Crypto Tracking by @BlockSecTeam / Monitor Movements / Track Crime / DYOR / TG: t.me/MetaSleuthTeam / 🚀 NEW: Try Phalcon Compliance FREE @Phalcon_xyz
- Tweets 956
- Following 122
- Followers 34,608
- Likes 777
Party time! Celebrate @TrustblockHQ 1.0 release with MetaSleuth on @Galxe! ❤️
Complete the MetaSleuth Mission & win your share of $15,000+ in prizes! Get MetaSleuth Voucher and start your crypto investigation journey right now.🛫
👉galxe.com/Trustblock/campaig…
#web3 #giveaway #TrustblockParty #web3security
5
201
207
3,217
Inferno Drainer quietly changed its core phishing accounts.
Our monitoring system has detected that Infereno Drainer's core phishing accounts, namely Fake_Phishing76183 (0xFB4d3EB37bDe8FA4B52c60AAbE55B3Cd9908EC73) and Fake_Phishing179817 (0x00008F1149168C1D2fa1eBa1Ad3e9cD644510000), are no longer engaged in phishing activities.
Fake_Phishing76183, which previously enticed victims to authorize their tokens and transfer them, has been substituted with Fake_Phishing00001f (0x00001f78189bE22C3498cFF1B8e02272C3220000).
Fake_Phishing179817, the phishing contract that swindled victims' ETH, has been substituted with Fake_Phishing00003d (0x00003d1cEf5F30E34510198cB045E4ae0aa20000).
Phishing funds in Fake_Phishing179817 have been transferred to Fake_Phishing00003d.
Check the fund flow: metasleuth.io/result/eth/0x4…
1
4
30
3,634
🚨 The wait is over! MetaSleuth's official launch（metasleuth.io/）is here to redefine your crypto tracking experience.
📹 piped.video/F69o4XXO_cM
WHAT NEW?
1.Superior Stability: MetaSleuth now offers significant improvements in stability and stunning visual design for an immersive experience.
2.Customized Investigation Services: Select from MetaSleuth's subscription plans for advanced features and premium services.
3.Open API Services: Integrate our top compliance scoring and address labeling API for seamless product enhancement.
Embrace the new era of crypto investigation with new features. MetaSleuth has officially unleashed its full power!💥
#MetSleuth #Blockchain #Crypto #investigation #tracking #CryptoRevolution
8
52
100
16,887
AzukiDao's governance token contract (bean) @_AzukiDAO has been exploited due to a contract vulnerability. So far, two attackers were able to exploit the vulnerability and made a profit of 35 ETH.
Thanks to a community member for providing a source of information
11
22
111
78,173
. @SushiSwap RouteProcessor2 was attacked, and sifuvision.eth @0xSifu lost 1800 ETH due to this. We tracked the stolen funds and presented them as follows.
The first attacker (0x9deff) has returned 90 ETH (of 100 stolen). BlockSec rescued 100 ETH and will return it shortly. The negotiation between sifuvision.eth and c0ffeebabe.eth is underway. And the majority of stolen funds went to beaverbuild @beaverbuild, rsync-builder, and Lido: Execution Layer Rewards Vault @LidoFinance.
We knew that @SushiSwap RouteProcessor2 was attacked. We evaluated possible damages in the past few hours and made this public only after we think it's safe : users' assets are always our first priority.
Btw: we rescued part of them and will release the details later.
6
32
96
63,958
🎉 Exciting news!
MetaSleuth has expanded its capabilities to support #SOLANA! 🌟
Discover more about our latest integration: 🔗metasleuth.io/blog/best-sola…
Our advanced analytics tools are ready for you to dive into transaction insights. 🕵️♂️💼
Don't hesitate and give it a try!
#MetaSleuth #Solana #DeFi #Crypto #Blockchain
8
13
79
21,686
🧐After the zero transfer scam, we first find a new similar phishing method that is rampant nowadays!! Here is the summary: 👇
1. After monitoring a user initiates a large transfer to a certain address (usually above $10,000), the scammer will forge an address that is extremely similar to the previous transfer target.
2. The scammer then sends a nominal amount, usually less than $0.1, to the user's account from this forged fake address.
3. And if the user mistakenly believed that this small deposit came from the original transfer address and copied it. Oooooooop!!!! They fall for the phishing trap and transfer their money to the scammer.
This is a new type of phishing, similar to the previous "zero-transfer" scam. Stay vigilant and do not readily copy the address of a small deposit without verifying its authenticity.
6
22
77
49,247
.@KyberSwap has been exploited on 6 chains by 3 different attackers.
The top earner 0x5027 made around $46M, utilizing funds initially sourced from @TornadoCash on ETH. 0x5027 then leveraged bridges and @fixedfloat to transfer funds to other chains for launching the attack.
Currently, the majority of profits are still held in address 0xc9b8 across the 6 chains. Notably, 500 WETH has been transferred to address 0x98d6 on Arbitrum, followed by bridging 300 WETH to the same address on ETH.
Check the link for detail: metasleuth.io/result/eth/0x5…
.@KyberSwap was exploited due to tick manipulation and double liquidity counting.
In summary, the attackers borrowed a flash loan and drained the pools with low liquidity. By executing swaps and altering positions, they manipulated the current prices and ticks of the victimized pools. Ultimately, the attacker triggered multiple swap steps and cross tick operations, resulting in double liquidity counting and consequently draining the pools.
5
18
74
30,692
📢 Attention all blockchain sleuths! 🔍
Exciting news: MetaSleuth's fund flow visualization tool has undergone a major upgrade! 💡
Try it out now and let us know what you think!
#productupdate #MetaSleuth #blockchain #dataviz
6
6
55
13,926
A victim got phished for 2.6M a few hours ago.
