At least $755K taken from @rrealist in a UK wrench attack Tracing shows ~719K USDC was deposited to @hitbtc within hours. The SOL was swapped to ~14.7 ETH via @near_intents and is now sitting untouched at 0xeec36e6b1dad28331e457d1abf532265d6ee700f We are actively monitoring this case
Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026 We checked when each of the 258 drained addresses first received funds. ~90% were first funded after June 1. The median date is Aug 6, and none was funded after Oct 4 But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
It seems like @payy_link was exploited for ~$1.9M in USDC Our tracing shows the proceeds were swapped into ~683 ETH and split across four fresh wallets (~200 / ~280 / ~200 / 1 ETH). Those wallets have not moved since A second batch of ~90.2k USDC is still parked in the attacker's entry wallet. It remains there and was not blacklisted by @circle at our last check Worth noting: the attack wallet's gas was seeded through Railgun two days before the drain We are actively monitoring this case and will post updates if funds move
Seems like the @Fetch_ai / @ASI_Alliance exploiter has started laundering the stolen funds 100 ETH was swapped to ~266K USDC, bridged via Circle CCTP to Arbitrum and deposited into Hyperliquid, then converted into "FXMR" which is likely a Monero variant The other 100 ETH was sent to @Chainflip, where the broker rejected the deposit. The attacker was refunded and pivoted to @THORChain, swapped into ~3.28 BTC and began peeling it through a chain of Bitcoin addresses The remaining ~433 ETH are still parked at the main address 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE
Multiple tokens in the @ASI_Alliance ecosystem were hit in an exploit on Ethereum - ethereum:0xaea46a60368a7bd060eec7df8cba43b7ef41ad85 drained and ethereum:0xf0d33beda4d734c72684b5f9abbebf715d0a7935 , $WMTX, ethereum:0x5b7533812759b45c2b44c19e320ba2cd2681b542 & $CGV minted Tracing shows most of the funds were swapped into ETH and stablecoins. The main wallet 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE holds ~$1.75M (632.9 ETH + 52.4K mUSD + 15.9 WETH). A second wallet 0x83F4424A401a9Bb75F90314f21ADAeA6a9cE09C5 holds ~$530K (92.4 ETH + 289.5K USDC) Another 40M AGIX was parked in three dormant stash wallets that hold no gas We are actively monitoring this case
Two Safes using Makina modules on Ethereum were drained on Sep 15 Safe #1 lost 2,900 rsETH ($7.7M). An MEV bot intercepted the extraction in-block - 2,882 rsETH is now dormant at 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, likely the Yoink MEV address. The attacker got nothing from this one Safe #2 lost ~$125K in USDC and DUSD. Those funds were swapped to ETH, bridged to Hyperliquid and converted to XMR. The attacker profited around $58K Attacker wallet was seeded from Railgun and used to deploy the malicious contracts
On September 11, @symbiosis_fi syBTC was exploited. ~184.47B syBTC was minted to the attacker on each of BNB, Ethereum and Rootstock Tracing shows attacker dumped all the tokens and bridged to Ethereum. The funds are now consolidated at 0x7cd28D8E6210E6E4A8b1947FC9b44DC01C600192 ~309 ETH (~$748K) The attacker's gas was funded via @ChangeNOW We are actively monitoring this case and will post updates if the funds move
Liquid Network @Liquid_BTC was reportedly exploited for ~4,000 BTC, currently worth ~$315M The purpoted whitehat might have returned 3,400 BTC (~$268M) to the official Liquid Federation wallet, while retaining ~600 BTC (~$47M) as a potential bounty The return transaction is still waiting to be confirmed https://t.co/ckH3V9xpRM
Project @cozyfinance was exploited for $160K on @Optimism The attacker bridged all the stolen proceeds (USDC) to Ethereum, swapped them to ETH, and deposited them into Tornado Cash Notably, the attacker's gas funding also came from Tornado Cash, withdrawn on 27 August, 11 days before the exploit
