News
Coverage of crypto exploits, drains and scams, alongside reports filed by people who lost funds. Every item names the addresses involved and what PublicAML sees on them.
Items marked Report are filings from readers, published as they were filed. Most have not been checked by anyone, and an unchecked report puts no risk label on any address. File a report.
Hacks, exploits and schemes we traced ourselves. The same list, on one page: all investigations.
- Investigation
Arcus exploit: the $2.23M left Robinhood Chain before the block, and almost all of it is still with the attacker
2,234,418 USDG left through Relay.link as 1,052 ETH 44 minutes before Arcus blocked the address; since then the attacker only reshuffled: 475 ETH unmoved, 1,008,945 DAI on a fresh wallet, 2.83 BTC via THORChain. No exchange, no mixer.
- Investigation
zkLink Nova bridge hack: 705,309 DAI of the stolen money sits on three wallets, untouched since 9 November
One transaction drained the Nova escrow on 28 Oct; the attacker sold everything for ~306 ETH, then DAI, and on 9 Nov parked 705,309 DAI on three fresh wallets. Gas from FixedFloat; about a tenth left via FixedFloat and ChangeNOW.
- Investigation
The Tornado-funded BTC-long, ETH-short trade on Hyperliquid: 3,100 ETH out of the mixer, and one thief with enough notes to have put it in
31 × 100 ETH out of Tornado on 7 Nov, sold for 6.92M USDC, sent to Hyperliquid via CCTP; since 1 Oct the Drift exploiter put in 505 of the pool's 1,576 hundred-ether notes. Consistent with Drift, not proven.
- Investigation
The "UXLINK-linked" $45M ETH long on Hyperliquid: the money predates the hack, the owner does not look like a stranger
The trader's 11.55M USDC came from two wallets that held the money months before UXLINK was drained; but they move in lockstep, minutes apart, and one of them paid the same three-hour burner as the UXLINK exploiter on 28 Aug 2026.
- Investigation
The iPhone wallet drain network did not stop: 734,424 USDT from 21 more TRON wallets after Bitquery’s report
The fee wallet behind $4.06M of iPhone seed-phrase thefts on TRON kept working after the report: three new collectors emptied 21 wallets by 7 Nov, one for 601,751.60 USDT in a single payment, cashed out as USDD 120,000 at a time through two pass-through wallets.
- Investigation
Premia exploit: 191.8 ETH turned into 5.27 BTC within an hour, and 4 BTC of it was deposited to HitBTC the same morning
Six Premia v3 vaults on Arbitrum were drained for 191.78 ETH; within 30 minutes it left through Chainflip, NEAR Intents and a CCTP leg to Solana, the swaps paid 5.27 BTC to eight addresses, and the attacker cut it into round pieces — 4.0 BTC went to six HitBTC deposit addresses swept at 09:29 UTC.
- Investigation
Binance hack: a Tornado-funded operator, three test runs the same afternoon, and about 430,737 stolen ETH parked on four wallets
The operator was funded by three Tornado Cash withdrawals, rehearsed EIP-7702 on its own wallets, then hijacked Binance 14 with 50 pre-signed authorizations: 197,540 ETH and 1.87B USDT to one collector in 24 seconds; 1.175B USDT frozen; 700M turned into ETH via UniswapX, Aave and Uniswap; about 430,737 ETH on four wallets that have never sent a transaction.
- Investigation
Binance Hot Wallet Exploit
The drain of Binance hot wallets on 29 October 2026: where the money went, which addresses hold it, and what is still open.
- Investigation
Initia exploit: the attacker bought its Initia gas with Tornado Cash ETH through Osmosis, tested the bridge it drained, and all 1,135.52 ETH still sit on one address
A forged MoveVM mint pulled 1.4M AUSD, 1.08M USDC and 105 ETH to Ethereum in seven minutes, swapped into 1,135.52 ETH and parked; the Initia signer is the same key as the Ethereum wallet, its gas was INIT bought with Tornado ETH via Axelar and Osmosis, and 29 minutes before the drain it sent a test through the same ETH bridge.