The victim's wallet had previously been drained multiple times after approving USDT transfers to a phishing address.
metasleuth.io/report?report_…
16
6
51
28,474
🧐Ooooop!! Recently, we have first discovered a new scam method again, which cleverly combines the features of fake token and zero transfer. We use BoShen Hacker as an example to explain this kind of phishing method. Here is the summary: 👇
7
24
59
20,836
The root cause of
@BeanstalkFarms
exploitation is that the emergencyCommit() requirement bipVotePercent is based on balance, which makes it very likely to be exploited by flashloan.
3
7
58
Based on the analysis of the fund flow in the Atomic wallet hack incident, we found the fund flow follows a pattern, involving four types of addresses.
1. The victim: The victim's valuable assets were almost completely drained.
2. The direct drainer: The stolen assets were directly transferred to this address, which is also responsible for swapping the assets for native tokens.
3. The keeper: This address currently holds the stolen assets. It received the assets from the direct drainer.
4. The gas fee provider: This address provided native assets to the victim or the direct drainer in case they did not have enough ones for the transaction fee. The source of the funds may also come from the victim, but further investigation is needed.
In addition, both the direct drainer and the keeper are new addresses that have been active for approximately 30 hours.
Special thanks to @zachxbt and @tayvano_ for providing the data.
metasleuth.io/result/eth/0x4…
6
16
57
20,027
KP3R was attacked, and the attacker managed to harvest approximately 4,084 $KP3R, worth around $200,000 USD. The attacker obtained their initial funds from @TornadoCash and had extensive interactions with @binance exchange. Notably, the attacker exploited a privileged vanity address to modify the governor of several pools, which allowed them to successfully carry out the attack.
Check the details: metasleuth.io/result/eth/0x4…
.@thekeep3r has been attacked. Due to the governor's private key being compromised (Vanity Address), the attacker reset the governor of several pools and launched a reentrancy attack, profiting 4084 KP3P (~ $200K).
3
11
56
35,106
Euler Finance @eulerfinance is being attacked. It seems the attack continues and the total loss exceeds 190 million USD already. Will update the details later.
Check the first attack tx:
metasleuth.io/result/eth/0x5…
Our system monitored that @eulerfinance is being attacked. Please take action!
phalcon.blocksec.com/tx/eth/…
4
17
51
58,120
🎉 MetaSleuth Superteam Earn Bounty has officially concluded! We received an incredible 149 submissions from talented participants.
We were truly impressed by everyone’s creativity, dedication, and deep understanding of our product. We hope MetaSleuth can help everyone DYOR and become on-chain detectives. 🕵️
After careful evaluation by our team, here are the winners:
🏆 Thread Winners:
1️⃣ @0xSese
2️⃣ @Algy_Web3
3️⃣ @Oluwaphilemon1
4️⃣ @0xTEJIRI
5️⃣ @nuel_defi_sage
🎥 Video Winners:
1️⃣ @OhJay_01
2️⃣ @shadowcrypto7
3️⃣ @streamquentin
4️⃣ @emzzil
5️⃣ @justfreaqy
Each winner will receive their respective rewards shortly. Thank you to everyone who participated, and we look forward to your continued support of MetaSleuth!
Special thanks to @superteam and @SuperteamEarn for partnering with us on this exciting initiative!
24
7
35
5,627
PolyNetwork was attacked, involving multiple chains. On Ethereum alone, the attacker withdrew over 40 tokens from the unlock proxy, with most of them being swapped for ETH. Currently, over $4.2 million has been transferred to other attacker addresses.
metasleuth.io/result/eth/0xe…
1
7
47
13,986
Euler Finance Exploiter 2 returned 3000 ETH to Euler: Deployer just now.
Congratulations to all and hope 90% can be fully returned soon.
1
6
49
31,430
ALERT
@CertiK Twitter has been compromised and pinned a phishing website.
DO NOT CLICK!!!!
4
21
46
7,673
⚠️Fake_Phishing76089 grabbed more than $660k $USDC from two victims just now. And the phisher keeps transfering asset from victims.
👀Please revoke the approvals if you have approved to the Fake_Phishing76089. @MetaDockTeam MetaDock's Approval Diagnosis can help!
metasleuth.io/result/eth/0x4…
#PhishingAlert
6
10
45
95,575
Damn, these phishing people are really genius.🧐 We find Pink-drainer used a new phishing scam to drain users' NFT assets.
7
13
37
13,585
🚀🚀MetaSleuth, the ultimate crypto asset tracking tool by @BlockSecTeam is now live in beta!🚀🚀
Track your assets like a pro and visualize the analysis process with our amazing fund flow map, supporting 9 blockchains, and all functions are free for beta version🆓, Try it now!
4
12
37
11,901
. @iearnfinance was hacked and the loss is around 11.4 million USD. The exploiter is actively converting the profits into stablecoins and has already laundered 1000 Ether into @TornadoCash .
docs.google.com/spreadsheets…
metasleuth.io/result/eth/0x8…
1/ @iearnfinance was hacked with two consecutive attack transactions. The root cause is due to an (on-purpose?) misconfiguration which makes the rebalance of the pools rely on an incorrect underlying token. This misconfiguration has been there for more than three years.
3
18
36
24,533
Introducing MetaSleuth Monitor - a powerful new feature for your Sleuth journey. 🔍
Now you can not only analyze addresses to track funds, but also add them to your monitor list for real-time tracking of fund movements.🚨
5
8
39
7,285
The South Korean exchange #GDAC announced that its hot wallet was hacked on April 8 (UTC), and the value of lost assets were ~13M USD.
On Ethereum, the hacker swapped all 220k $USDT for Ether and laundered all 461 Ether into @TornadoCash.
