real hit rate, not the one you remember > learn what your losers had in common: big dev bags, serial launchers, freshly funded devs. Those are the flags to check before the next buy > vet a wallet before you copy it. Paste a caller's or copy-trade wallet and see how its picks actually ended Every figure links to the chain. Read-only, no wallet connect, no signing.
5
4
2,752
WE BUILT A RADAR FOR PUMPFUN RUGS first hour live, it caught: > one wallet launching 143 coins in 13 minutes > two more doing 100+ in 25 minutes > HELLO launched 38 times in under 5 minutes > ~70% of new launches flagged this is what you're "aping early" into. introducing RUG RADAR every pumpfun launch hits the dish the second it's created > serial devs > cloned tickers > known ruggers from our database > devs buying their own launch with 5+ SOL hover any dot and watch it thread to every other coin that dev launched live. free. open source.
1
1
5
683