- InvestigationUpdated Oct 26, 2026
X100 exploit: the attacker’s gas came from FixedFloat, the second raid was run by a Limit Break attacker wallet, and on 26 October 821 ETH went into Tornado Cash
One flash-loaned transaction bought two of three Senate seats and made the treasury sell 400,000 X for 36 USDT; 4,749,726 USDT netted into 2,022.86 ETH, of which 821.1 ETH went into Tornado Cash on 26 Oct; FixedFloat funded the gas five minutes before; a wallet we filed for Limit Break ran the second raid and cashed 40.9 ETH out through ChangeNOW in twenty minutes.
- Investigation
Tornado Cash in 2026: at least 18% of the ETH that went in was stolen, over 40% of that by one attacker — and almost none of it can be traced out
All 64,860 deposits of 2026 read on chain: 645,194 ETH, at least 117,000 of it from published thefts, 48,805 from the Drift exploiter alone; bridges and DEX swaps are the main on-ramps, exchanges only 3–4%; only 4.7% of withdrawals link to deposits — compared with TRM, Chainalysis, Cambridge and academic studies.
- Investigation
USDD on TRON: $8.4 billion went USDT → USDD → USDT within two days in 2026, and $621 million of it came from wallets Tether froze, darknet guarantors or hacks
Every swap through the USDD stability module in 2026: 12.99B USDT in from 11,971 senders, 64% of redemptions are quick round trips, 7.4% of them tied to Tether-frozen wallets, Xinbi counterparties or hacks — the route the Ledger/CryptoBilis thief used, measured across the whole network.
- Investigation
Drift Protocol hack: a second 25,710 ETH went into Tornado Cash on 20 October, and 56,568 ETH still sit on one wallet
190.7M USDC followed from Circle CCTP and Mayan onto 13 attacker wallets on Ethereum; 23,095 ETH into Tornado on 23 July, another 25,710 ETH on 20 October that no report covers yet, 56,568 ETH (~$138M) untouched since 2 April; the Circle blacklisting came after the USDC had left.
- Investigation
Cysic bridge exploit: the attacker’s gas came from Cysic’s own staking-operator wallet, and all 306.5 ETH still sit on one address
A forged 10M CYS mint through the bridge’s normal relayer; 7.2M sold, 306.6 ETH bridged via SWFT, Mayan and deBridge and parked untouched; ten minutes before the mint, Cysic’s staking-operator wallet funded fresh addresses that then paid the attacker’s gas.
- Investigation
The Houthis’ eight sanctioned Tron wallets: $915M passed through — and the freeze that mattered came four months before the sanctions
822.7M USDT through one wallet, 81.5M traded with Sa’id al-Jamal’s listed wallets, 750,318 USDT frozen by Tether in Dec 2024 — the other six held 24 cents.
- Investigation
Gamdom hack: $2.2M still parked in DAI, $363k turned into Monero on Hyperliquid, the Bitcoin into a coinjoin
Full attacker addresses behind the analysts’ map: 2.0M DAI and 87 ETH unmoved, the branch where the public trail stopped went to Hyperliquid too, $363k bought a Monero token, 1.5 BTC went into a coinjoin.
- Investigation
The EIP-7702 sweeper behind the sven.eth theft: 120 wallets, not one, and the 9 ETH went back nine minutes later
The press reported one victim and no recovery; on chain the attacker used delegations from 120 wallets, sent sven.eth 9.58 ETH back nine minutes after the sweep, and cashed 3.32 ETH out into a Binance deposit.
- Investigation
Moonwell MAMO exploit: 800 ETH from Tornado Cash in, 8.73 million DAI out, and the DAI has not moved for seven weeks
The Base exploit of 27 Aug was paid for with ~800 ETH from Tornado; 1.95M USDC bridged in, 8.73M back as unfreezable DAI; the attacker’s own gain is about $6.78M; all 8,728,319 DAI still sit on one Ethereum wallet.