On WEMIX, after stealing 10M $WEMIX, the hacker (0x5719) successively bridged funds to Ethereum. The addresses Hacker 4 (0x5719) and Hacker 5 (0x6225) received the bridged funds.
See more detail in 👇metasleuth.io/result/eth/0x8…
3
6
23
7,438
More than 120M assets were transferred from Multichain: Fantom Bridge and Multichain: Moonriver Bridge and are now distributed across 6 addresses. Additionally, 1.2M ICE (currently worth $1.8M) has been burned from address 0x9d57.
See detail in:
metasleuth.io/result/eth/0xC…
The lockup assets on the Multichain MPC address have been moved to an unknown address abnormally.
The team is not sure what happened and is currently investigating.
It is recommended that all users suspend the use of Multichain services and revoke all contract approvals related to Multichain.
2
6
39
14,855
Thrilled to announce our latest partnership with @Bitquery_io ! 🎉
Through this collaboration, MetaSleuth will integrate Bitquery's powerful blockchain data services to enhance our tracking and analytical capabilities, ensuring more stable and accurate data for our users. 💡
Stay tuned for more exciting updates and features! 🙌
10
12
38
4,426
As reported by @CoinDesk , several Eigen Labs employee wallet addresses received notable token allocations from EigenLayer Ecosystem projects:
metasleuth.io/result/eth/0xb…
🔸46,512 $ALT / address
🔸10,490 $ETHFI / address
🔸66,617 $REZ / address
Want to dive deeper?🕵️
MetaSleuth is your go-to tool for uncovering the full story!💡
4
10
32
3,053
Demystifying Profit Sharing in #InfernoDrainer
Scam-as-a-service (SaaS) has emerged. The service provider supplies collaborators with the phishing toolkit and requires a percentage, typically 20% or 30%, of their earnings in return.
See the story:
blocksecteam.medium.com/demy…
5
6
30
7,903
Metaslueth always stands with the community users.
Recently, we launched an automated phishing alert function. We will send the victim an on-chain warning message and attach a detailed report in the first instance. We hope our system can help phish victims.
👇
poap.eth fell into approval phishing and lost nearly $3 million yesterday. We immediately sent an alert to help him. After one minute, we noticed that poap.eth revoked his approval, avoiding further losses.
4
6
33
12,154
~20 hours ago, we found a new phishing address 0x345e3...71aab trying to call the permit() function to steal vitalik.eth @VitalikButerin assets.
6
7
33
5,774
Remember the $10,000,000 scammer？
Recently, our phishing detection system (github.com/blocksecteam/web3…) has identified 270 phishing websites associated with 0x1661F1 (Fake_Phishing66321). 🧐Our system shows the scammer is very skilled at using fake pages to lure victims to approve their tokens.
Upon analyzing the fund flow of Fake_Phishing66321, we have discovered that it transferred 870 ETH to 0xDFFBF7, and 806.5 ETH has been deposited into @SimpleSwap_io . Seems the bad guy loves SimpleSwap.
metasleuth.io/result/eth/0xc…
🧐The danger of blockchain phishing is beyond imaginable! Even senior industry insiders feel unbelievable.
Metasleuth found that a phishing address (0x1661f1) participated in multiple large-scale frauds, with profits exceeding $10,000,000!
7
7
28
13,699
Shido on BSC was exploited, resulting in the attacker profiting 977 WBNB (worth approximately $242,000). The attacker swapped most of the profits for ETH and bridged them to Ethereum via cBridge, where they laundered the funds using TornadoCash. It's worth noting that the attacker also deposited 1 BNB into TC on BSC, which suggests that they may continue to operate on BSC in the future.
Check the details: metasleuth.io/result/bsc/0x6…
1/ @shidonetwork on BSC was exploited through a flash loan, taking advantage of the lock and claim mechanism, as well as the price difference between the two pools. Consequently, the attacker managed to steal 977 WBNB from the pool.
1
12
28
15,551
#MetaSleuthTips Crypto Tracking: Starting with a Transaction - pt1
1/8 In this tutorial, we'll explore MetaSleuth's basic features for tracking stolen funds. Learn how to analyze transactions, track specific funds, and monitor untransferred funds. Our focus is on a phishing tx.
2
5
26
7,549
The bybit @Bybit_Official hacker is dispersing the Ether across multiple addresses.
metasleuth.io/result/eth/0x4…
1
18
2,611
The phishing contracts used by Inferno Drainer have recently undergone an upgrade. These phishing contracts now possess the ability to steal users' ETH, ERC20 tokens, and NFTs.
Let's consider phishing contract 0x000056 as an example. The claim function is specifically designed to pilfer users' ETH, which is then transferred to a central hub contract with the address 0x0000da. This hub contract serves as a collection point for stolen ETH from various phishing contracts. Consequently, a phisher such as 0x000055 (Fake_Phishing182232) can invoke the withdraw function of the hub contract to facilitate the transfer of the stolen funds.
Simultaneously, the multicall function of the phishing contract is employed to transfer users' approved ERC20 tokens and NFTs, incorporating a built-in profit-sharing mechanism.
We have promptly reported all associated contracts to Etherscan. Please exercise caution and remain vigilant.
Check the fund flow:
metasleuth.io/result/eth/0x5…
metasleuth.io/result/eth/0xc…
metasleuth.io/result/eth/0xa…
3
10
27
12,877
⚡️Bounty: Create Content to win amazing rewards with MetaSleuth!
🔶 Write a Thread
🔶 Create a Video
MetaSleuth's bounty campaign is ending Next Friday! Don't miss your chance to participate and win via @SuperteamEarn
Check the link for Tips & Tricks on how to win
earn.superteam.fun/listings/…
12
4
18
3,105
Address 0x0e7a6 has been scammed for 494.71 Ether, with 25% flowing into the scam contract creator's address and 75% flowing into the phisher's address. This distribution method is fixed and written in the contract. From the flow of funds, it appears that several known phishers have previously used this contract.
