On-chain investigations
Hacks, exploits and schemes we traced ourselves: where the money went, which addresses hold it, and which exchanges it reached. Every figure links to the transaction; every attacker address is labelled in the PublicAML risk graph.
The Houthis’ eight sanctioned Tron wallets: $915M passed through — and the freeze that mattered came four months before the sanctions
822.7M USDT through one wallet, 81.5M traded with Sa’id al-Jamal’s listed wallets, 750,318 USDT frozen by Tether in Dec 2024 — the other six held 24 cents.
Gamdom hack: $2.2M still parked in DAI, $363k turned into Monero on Hyperliquid, the Bitcoin into a coinjoin
Full attacker addresses behind the analysts’ map: 2.0M DAI and 87 ETH unmoved, the branch where the public trail stopped went to Hyperliquid too, $363k bought a Monero token, 1.5 BTC went into a coinjoin.
The EIP-7702 sweeper behind the sven.eth theft: 120 wallets, not one, and the 9 ETH went back nine minutes later
The press reported one victim and no recovery; on chain the attacker used delegations from 120 wallets, sent sven.eth 9.58 ETH back nine minutes after the sweep, and cashed 3.32 ETH out into a Binance deposit.
Moonwell MAMO exploit: 800 ETH from Tornado Cash in, 8.73 million DAI out, and the DAI has not moved for seven weeks
The Base exploit of 27 Aug was paid for with ~800 ETH from Tornado; 1.95M USDC bridged in, 8.73M back as unfreezable DAI; the attacker’s own gain is about $6.78M; all 8,728,319 DAI still sit on one Ethereum wallet.
UNCX vesting exploit: $1.08 million from BNB Chain still sits untouched, and the Ethereum attacker came back for its ZC
Updated 16 Oct: $1.49M on four chains; a Tornado-funded BNB Chain attacker parked $1.08M on an address that has never sent a tx, with UNCX offering a 10% bounty; the Ethereum attacker has taken 21.45 ETH.
Aave Loop Safe Module exploit: 114 ETH into Railgun in 98 minutes, and a bounty offer that came four hours late
Gas from Railgun, the loot back into Railgun 98 minutes later; both drained Safes run by one key, the only two Safes that ever enabled the adapter.
Autheo THEO exploit: two unbacked mints, 119 million tokens, and about 292 ETH taken — not 700
A second 100M mint nobody reported; the sales produced 291.7 ETH; 400 ETH of the reported 700.8 were on the wallet a week before; 93.5M unsold THEO sent to an older wallet funded from Binance and MEXC.
Sinaloa Cartel sanctions: $4.4 million of the listed wallets’ money went into Binance, and three of the six are Binance deposit addresses
The six Ethereum addresses OFAC listed on 20 May 2026: $4.58M in, $4.39M into one Binance hot wallet within minutes; $989,000 withdrawn from Coinbase, swapped on Uniswap; last deposit 14 months before the listing.
79th Vault hack: 15,000 BNB went back, and the 1,249 BNB the attacker kept went into Tornado Cash
All 16,249 BNB accounted for: a 912 BNB top-up eight minutes before the return, 606 BNB into Tornado Cash, 645 BNB through swap-service and KuCoin deposit addresses, one branch followed to Ethereum.
Where the stolen crypto still sits: 17,500+ BTC and 3,190 ETH on wallets we watch
Chen Zhi, Coldcard, Liquid, Aztec, Duelbits, Neutron, Nostra, Limit Break re-read on 10 Oct: most never moved. NuNet’s 432.5 ETH left via Chainflip and THORChain; Payy’s 90,202 USDC still not frozen.
A fake “Bitget AML check” drained 101 wallets of $233,000 — the site is still online
bitget-aml.com asks for an unlimited USDT approval and takes the whole balance. One operator, four contracts since April 2025; 45,000+ USDT into Bybit deposit addresses.
Triple-A hack: the stolen ether went into DAI, back into ether, and through Tornado Cash twice
5,287 ETH sold for 9.87M DAI three days after the theft, bought back in August; 1,414 ETH withdrawn from Tornado on 10 Aug went straight back in on 9 Oct. Nothing left.
· updated
Ledger / CryptoBilis drain: two more Tornado Cash waves on 10 October, and what still sits on the thief’s wallets
After Bitquery’s snapshot: 1,340 ETH into Tornado in two waves, all 2.1M USDC passed to one service address by 11 Oct; ~15,075 ETH and 203.8 BTC still on named addresses.
Iranian oil money on Tron: $2.7 billion through seven wallets, $61 million frozen, and the 14 months in between
The US forfeiture case read on chain: all seven Entity A wallets found from five-character prefixes, $491M straight from Binance withdrawals, $2M to Zedcex in 2024.