- Investigation
Aave Loop Safe Module exploit: 114 ETH into Railgun in 98 minutes, and a bounty offer that came four hours late
Gas from Railgun, the loot back into Railgun 98 minutes later; both drained Safes run by one key, the only two Safes that ever enabled the adapter.
- Investigation
Autheo THEO exploit: two unbacked mints, 119 million tokens, and about 292 ETH taken — not 700
A second 100M mint nobody reported; the sales produced 291.7 ETH; 400 ETH of the reported 700.8 were on the wallet a week before; 93.5M unsold THEO sent to an older wallet funded from Binance and MEXC.
- Investigation
UNCX vesting exploit: $1.08 million from BNB Chain still sits untouched, and the Ethereum attacker came back for its ZC
Updated 16 Oct: $1.49M on four chains; a Tornado-funded BNB Chain attacker parked $1.08M on an address that has never sent a tx, with UNCX offering a 10% bounty; the Ethereum attacker has taken 21.45 ETH.
- Investigation
79th Vault hack: 15,000 BNB went back, and the 1,249 BNB the attacker kept went into Tornado Cash
All 16,249 BNB accounted for: a 912 BNB top-up eight minutes before the return, 606 BNB into Tornado Cash, 645 BNB through swap-service and KuCoin deposit addresses, one branch followed to Ethereum.
- Investigation
Sinaloa Cartel sanctions: $4.4 million of the listed wallets’ money went into Binance, and three of the six are Binance deposit addresses
The six Ethereum addresses OFAC listed on 20 May 2026: $4.58M in, $4.39M into one Binance hot wallet within minutes; $989,000 withdrawn from Coinbase, swapped on Uniswap; last deposit 14 months before the listing.
- Investigation
A fake “Bitget AML check” drained 101 wallets of $233,000 — the site is still online
bitget-aml.com asks for an unlimited USDT approval and takes the whole balance. One operator, four contracts since April 2025; 45,000+ USDT into Bybit deposit addresses.
- InvestigationUpdated Oct 11, 2026
Ledger / CryptoBilis drain: two more Tornado Cash waves on 10 October, and what still sits on the thief’s wallets
After Bitquery’s snapshot: 1,340 ETH into Tornado in two waves, all 2.1M USDC passed to one service address by 11 Oct; ~15,075 ETH and 203.8 BTC still on named addresses.
- Investigation
Where the stolen crypto still sits: 17,500+ BTC and 3,190 ETH on wallets we watch
Chen Zhi, Coldcard, Liquid, Aztec, Duelbits, Neutron, Nostra, Limit Break re-read on 10 Oct: most never moved. NuNet’s 432.5 ETH left via Chainflip and THORChain; Payy’s 90,202 USDC still not frozen.
- Investigation
Triple-A hack: the stolen ether went into DAI, back into ether, and through Tornado Cash twice
5,287 ETH sold for 9.87M DAI three days after the theft, bought back in August; 1,414 ETH withdrawn from Tornado on 10 Aug went straight back in on 9 Oct. Nothing left.
- Investigation
Iranian oil money on Tron: $2.7 billion through seven wallets, $61 million frozen, and the 14 months in between
The US forfeiture case read on chain: all seven Entity A wallets found from five-character prefixes, $491M straight from Binance withdrawals, $2M to Zedcex in 2024.
- InvestigationUpdated Oct 11, 2026
Google’s AI lists a wallet drainer as the top free AML checker. We read its code and followed the money
AML.legal says “no wallet connect”, then asks for a USDT approval on hidden pages. 71 addresses approved its Tron contract; 10,069 USDT taken so far.