Track the funds through the following report: metasleuth.io/report?report_…
1
7
27
5,350
We found a scammer
👉pink-drainer.eth,
who has stolen the victim's NFTs (including BoredApeYachtClub#5497, MutantApeYachtClub#23444) and profit of 156.11ETH.
After analysis by metasleuth🧐, we found that pink-drainer.eth has a relationship with the previously mentioned phishing address (Fake_Phishing66321). Note that this phishing address has caused over 10,000,000 $ loss.🧐Fake_Phishing66321 stoles NFTs from victims using zero-buy scams. The only exception is that it purchased 6 Fighter NFTs from the scammer at a premium of 6 ETH, while the floor price was only 0.009 ETH. It is clear. They are a gang.Stay vigilant!! Never approve your assets to an unknown address😢.
2
5
23
4,496
.@SturdyFinance was attacked and the loss is ~442 ETH. The attacker obtained the initial funding from @TornadoCash. Most of the profits were laundered into Tornado Cash, and a small portion flowed into the @ChangeNOW_io exchange.
Check the details: metasleuth.io/result/eth/0x1…
7
25
4,724
Pawnfi was attacked, and the attacker made a profit of around $820,000. The attacker obtained initial funds from TornadoCash, and so far, 200 Ether has been laundered into TornadoCash, while the remaining 267 Ether was transferred to the address 0xcd12 (which has been labeled as Pawnfi Exploiter 2). It's unfortunate that the 1 BAYC, 6 MAYC, and 2 BAKC that were stolen were quickly and successfully traded on Blur.
Check the details: metasleuth.io/result/eth/0x8…
1/ @Pawnfi was attacked in a furry of transactions (e.g., explorer.phalcon.xyz/tx/eth/…) The root cause for the attack is that the protocol failed to verify whether the NFT had actually been transferred when users used a specified NFT as collateral for borrowing.
4
6
24
7,577
Platypus was attacked and there is a possibility of two attackers. Exploiter 0xc64a gained a profit of around 51K USDC through approximately 100 transactions. Several tens of minutes after the first profitable transaction by 0xc64a, Exploiter 0x853d created the same contract and used the same method to gain a profit of around 94K USDC. Currently, the profits from the attack are still held in these two addresses.
Exploiter 0xc64a: metasleuth.io/result/avalanc…
Exploiter 0x853d: metasleuth.io/result/avalanc…
1
6
23
3,514
After a period of 17 days, #InfernoDrainer has once again changed its phishing operator and contract addresses.
The drainer phishing operator, responsible for transferring victims’ ERC20 tokens and NFTs, has been changed from 0x00001f to 0x000055.
The drainer phishing contract, which employs a deceptive 'claim' function to acquire victims' ETH, has been changed from 0x00003d to 0x000011.
We urge users to exercise caution and diligently review transaction details before approving any actions.
Check the fund flow: metasleuth.io/result/eth/0x7…
8
21
5,660
Bo Shen's stolen funds are being transferred.
BoShen Hacker 4 (0X376a0) is actively moving $ETH to 0xe8bb1 and swapping for USDT. Already 1.3M $USDT has been deposited into the @WhiteBit exchange.
BoShen Hacker 5 (0X4ac9c) transferred 557K $LQTY to 0x1d43f and swapped for 612 ETH. The 612 ETH remains in 0x1d43f for the moment.
metasleuth.io/result/eth/0x3…
3
6
19
18,762
Update: The Euler Finance Attacker refunded 58737.25 Ether just now. A total of 61737.25 Ether are returned till now.
The other Ether and DAI are spread to the other four addresses.
Check the details: metasleuth.io/result/eth/0xb…
Euler Finance Exploiter 2 returned 3000 ETH to Euler: Deployer just now.
Congratulations to all and hope 90% can be fully returned soon.
2
5
20
14,852
We are excited to announce our partnership with @Intell_On_Chain .
This collaboration aims to elevate blockchain security to the next level, ensuring a safer future for Web 3.0.
📣 HUGE NEWS 📣
@BlockSecTeam partners with @Intell_On_Chain
In the rapidly evolving landscape of #BlockchainTechnology, security remains a paramount concern. As the adoption of #Web3 continues to grow, the need for robust security measures becomes more pressing.
To address this, @BlockSecTeam who conduct cutting-edge research, provide reliable security services and build insightful tools, has formally agreed to partner with @Intell_On_Chain 's (IOC) brand new suite of services called '#AЯMRD.'
IOC have positioned @ARMRD_IOC to become the Ultimate Web 3.0 Help desk, by offering a whole suite of services to new and existing crypto projects, that provide end to end security.
The collaboration between BlockSec, IOC, and AЯMRD marks a significant stride towards fortifying the foundations of decentralised applications. By leveraging cutting-edge tools and high-quality auditing services, the partnership is poised to set new standards for security in the blockchain space, ensuring a safer and more secure future for Web 3.0.
You can read more about this partnership on the AЯMRD or IOC websites
Go to AЯMRD: armrd.io
Go to IOC: intelligenceonchain.com
Follow all these accounts:
➡️ @MetaSleuth
➡️ @Phalcon_xyz
➡️ @MetaDockTeam
➡️ @Intell_On_Chain
➡️ @ARMRD_IOC
3
8
22
1,890
Not sure whether this is a private key leakage without further information. Currently, funds have been swapped to Ether and distributed to four addresses (blue color).
metasleuth.io/result/eth/0x3…
🚨ALERT🚨Our AI-powered system has detected multiple suspicious transactions with @Stake.
etherscan.io/address/0x31306… address received about $16M in $ETH $USDC $USDT and $DAI
All the stable coins are converted to $ETH and distributed to different EOAs.