· updated
Google’s AI lists a wallet drainer as the top free AML checker. We read its code and followed the money
AML.legal says “no wallet connect”, then asks for a USDT approval on hidden pages. 71 addresses approved its Tron contract; 10,069 USDT taken so far.
North Korea’s IT-worker money on chain: a wallet changed every fortnight, ether staked with a mainstream provider, and 96 ETH nobody can freeze
Addresses OFAC listed on 12 Mar 2026: six Tron wallets used in turn, one frozen three months before the listing, and 96 ETH still sitting on a sanctioned address.
Iran’s sanctioned crypto exchangers: $483M in stablecoins, and every dollar of it went into Binance and OKX
Six addresses OFAC listed on 7 Aug 2026 behave as exchange deposit addresses: 431.0M forwarded to Binance, 51.7M to OKX, nothing left to freeze.
Tren de Aragua on Tron: $6.08M passed through seven sanctioned wallets — every dollar went on to Binance
Seven wallets listed on 30 Sep 2026: money forwarded within minutes, a third of it from three unlisted wallets, and 20 USDT left to freeze.
Two terror-finance freezes on Tron: one caught $538,000, the other caught $28
131 ISIS-K wallets were frozen while still working; seven Hamas-linked wallets that moved 24.7M USDT were listed 16 months after they went quiet.
Iran’s central bank on Tron: $474M frozen in two steps, and $12.6M that left in the 82 days between them
Six sanctioned wallets read in full: 85.5M USDT moved to a new wallet 8 days before the first freeze, 12.56M paid out between the two, and none of the recipients frozen.
MakerDAO keeper drain: 200 ETH out of Tornado Cash’s shadow and back into it in 31 minutes
A forgotten third-party liquidation bot, an unprotected function, gas from Tornado at 05:57, 200 ETH taken at 06:13, twenty 10-ETH deposits done by 06:28.
Summer.fi exploit: 6 million DAI became 3,294 ETH in Tornado Cash — through the attacker’s own router, over 16 days
DAI sold through a private swap contract, ether paid to a second wallet, 56 Tornado deposits on 7–22 July. Nothing left.
· updated
Tornado Cash, July–September 2026: nine thefts we traced put 18,391 ETH into the mixer
Bonzo Lend, Summer.fi, Term Labs, Tectonic, Duelbits, Aztec, GIWA, Payy, Coldcard: how fast each reached the mixer, 6,561 ETH in three days of September, and what did not go there.
A7A5 after the US designation: 89% of the volume is the same tokens going out and coming back
Every A7A5 transfer on Tron for three weeks: 347.7B on paper, 89% matched back-and-forth between the same wallets, about $0.7M a day in small transfers — and no change after 1 October.
Aztec exploits: the 909 ETH never moved — the Tornado Cash deposits came from a different drain
Three drains in June: 909 ETH, 270,513 DAI and 167.89 wstETH untouched on one wallet for 113 days; the 1,158 ETH from the older rollup all in Tornado by 26 Aug.
Bonzo Lend exploit: all 4,571 ETH went into Tornado Cash — most of it within a day
The Hedera lender lost $9M on 11 July; WBTC over LayerZero, ether relayed from Arbitrum and Base, 63 Tornado deposits by 14 July. Nothing left on the wallet.
September 2026 crypto hacks: $766 million taken — where the money is one week later
Twelve incidents we traced, re-read on 5 October: three ended with the money returned, three in mixers, and seven addresses still hold about $59 million.
· updated
Kelp DAO hack, six months on: 75,700 ETH became 2,105 BTC in two days — and two thirds of it went into coinjoins
857 THORChain swaps from 265 wallets, 2,104.67 BTC on 359 addresses; 69% of what could be traced ended in Wasabi and JoinMarket coinjoins, about 81 BTC at exchanges.
Xinbi Guarantee: $52.8M was frozen — and $146M had left the same wallets in the week before
The 52 sanctioned Tron wallets read on chain: a 53rd frozen wallet that is not on the list, $20M a day paid out until the last minute, and the same deposit hubs as in our pig-butchering study.
· updated
Base vault drain: $6M in wstETH, gas from Tornado Cash — and 1,000 wstETH stuck in a seven-day bridge window
Three valid Safe signatures, gas laundered through Tornado 2.5 h before, and a Lido bridge withdrawal that cannot be claimed on Ethereum until about 11 Oct.
· updated
Nostra exploit: the $2M that reached Ethereum is still on one wallet — after a Railgun deposit came straight back
USDC swapped to DAI within minutes, WBTC sold for ETH, one 19 ETH try at Railgun bounced back; 253.47 ETH + 1.35M DAI still parked on 3 Oct.