- Investigation
Iran’s sanctioned crypto exchangers: $483M in stablecoins, and every dollar of it went into Binance and OKX
Six addresses OFAC listed on 7 Aug 2026 behave as exchange deposit addresses: 431.0M forwarded to Binance, 51.7M to OKX, nothing left to freeze.
- Investigation
North Korea’s IT-worker money on chain: a wallet changed every fortnight, ether staked with a mainstream provider, and 96 ETH nobody can freeze
Addresses OFAC listed on 12 Mar 2026: six Tron wallets used in turn, one frozen three months before the listing, and 96 ETH still sitting on a sanctioned address.
- Investigation
Iran’s central bank on Tron: $474M frozen in two steps, and $12.6M that left in the 82 days between them
Six sanctioned wallets read in full: 85.5M USDT moved to a new wallet 8 days before the first freeze, 12.56M paid out between the two, and none of the recipients frozen.
- Investigation
Two terror-finance freezes on Tron: one caught $538,000, the other caught $28
131 ISIS-K wallets were frozen while still working; seven Hamas-linked wallets that moved 24.7M USDT were listed 16 months after they went quiet.
- Investigation
MakerDAO keeper drain: 200 ETH out of Tornado Cash’s shadow and back into it in 31 minutes
A forgotten third-party liquidation bot, an unprotected function, gas from Tornado at 05:57, 200 ETH taken at 06:13, twenty 10-ETH deposits done by 06:28.
- Investigation
Tren de Aragua on Tron: $6.08M passed through seven sanctioned wallets — every dollar went on to Binance
Seven wallets listed on 30 Sep 2026: money forwarded within minutes, a third of it from three unlisted wallets, and 20 USDT left to freeze.
- Investigation
A7A5 after the US designation: 89% of the volume is the same tokens going out and coming back
Every A7A5 transfer on Tron for three weeks: 347.7B on paper, 89% matched back-and-forth between the same wallets, about $0.7M a day in small transfers — and no change after 1 October.
- InvestigationUpdated Oct 19, 2026
Aztec exploits: the 909 ETH sat untouched for four months — on 19 October it all went into Tornado Cash
Three drains in June. The 14 June wallet held 909 ETH, 270,513 DAI and 167.89 wstETH for 127 days, then sold it all and sent 1,255.8 ETH to Tornado on 19 Oct; the 1,158 ETH from the older rollup was there by 26 Aug.
- Investigation
Bonzo Lend exploit: all 4,571 ETH went into Tornado Cash — most of it within a day
The Hedera lender lost $9M on 11 July; WBTC over LayerZero, ether relayed from Arbitrum and Base, 63 Tornado deposits by 14 July. Nothing left on the wallet.
- Investigation
September 2026 crypto hacks: $766 million taken — where the money is one week later
Twelve incidents we traced, re-read on 5 October: three ended with the money returned, three in mixers, and seven addresses still hold about $59 million.
- Investigation
Summer.fi exploit: 6 million DAI became 3,294 ETH in Tornado Cash — through the attacker’s own router, over 16 days
DAI sold through a private swap contract, ether paid to a second wallet, 56 Tornado deposits on 7–22 July. Nothing left.
- InvestigationUpdated Oct 5, 2026
Tornado Cash, July–September 2026: nine thefts we traced put 18,391 ETH into the mixer
Bonzo Lend, Summer.fi, Term Labs, Tectonic, Duelbits, Aztec, GIWA, Payy, Coldcard: how fast each reached the mixer, 6,561 ETH in three days of September, and what did not go there.
- InvestigationUpdated Oct 10, 2026
Base vault drain: $6M in wstETH, gas from Tornado Cash — and 1,000 wstETH stuck in a seven-day bridge window
Three valid Safe signatures, gas laundered through Tornado 2.5 h before, and a Lido bridge withdrawal that cannot be claimed on Ethereum until about 11 Oct.