FYI: @tayvano_ @zachxbt
3
4
24
11,974
1/ Well, this isn't just a one-off event! MetaSleuth, our trusty web3 detective, has revealed that this is actually part of a series of highly suspicious rug pull projects, sharing a similar backdoor code logic.
metasleuth.io/result/arbitru…
ALERT! Our system detected a suspicious $SAMO token on Arbitrum
(0x37226b0285d2017c0aa585c61cdca2c78ee900e0) that is used in a UniswapV2 pair (0x4c39580382bb9ebd3d28d4f8d9d433eca74103ec).
Stay vigilant and do NOT engage with this pair/token!
2
5
23
5,087
Swaprum on Arbitrum rug pulled!
The deployer transferred all funds to ETH via @MultichainOrg , @AcrossProtocol , and @CelerNetwork , resulting in 1620 Ether being laundered into @TornadoCash.
Additionally, the deployer interacted with @Bybit_Official on both ARB and ETH.
metasleuth.io/result/eth/0xa…
4
10
23
6,738
AnubisDAO Exploiter has just deposited 3000 ETH into @TornadoCash .
metasleuth.io/result/eth/0x0…
5
6
16
9,049
We've just released a detailed analysis of the @lifiprotocol LiFi Attack, where a vulnerability in the GasZipFacet contract resulted in significant losses.
👉 Check out the full report here: metasleuth.io/blog/illicit-f…
📊 Explore the MetaSleuth Chart here: metasleuth.io/result/eth/0x1…
🔍 We used #MetaSleuth to trace the stolen funds and reveal the full impact of the exploit.
🕵️ Simplify and enhance your on-chain investigations with #MetaSleuth
10
20
4,907
Revoke any allowances to #Atlantis contracts!
Due to the execution of a malicious governance proposal, the implementation contracts of Atlantis Tokens and Unitroller were replaced with the contract 0x613cc5, which was created 3 hours ago. This resulted in user assets that had been approved to Atlantis contracts being transferred to address 0xeade07. In addition to the $ATL tokens siphoned from the Atlantis contracts by 0xeade07, a total of nearly $1 million in assets have flowed into 0xeade07 (some of which have already been transferred to address 0xd8e918).
Check the details: metasleuth.io/result/bsc/0xE…
1
7
16
5,437
Feature Tip ✍️
When an address participates in too numerous transactions, the analyzed result may only contain partial data. For such addresses, we mark them with a symbol to inform users.
In this case, if the analyzed result lack of the address/transaction data users cared about, users can manually add the corresponding address/transaction to the graph through the 'Add Address/Tx' function.
As the most active phishing address recently, Fake_Phishing66321 involves numerous transactions. And the analyzed result does not contain a phishing transaction with 50 WBTC. After manually entering the corresponding transaction hash, the transfer shows.
Try the 'Add Address/Tx' function to create a more complete fund flow graph!
1
4
21
2,345
Join the high-risk asset hunting tasks hosted by Secwarex!
Use MetaSleuth to DYOR before investing and say goodbye to fake token scams.👋🏻
🔗 secwarex.io/task-detail/85
6
15
3,704
At MetaSleuth, community safety is our top priority. Thanks for the positive feedback on our Phishing Alert System.
Remember to stay vigilant and protect yourself from phishing attacks by being cautious in all of your online actions. Together, we can keep each other safe!
Remember that 💩happens.eth guy that lost 400k in assets a couple days ago to a drainer?
Looks like he lost his new ape, again, since he didn't remove the drainer's access to the proxy that was used for the drain.
h/t @MetaSleuth - automated onchain reports are a good feature
2
1
18
3,682
1/ Our team has discovered a Quaternion exploit. Investigation reveals initial funding from address 0x3bc83b0a2e764447a676271ac380d766bb4fc71b, which can be traced back to Tornado.Cash. With MetaSleuth, you can easily discover it. metasleuth.io/result/eth/0x3…
1
3
19
5,074
🎉Exciting news! MetaSleuth just updated with the Advanced Analyze Feature, allowing you to:
· Set a Date Range 📅
· Choose the direction 🧭
before analyzing.
Give it a try today!
1
4
19
5,292
🚨 Just analyzed a suspicious $238M transfer of 4064 BTC flagged by @zachxbt
metasleuth.io/result/btc/4b2……
🕵️Our findings as of the anaysis time:
🔸The majority of BTC (approximately 3686 BTC) is held in six addresses (marked in orange in MetaSleuth canva)
🔸A small amount of BTC has flowed into services such as eXch, FixedFloat, ChangeNOW, KuCoin, Gate, and others
🔸65 BTC bridged to Avalanche, swapped to WETH, bridged to Ehereum, then laundered via TornadoCash
Additionally, while @RAILGUN_Project mentioned refunding BTC (unshielded back to the original address) under ZachXBT's tweet, the initial funding for address 0x5395 on ETH still originates from Railgun.
Follow us for the latest updates on this case!
4
2
18
3,858
🎉 Exciting news! 🚀MetaSleuth now offers ENS domain name resolution. 🔎
Analyzing the corresponding address of an ENS domain name is now as easy as entering it in our search bar. 🙌
Try it today and see how convenient and efficient our ENS domain name resolution feature is.