Chen Zhi’s other bitcoin: the four sanctioned addresses are empty, and 15,957 BTC sits next door
OFAC listed four bitcoin addresses for the Prince Group chairman. All four were emptied eight days later into four new addresses that are not on the list — 15,957 BTC, unspent for a year.
Coldcard hack: where the bitcoin is now — 1,038.85 BTC still on four addresses, 649 ETH into Tornado Cash
Two months on: most of the stolen bitcoin has never moved, the one leg that reached Ethereum went into Tornado Cash, and 32.37 BTC rescued by white hats is still unclaimed.
· updated
NEAR Intents exploit: 3.87M USDT taken in seven withdrawals — and returned two days later
Returned in full on 2 Oct, with an on-chain message from the exploiter. Seven withdrawals from the HOT bridge treasury over 11 hours, swapped to BNB; ~590 BNB into one KuCoin deposit account, ~760 BNB through MetaMask Bridge.
Pig butchering on Tron: we followed the money from 9,993 victim reports
2,197 Tron addresses from Chainabuse reports, read on chain: shared collectors, a 92.7M USDT node, 184 exchange deposit accounts and HuionePay.
Meter Passport exploit: the “$2.3 million” was printed, not taken
A billion unbacked wMTRG on BNB Chain, but thin pools and a $0.0015 token: the attacker’s sales returned about $420, and 400M went into pools on failed swaps.
Payy hack: the 682 ETH went into Tornado Cash, but 90,202 USDC is still on the exploiter’s wallet
A bridge verifier accepted an invalid proof: 1.92M USDC out, swapped to ETH and into Tornado on 26 Sep; the second payout is still there and not frozen.
Fake GIWA bridge: 1,331 wallets paid in, and all 766 ETH went to Tornado Cash
A fake Upbit L2 bridge listed on DyorSwap, drained by its own 2-of-2 Safe; every branch of the 766 ETH into Tornado within 27 hours.
Limit Break exploit: where the 542 WETH went, and the attacker still draining wallets
Old Magic Eden approvals: 282.7 WETH to an MEV bot that is returning 90%, 223 ETH parked on one attacker wallet, 46 ETH into Railgun.
· updated
Duelbits hack: five chains drained into one wallet, and 1,370 ETH now in Tornado Cash
Ethereum, TRON and Solana converted to ETH and pooled in one wallet; 1,370 ETH into Tornado on 26–28 Sep, 973.5 ETH still there.
· updated
Bitget hack: the last 40,000 ETH has moved — about 35,000 ETH sent toward THORChain
All eight holding wallets are empty; ~35,000 ETH toward THORChain; the $318K we flagged is frozen; NEAR Intents blocked $50M+.
The $7.8 million the Yoink bot took from a hacker went back to the Safe’s owner
All 2,882.37 rsETH, a day after the interception — a 1 rsETH test, then the rest. Nobody reported the ending.
Fetch.ai, NuNet, World Mobile: what the attacker sold, and the 433 ETH and 200 million WMTX he still holds
Across two wallets: ~720 ETH realised, 293.7 ETH gone, and 433 ETH plus 200M WMTX that have not moved.
· updated
Neutron: two wallets cast 98% of the votes that handed Astroport and Drop to their attacker
One staked 31.62M NTRN eleven minutes before close; the other was paid 1,000 USDC after the drain. 794 ETH has not moved.
Tectonic: the branch that skipped Tornado — 232 XMR1 still sitting on Hyperliquid
140 ETH the reports missed: Bitcoin coinjoins, and six undelivered Wagyu swap orders.
Nomic and Osmosis allBTC: the 40.65 BTC nobody noticed for 74 days
A gas payment two days before the mint ties the Osmosis and Ethereum addresses to one actor.
Nesa: the "$50 million" exploit that cashed out at about 109 ETH, into KuCoin
The headline was paper value. The attacker spent 105 ETH to make 109.
Term Labs: all of the stolen ETH went to Tornado Cash, and the DAI went to Robinhood Chain
3,253 ETH into Tornado, not 960 — and 1M DAI bridged to a chain few explorers read.
FomoPeek: the App Store app that read wallet keys off the phone
580,129 USDT from 38 wallets we can see. What to do if you installed it.
· updated
Finiko’s FNK token: the $14 million taken from its pool two years after the collapse
The pool was drained in 2023 and routed through Avalanche to HTX, OKX and Swapster.
· updated
Finiko: what the chain says, and why the published totals conflict
The venue was Bybit, and the 20,565 BTC figure does not hold.
Where Amir Capital’s money went: a four-chain trace
Bitcoin, Tron, Ethereum and BNB Chain, with the exits named.
Liquid Network hack: the 598.5 BTC has not moved
The 598.5 BTC is still where it landed — and the address most reports blame is Blockstream’s own.
Incident reports from the wider feed are on News.