- InvestigationUpdated Oct 5, 2026
Kelp DAO hack, six months on: 75,700 ETH became 2,105 BTC in two days — and two thirds of it went into coinjoins
857 THORChain swaps from 265 wallets, 2,104.67 BTC on 359 addresses; 69% of what could be traced ended in Wasabi and JoinMarket coinjoins, about 81 BTC at exchanges.
- Investigation
Xinbi Guarantee: $52.8M was frozen — and $146M had left the same wallets in the week before
The 52 sanctioned Tron wallets read on chain: a 53rd frozen wallet that is not on the list, $20M a day paid out until the last minute, and the same deposit hubs as in our pig-butchering study.
- InvestigationUpdated Oct 5, 2026
Nostra exploit: the $2M that reached Ethereum is still on one wallet — after a Railgun deposit came straight back
USDC swapped to DAI within minutes, WBTC sold for ETH, one 19 ETH try at Railgun bounced back; 253.47 ETH + 1.35M DAI still parked on 3 Oct.
- Investigation
Chen Zhi’s other bitcoin: the four sanctioned addresses are empty, and 15,957 BTC sits next door
OFAC listed four bitcoin addresses for the Prince Group chairman. All four were emptied eight days later into four new addresses that are not on the list — 15,957 BTC, unspent for a year.
- Investigation
Coldcard hack: where the bitcoin is now — 1,038.85 BTC still on four addresses, 649 ETH into Tornado Cash
Two months on: most of the stolen bitcoin has never moved, the one leg that reached Ethereum went into Tornado Cash, and 32.37 BTC rescued by white hats is still unclaimed.
- InvestigationUpdated Oct 2, 2026
NEAR Intents exploit: 3.87M USDT taken in seven withdrawals — and returned two days later
Returned in full on 2 Oct, with an on-chain message from the exploiter. Seven withdrawals from the HOT bridge treasury over 11 hours, swapped to BNB; ~590 BNB into one KuCoin deposit account, ~760 BNB through MetaMask Bridge.
- Investigation
Pig butchering on Tron: we followed the money from 9,993 victim reports
2,197 Tron addresses from Chainabuse reports, read on chain: shared collectors, a 92.7M USDT node, 184 exchange deposit accounts and HuionePay.
- Investigation
Meter Passport exploit: the “$2.3 million” was printed, not taken
A billion unbacked wMTRG on BNB Chain, but thin pools and a $0.0015 token: the attacker’s sales returned about $420, and 400M went into pools on failed swaps.
Archive
- Payy hack: the 682 ETH went into Tornado Cash, but 90,202 USDC is still on the exploiter’s wallet
- Duelbits hack: five chains drained into one wallet, and about 2,745 ETH now in Tornado Cash
- Fake GIWA bridge: 1,331 wallets paid in, and all 766 ETH went to Tornado Cash
- Limit Break exploit: where the 542 WETH went, and the attacker still draining wallets
- Bitget hack: the last 40,000 ETH has moved — about 35,000 ETH sent toward THORChain
- Fetch.ai, NuNet, World Mobile: what the attacker sold, and the 433 ETH and 200 million WMTX he still holds
- Neutron: two wallets cast 98% of the votes that handed Astroport and Drop to their attacker
- The $7.8 million the Yoink bot took from a hacker went back to the Safe’s owner
- FomoPeek: the App Store app that read wallet keys off the phone
- Nesa: the "$50 million" exploit that cashed out at about 109 ETH, into KuCoin
- Nomic and Osmosis allBTC: the 40.65 BTC nobody noticed for 74 days
- Tectonic: the branch that skipped Tornado — 232 XMR1 still sitting on Hyperliquid
- Term Labs: all of the stolen ETH went to Tornado Cash, and the DAI went to Robinhood Chain
- Finiko’s FNK token: the $14 million taken from its pool two years after the collapse
- Finiko: what the chain says, and why the published totals conflict
- Liquid Network hack: the 598.5 BTC has not moved
- Where Amir Capital’s money went: a four-chain trace