#MetaSleuth #blockchain #fundtracking #ENS #cryptocurrency
4
2
19
3,333
PolyNetwork attack update. In Ethereum, we have identified three new attacker addresses that have profited 2.6 million USDT, 3.5 million COW, and 3 million USDC respectively. All USDC and USDT have been swapped for 2929 Ether (currently worth ~$5.7M) and transferred to the addresses 0x3d66 and 0x2f6c. metasleuth.io/result/eth/0x2…
PolyNetwork attack update. We have now completed the profit statistics of the attacker on ETH and BSC. The profit on ETH is approximately $5.3 million, of which $4.3 million exists in the form of ETH. The profit on BSC is approximately $232 million based on the price at the time of transfer, but the majority of it has not been swapped yet. There should not exist enough liquidity in dex pools, so the real profit should be much smaller. Please refer to the table for detailed profit data. docs.google.com/spreadsheets…
3
5
16
5,484
PolyNetwork attack update. We have now completed the profit statistics of the attacker on ETH and BSC. The profit on ETH is approximately $5.3 million, of which $4.3 million exists in the form of ETH. The profit on BSC is approximately $232 million based on the price at the time of transfer, but the majority of it has not been swapped yet. There should not exist enough liquidity in dex pools, so the real profit should be much smaller. Please refer to the table for detailed profit data. docs.google.com/spreadsheets…
PolyNetwork was attacked, involving multiple chains. On Ethereum alone, the attacker withdrew over 40 tokens from the unlock proxy, with most of them being swapped for ETH. Currently, over $4.2 million has been transferred to other attacker addresses.
metasleuth.io/result/eth/0xe…
5
16
19,152
#MetaSleuthTips
Great news! 🚀
We've raised the limit for batch imports to support up to 30 transactions per import. Say goodbye to import restrictions and hello to faster data processing! 💪
1
2
20
1,160
New chain added - TRON! MetaSleuth now supports the TRON blockchain! 🌐
Explore and visualize the fund flow of TRON with ease and gain unprecedented insights.
Try it out now! 🔍📊
#MetaSleuth #TRON #blockchain #fundflow
3
3
17
2,169
Drainers are using various methods to perform phishing hacks, including hacking social media, websites, and others.
Be cautious when clicking the links!
See our full story:
blocksec.com/blog/demystifyi…
5
10
19
3,910
Rodeo_Finance on Arbitrum was attacked again. The attacker profited around 480 ETH (approximately $896K). The profits were cross-chain transferred to the same address on Ethereum, with 150 Ether laundered into TC and the remainder yet to be transferred.
metasleuth.io/result/arbitru…
The attacker of Rodeo gained a total profit of 89601 USDC.e, which was later exchanged for 46.11 ETH.
-> Interestingly, the deployer of the Rodeo contract and the attacker's address are very similar, with the first five letters being exactly the same.
1
3
14
3,460
1/ The profit of @BonqDAO attacker is around 98.6M BEUR 113M WALBT. Specifically, 113M WALBT was burned to unlock 113M ALBT. ~0.5M BEUR was swapped to 534,535 USDC and t to Ethereum (0xcacf…6642). 98.1M BEUR was still on the attacker’s account on Polygon
metasleuth.io/result/polygon…
2
4
16
15,690
The main reason for the exploit is that the signatureClaimed variable in the contract was not properly checked, which allowed for replay attacks. Now, the contract is paused.
1
16
6,245
🚨 $MBAPPE Token Incident 🚨
metasleuth.io/result/solana/…
Token Address: 9urVxmVzVoh5DNER3hyQm4s7sCixdRpNE1HNR6ezpump
🔍 A quick look into a series of rapid trades and arbitrage activities on the Solana blockchain, triggered by the $MBAPPE token that was launched from a hacked account of football star @KMbappe
💥 Address 1: AuzmvPCU2nWnJKUSqtu9qMvFjhfqysiq4gUay96cazNY
⏰ 2024-08-29 01:02 (UTC): Swapped 85.01 SOL for 793,100,000 $MBAPPE via Pump.fun
⏰ 2024-08-29 01:10 (UTC): Swapped 793,100,000 $MBAPPE for 603.08 wSOL via Raydium
💰Profit: Earned 518.07 SOL in just 8 minutes
💥 Related Address 2: EW9eYQ7ptNK3gQbzxKxgvuYYojyHhzDNrxcvZZGKnv3v
⏰ 2024-08-29 01:08:03 (UTC): Swapped 7,156.66 wSOL for 93,092,915.82 $MBAPPE via Raydium
⚠️ Sandwich Attack Exposed!
💥 Attacker Address 3: BhBigMUkEqwuQAEmYyNpL6jP4sR7DG6umAKtAc8ittiC
🥷 Action: Detected Address 2's impending large purchase, preemptively swapped 2 wSOL for 1,117,995.51 $MBAPPE via Raydium.
⏰ Timestamp: 2024-08-29 01:08:02 (UTC): Just 1 second before Address 2’s transaction!
💸 Result: After Address 2’s buy, Address 3 quickly sold all $MBAPPE, swapping it for 1,491.07 wSOL, profiting 1,489.07 wSOL.
💔 Outcome: The pool was swiftly drained, leaving Address 2 as the top holder of 93,092,915.82 $MBAPPE, but those tokens are now almost worthless.
Become on-chain detective with MetaSleuth🕵️🕵️
1
2
17
2,110
Scammers are abusing legitimate smart contracts to perform phishing attacks.
See our full story:
metasleuth.io/blog/demystify…
7
18
3,341
Crypto Leaks investigation found that the Avalanche Bridge received over $279M from malicious sources.
Use MetaSleuth to track the flow and uncover new findings.🧐
From ChipMixer[.]com to Avalanche Bridge: metasleuth.io/result/btc/3a2…
From Mixers to Avalanche Bridge: metasleuth.io/result/btc/1Dc…
metasleuth.io/result/btc/bc1…
#crypto #investigation #funds #metasleuth
CL Case #6 potentially has serious implications for Avalanche Bridge depositors. We invite other specialists to corroborate our blockchain analysis work with urgency...
