On-chain investigations
Hacks, exploits and schemes we traced ourselves: where the money went, which addresses hold it, and which exchanges it reached. Every figure links to the transaction; every attacker address is labelled in the PublicAML risk graph.
Bitget hack: 68,465 ETH sit on eight attacker wallets, untouched
The Ethereum side address by address — three Bitget wallets, one swap wallet, one hub, eight holding wallets, and $318K still freezable.
The $7.8 million the Yoink bot took from a hacker went back to the Safe’s owner
All 2,882.37 rsETH, a day after the interception — a 1 rsETH test, then the rest. Nobody reported the ending.
Fetch.ai, NuNet, World Mobile: what the attacker sold, and the 433 ETH and 200 million WMTX he still holds
Across two wallets: ~720 ETH realised, 293.7 ETH gone, and 433 ETH plus 200M WMTX that have not moved.
Neutron: two wallets cast 98% of the votes that handed Astroport and Drop to their attacker
One staked 31.62M NTRN eleven minutes before close; the other was paid 1,000 USDC after the drain. 794 ETH has not moved.
Tectonic: the branch that skipped Tornado — 232 XMR1 still sitting on Hyperliquid
140 ETH the reports missed: Bitcoin coinjoins, and six undelivered Wagyu swap orders.
Nomic and Osmosis allBTC: the 40.65 BTC nobody noticed for 74 days
A gas payment two days before the mint ties the Osmosis and Ethereum addresses to one actor.
Nesa: the "$50 million" exploit that cashed out at about 109 ETH, into KuCoin
The headline was paper value. The attacker spent 105 ETH to make 109.
Term Labs: all of the stolen ETH went to Tornado Cash, and the DAI went to Robinhood Chain
3,253 ETH into Tornado, not 960 — and 1M DAI bridged to a chain few explorers read.
FomoPeek: the App Store app that read wallet keys off the phone
580,129 USDT from 38 wallets we can see. What to do if you installed it.
· updated
Finiko’s FNK token: the $14 million taken from its pool two years after the collapse
The pool was drained in 2023 and routed through Avalanche to HTX, OKX and Swapster.
· updated
Finiko: what the chain says, and why the published totals conflict
The venue was Bybit, and the 20,565 BTC figure does not hold.
Where Amir Capital’s money went: a four-chain trace
Bitcoin, Tron, Ethereum and BNB Chain, with the exits named.
Liquid Network hack: the 598.5 BTC has not moved
The 598.5 BTC is still where it landed — and the address most reports blame is Blockstream’s own.
Incident reports from the wider feed are on News.