Crypto web3 services @Devweb3sec

2/ On April 21, 2024 over a 16 hour period a Coinbase Commerce contract saw 1700+ USDC outflows for $15.97M total on Polygon. Attacker 0x07c77559b37a5cde66267a3b5451200fdc312078 0x58e838b7fbfe27397517fbe70b1c92d941aace4d Contract 0x551c6791c2f01c3cd48cd35291ac4339f206430d

keyboard_arrow_left Previous keyboard_arrow_right Next

1/ Earlier this year in April 2024 a Coinbase Commerce contract saw $15.9M of suspicious outflows indicating a merchant had potentially been exploited. Shortly after a threat actor with the alias ‘Excite’ began showing off the stolen funds in chats. Let’s dive in.

keyboard_arrow_left Previous keyboard_arrow_right Next

8/ While the identity of the victim in this case remains unknown it’s clear a strong lead exists to potentially hold this threat actor legally accountable. Due to how the funds were split three ways I would expect others may have been involved. One question I would have is…

7/ While the majority of funds have remained dormant a portion was transferred to eXch & Stake utilizing Dex swaps to a fresh address in an effort to obfuscate the funding source. One of the deposit addresses used has high exposure to a drainer customer.

4/ After the theft in May 2024 a threat actor began flexing in Telegram chats with the username ‘tezedasads12’ sending 1 DAI as proof of owning an address with $6M from the theft. 0x0138d8c265b0d60907055df25ebfb34a6f805acd3675c45dcd5d96b85376ec2d TG ID: 6710473579

keyboard_arrow_left Previous keyboard_arrow_right Next

13/ Coinbase needs to urgently make changes as more and more users are being scammed for tens of millions every month. Other major exchanges do not have similar panels created by scammers for fraud. While the victims are partially responsible it’s unreasonable to expect…

12/ I strongly urge the Coinbase leadership team to consider: a) Making phone numbers optional for advanced users with Authenticator app or Security key added who are fully KYC verified. b) Add a beginner / elderly user account type that doesn’t allow withdrawals. c) Improve…

1/ Over the past few months I imagine you have seen many Coinbase users complain on X about their accounts suddenly being restricted. This is the result of aggressive risk models and Coinbase’s failure to stop its users losing $300M+ per year to social engineering scams.

keyboard_arrow_left Previous keyboard_arrow_right Next

Today when laundering funds for the Bybit Hack the Poloniex hack was also linked on-chain in consolidation address 0x15ec. This now shows the same entity is tied to four different hacks (Bybit, Poloniex, Phemex, BingX) Overlap 0x15ec300a4895a86322f1a27dd9ba0b9f8297e65d Bybit…

I spent the entire day graphing out the laundering movements and flagged theft addresses. I am making 920+ addresses connected to the Bybit hack publicly available here: chainabuse.com/report/b87c882… (the data may need to be cleaned up a bit)

Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents. Overlap address: 0x33d057af74779925c4b2e720a820387cb89f8f65 Bybit hack txns on Feb 22, 2025:…

I will provide an update once more information about the case becomes public. You can read my investigation below:

ZachXBT @zachxbt

2 years ago

I will provide an update once more information about the case becomes public. You can read my investigation below:

584 1K 7K 3.3M 2K

A few hours ago it was announced that $31M from the Uranium Finance exploit was seized by US law enforcement. In Dec 2023 I posted an investigation for the $50m Uranium exploit on BSC detailing how the exploiter had laundered $10.5M via Magic The Gathering trading cards using a…

keyboard_arrow_left Previous keyboard_arrow_right Next

Pleased to share I'll be working with @matthuang @paradigm as an incident response advisor to assist their portfolio companies. It was an easy decision as this gives me the freedom to continue helping the community and publishing investigations like. I’ve always respected how…

Matt Huang @matthuang

6 months ago

Pleased to share I'll be working with @matthuang @paradigm as an incident response advisor to assist their portfolio companies. It was an easy decision as this gives me the freedom to continue helping the community and publishing investigations like. I’ve always respected how…

292 181 4K 987K 149

11/ It is abundantly clear WP/AP has not learned his lesson over the years after serving time for fraud and will likely continue gambling. Currently the funds primarily sit here: 0x51d99A4022a55CAd07a3c958F0600d8bb0B39921 Here’s a quick TLDR for those people who have a short…

10/ Who is William Parker? Last year WP was arrested for stealing ~$1M from two casinos in 2023 and was sentenced in Finland. Prior to this WP was known as Alistair Packover (William Peckover) before later changing his name. In the early 2010s AP made multiple news headlines…

keyboard_arrow_left Previous keyboard_arrow_right Next

1/ An investigation into the alleged identity of the mysterious Hyperliquid whale tied to illicit activity that profited ~$20M via highly leveraged positions over the past couple weeks.

keyboard_arrow_left Previous keyboard_arrow_right Next

Update: Two suspects in the $330M heist include “Nina/Mo” a Somalian who operates a call scam centre in Camden,UK and an accomplice “W0rk” who assisted with the site/call. They have since deleted social media accounts.

Update: So far $7M+ has been frozen with the help of @CFInvestigators, @tanuki42_, Binance Security team, and myself.

Nine hours ago a suspicious transfer was made from a potential victim for 3520 BTC ($330.7M) Theft address bc1qcrypchnrdx87jnal5e5m849fw460t4gk7vz55g Shortly after the funds began to be laundered via 6+ instant exchanges and was swapped for XMR causing the XMR price to spike…