@chainalysis @elliptic @samczsun @Coffeezilla @FatManTerra @Bitfinexed
cryptoleaks.info/case-no-6
3
15
3,064
Track funds in a single direction with MetaSleuth! 🚀
Click the plus icon by the address nodes to see only incoming or outgoing funds. 🔍
Stay tuned for more updates! 🌐
#MetaSleuth #Blockchain #NewFeature
2
2
16
3,955
🔔 Be Cautious!
metasleuth.io/result/btc/bc1…
Address poisoning is a tactic being used on #Bitcoin
Here’s a simple example:
🔸Phishing Address:
bc1q7jywd9nfjg36skxt4lc0twvgzc3rkjj6lyfjwm
🔸Legitimate Address:
bc1q7jgulg69frc8zuzy0ng8d5208kae7t0twyfjwm
🔸Target Address:
bc1q6c3c0t3zvnphce37ufr4yz9veaqvew2wg0shwr
How It Works:
The phishing address pretends to be the legitimate address and sends a small amount of BTC (0.000006 BTC) to the target address. Since the legitimate address has a history of transactions, the attacker hopes the owner will mistakenly copy the phishing address instead.
🔒 Stay safe and verify before you send!
🕵️ Become on-chain detective with #MetaSleuth!
4
5
14
4,975
Fake Uniswap scammer addresses have been flagged and can be viewed through the MetaDock plugin. Furthermore, it appears that the scammers have laundered some of their scam proceeds into the exchange. @binance @gate_io @MEXC_Global
Check the fund flow: metasleuth.io/result/eth/0x9…
1
3
12
4,402
If you guys are curious about the refund status of the Euler hack event, ~84% of stolen funds have been returned till now.
Check the details: metasleuth.io/result/eth/0xa…
The Euler Finance Exploiter refunded again. Till now, ~76% of the total loss have be refunded to Euler.
👇
metasleuth.io/result/eth/0x0…
3
16
5,512
A continuous rug pull. When you trace it back to the past, it seems to have no end. And when you look to the future, it appears to keep happening.
metasleuth.io/result/bsc/0xd…
🚨 Someone is testing some 'Rugpull' token on BSC. These tokens appear to be popularly bought, but in reality, they are being manipulated by fraudsters using bots. The real buyer and so the loser is essentially just only you.
explorer.phalcon.xyz/tx/bsc/…
explorer.phalcon.xyz/tx/bsc/…
1
3
13
2,545
Know more, and act with greater caution.
This phishing attack is a type of Fake-token Attack, which is part of Address Poisoning. We previously introduced three types of Address Poisoning, including Fake-token, Zero-value, and Dust-transfer attacks. It's important for all users to be aware of these attacks.
piped.video/watch?v=zo9oTLpR…
I want to share this (luckily) unsuccessful, but very clever and close scam incident from yesterday 👇. Saved $20m. Hope it may also save you one day.
The scammers are so good now they generate addresses with the same starting and ending letters, which is what most people check for when doing a crypto transfer. In fact, many wallets hide the middle part of the address with "..." to make the UI look better.
The scammer then use this address to send you dust transactions so that the address is shown in your wallet. Now, if you want to send to the legitimate address, you might just pick one previous transactions in your wallet and copy the address. You might just copy the wrong one. This is what happened yesterday, to a very experienced crypto operator.
Positive ending for this one. The operator noticed the error right after the transaction, and we were able to request the USDT to be frozen in time. It will now take some process, including filing a police report, to reclaim the funds back. But at least, the funds won't leave with the scammers.
Fast reaction is key in these types of recovery.
Hope this will help you avoid these one day. Stay #SAFU! 🙏
5
16
7,497
Get ready to sleuth on TRON with MetaSleuth!
We're thrilled to announce that TRON support is coming soon.
Stay tuned!
#MetaSleuth #TRON
2
2
14
1,512
🚀MetaSleuth supports multi-chain analysis, and we have parsed some cross-chain transactions on third-party bridges on 7 EVM-compatible chains. The supported cross-chain bridges include Across, Multichain, Celer, Hop, Ren, Stargate, Synapse, and Wormhole.
#CrossChain #Bridge
2
2
13
1,726
MetaSleuth just launched a powerful new feature: Custom Watermark! 🎉
It's the best way to showcase your analysis result and protect your intellectual property.
2
3
14
2,287
Want to know the trending Memes and smart money on Solana? try our Solana Watcher in MetaSleuth. You can also easily track SMART addresses on Solana in MetaSleuth.
Take a try:
metasleuth.io/dashboard/sola…
#Solana #SmartMoney
1
1
10
2,174
Did you know that we automatically connect transfers across Cross-chain Bridges, including Across Protocol?
Take the Exactly Protocol Exploit as an example. When analyzing the exploiter's address on OP, we automatically display the cross-chain path to ETH. 🔄
Try it now 👇metasleuth.io/result/optimis…
1
1
14
1,959
Over 3000 Phishing Alerts, with estimated losses exceeding $91M.🚨
Stay informed and secure with our Phishing Alerts Dashboard. metasleuth.io/phishing/alert…
MetaSleuth Phishing Alert system proactively identifies potential phishing attempts, delivering on-chain messages, and generating detailed reports. This allows users to stay updated on potential fund losses and take necessary action promptly.
1
5
13
1,472
#MetaSleuthTips No more manually posting screenshots!
Now, when you create shared links and post them on platforms like X and Telegram, a preview image of the entire fund flow chart will be automatically displayed.
metasleuth.io/result/eth/0xf…
Example of the Heco bridge hack.
13
1,226
🧐The danger of blockchain phishing is beyond imaginable! Even senior industry insiders feel unbelievable.
Metasleuth found that a phishing address (0x1661f1) participated in multiple large-scale frauds, with profits exceeding $10,000,000!
2
3
11
11,888
Excellent investigation on Pink Drainer, using MetaSleuth. Kudos to Heiner García.
medium.com/@Heiner./scam-as-…
4
3
14
1,898
DND Token (DungeonSwap Token) on BSC has been exploited. The init funds came from @TornadoCash. All of the illicit funds still remain in the address 0xbaca.
The exploiter 0xbaca2500b0f3009b420a7592bb1485e7ba419d76 stole BUSD from people who had approved for the DND token contract, and finally transferred the profits to 1,375 + 567 BNB.
tx hash: 0x21b1378e332333d9c48129fe644f7c6d6393892f6604dba58ce7da103c922519
0x1f1f7e4c2d817231af97d6265fb55fb175e561f93c577cd905f8eeb6c29bca9d
Click the link to see details:
metasleuth.io/result/bsc/0xB…
10
2
10
4,542
Introducing MetaSleuth’s new feature: Tracing funds in one direction.
Here's an example of using it to investigate phishing incidents. 👇
Track funds in a single direction with MetaSleuth! 🚀
Click the plus icon by the address nodes to see only incoming or outgoing funds. 🔍
Stay tuned for more updates! 🌐
#MetaSleuth #Blockchain #NewFeature
1
3
12
3,570
#MetaSleuthTips
Navigate complex fund flow diagrams with ease! 🔍
With #MetaSleuth, quickly search for addresses, labels, transaction hashes, or use edge:{index} to locate edges that appear on the canvas.
Results are highlighted and the view is centered, streamlining your #Blockchain analysis.
1
12
1,795
#MetaSleuthTips Address Panel Filter
Effortlessly filter the related addresses and transfers for your target address using the Filter feature in the Address Panel.
Stay focused on what matters most.
14
999
The @harmonyprotocol Horizon Bridge's hacker built a complex but structured money laundering network and is attempting to launder millions of dollars, some of the illicit assets deposited into many CEX.
metasleuth.io/result/eth/0xc…
2
15
2,466
Track phishing funds like a pro with MetaSleuth! 🔍🚨
This clip showcases how easy it is to use 'show more' for detailed transfer data, 'token filter' to focus on key assets, and 'search box' to trace all edges related to a given transaction hash.
1
13
1,530
📚 Exciting news! We're planning a tutorial series on conducting investigations using MS. We want to hear your thoughts and ideas! What specific areas or topics would you like us to cover?
Leave your comments below and let us know! #investigation #MetaSleuth #DYOR
2
15
992
We have traced the @coinexcom stolen funds on ETH, BSC, Polygon, Tron, and BTC (this is not an exhaustive list of the stolen funds). The stolen funds on these chains amount to approximately $42 million in total, with the majority currently held in the form of native tokens and transferred to new addresses. We will continue to monitor the addresses where the funds are being held.
metasleuth.io/result/eth/0x8…
#CoinExResponseUpdate - We've identified the 2nd series of suspicious wallet addresses linked to the hack:
$ETH:
0x2118e4432d668aCFa347ddBA0efCcc6BB04DB297
0x1A61Df134d766f1e240FBFAEe79bBeCC04195f62
0x40cBe7580168d52b7FEC884120B31115c3F7E37E
$XRP:
rpQxVcjVF2fC23r3xKyJS53jw8d5SRhZQf
$SOL:
G3udanrxk8stVe8Se2zXmJ3QwU8GSFJMn28mTfn8t1kq
$BSC:
0x6953704e753C6FD70Eb6B083313089e4FC258A20
$KDA:
k:a9f3672d7ad7a1e4592702d73b220cbc61db1fa17f89a56131d965bc03959913
$BCH:
qrgxyhj8rzl4l7fgauu6q6vtu2grct4jeyrnaq2s75
$XDAG:
15VY3MadZvLpXhjzFXwCUmtZcHszju6L9
We will continue to trace and identify suspicious addresses. We urge affected projects and fellow industry colleagues to assist in flagging and freezing these questionable addresses. Together, we can face and overcome the challenges ahead.
7
13
2,163
This blog shows how to use MetaSleuth to track "smart" money on Solana, who made millions of dollars in two minutes by buying #TIM meme Tokens.
They were criticized as the insider job. You can DYOR.
blocksec.com/blog/using-meta…
2
6
12
3,321
MetaSleuth now supports analyzing transactions on 11 chains, including @BuildOnBase and @LineaBuild!
Just enter a transaction hash and uncover all the fund flow within.
Simplify your analysis and gain insights into transaction details.
3
14
1,265
1/ MetaSleuth has an online alert system for phishing attacks, sending notifications to victims from metasleuth911.eth. We've discovered someone impersonating us and claiming to represent BlockSec, targeting the same victims.
We've received reports of users being contacted by individuals claiming to represent BlockSec, offering to recover phishing losses. DO NOT respond to these messages. If you have any concerns, please contact us directly via email at contact@blocksec.com to verify the identity.
3
5
11
4,312
🙌Insightful analysis of $BWT launcher using metasleuth.io!
I have PROOF that $BWT (@MemeBarron47) was launched by BARRON HIMSELF. It is also being market made by Wintermute.
CA: EmBBhcqgm2acaXv9dXQFyDZDkhL4YMoWnGdHaMQJpump
Read on: 🧵
3
14
2,937
Thanks for using Metasleuth.io to track and uncover this obfuscation tactics.
Hector network exploiter is using sophisticated obfuscation tactics by sending 100 BNB to TCash and receiving it back into the same wallet🤪
1
1
13
1,201
The root cause of @BeanstalkFarms exploitation is that the emergencyCommit() requirement bipVotePercent is based on balance, which makes it very likely to be exploited by flashloan.
14