Web3 Data Platform | No code tools that empower everyone to capture, analyze, and understand web3 data in a useful way.
Joined July 2022
- Tweets 318
- Following 724
- Followers 1,863
- Likes 149
222 Photos and videos
First major hack of 2026, as @Truebitprotocol was drained for $26.2 million through an overflow in unverified bytecode.
The same attacker hit Sparkle weeks prior. Old code keeps bleeding - the archives have clearly become a shopping list.
rekt.news/truebit-rekt
9
16
77
12,134
Jan 8
1/ @Truebitprotocol appears to have been exploited for roughly $26M. As of now, the team hasn’t posted an incident update on their official socials, but we’re have seen large outflows from protocol-linked contracts plus on-chain communications consistent with a compromise.
Exploiter: 0x6c8ec8f14be7c01672d31cfa5f2cefeab2562b50
6
3
12
775
Jan 8
4/ Exploiter addresses:
1. 0x6aecb6ee5d7fa4f5b7b5553ed0173442f0ee5ccb
2. 0x6c8ec8f14be7c01672d31cfa5f2cefeab2562b50
3. 0x3b58192943ee6f9ae92d54dd1ef378cfd519862a
4. 0x62afdd1bd84f6b152572404be90679ae58eb4862
Exploit Tx: 0xcd4755645595094a8ab984d0db7e3b4aabde72a5c87c4f176a030629c47fb014
Tx. hash for on-chain communication: 0x46f7539cfe46b3e925d69b9bc62fc31c8f06305c8d155bdb5a4c528f3dfb1277
1
271
Jan 8
3/ The activity also suggests the attack was initiated/planned back in November, when the suspected exploiter was funded via Rhino.fi (likely as part of the setup phase).
1
2
450
Jan 8
2/ The stolen funds are currently consolidated into two wallets holding ~$13M each.
1
211
Blockscope retweeted
15 Dec 2025
1/ Stablecoin Monitor just got a major upgrade: we now track not only dozens of stablecoins, but also the entities behind them; Issuers, owners, bridges, protocols, DAOs, and more.
Visit: stablecoinmonitor.com/entity
2
5
6
313
11 Dec 2025
A victim, attributed to the ENS name markpascall.eth, lost approximately $1.05M in assets in a suspected private key compromise.
The incident came to light after @zachxbt flagged the activity. The stolen funds were consolidated and swapped for ~330 ETH, which was then funneled into Tornado Cash.
Exploiter address: 0x4f8affe6cd269d1f8352d0542432de6975c3912d
1
2
2
451
5 Dec 2025
1/ Just yesterday we were discussing CPIMP attacks, and now we have a live example: @USPD_io has been exploited for ~$1M via a malicious backdoor proxy planted over 2 months ago.
All the drained funds were swapped to ETH. The exploiter currently holds ~$1.05M at this address: 0x083379bdac3e138cb0c7210e0282fbc466a3215a
This wasn't a flash loan attack but a sophisticated "sleeper" job.
1
3
6
815
5 Dec 2025
2/ In mid-September, the exploiter front-ran the contract's initialization, inserting a malicious proxy to seize Admin privileges. The backdoor remained dormant and undetected for 78 days.
Using the Blockscope AI Investigator, we analyzed the root cause transaction to visualize exactly how the injection occurred.
2
227
5 Dec 2025
1/ Earlier today, @zachxbt reported the likely arrest of threat actor Danish Zulfiqar ("Danny"), linked to the $243M Genesis theft and Kroll SIM swaps.
Blockscope analyzed the suspected seizure address: 0xb37d617716e46511E56FE07b885fBdD70119f768
Current holdings sit at ~$18.58M (primarily $ETH & $DAI), showing specific consolidation patterns consistent with Law Enforcement seizures.
1
1
4
862
5 Dec 2025
2/ On further analysis of counterparties, we identified a distinct obfuscation flow from last year:
• Funds were received from Mixers & Exchanges.
• Assets moved through intermediaries performing repeated $ETH ⇄ $WETH swaps.
• Swapped funds were sent to fresh addresses before final exchange deposits.
This layering was clearly designed to mask origins and sever exposure links.
2
260
1 Dec 2025
In a major win for blockchain forensics, @Europol, working with German and Swiss authorities, has successfully shut down Cryptomixer, a service responsible for laundering over €1.3 billion in Bitcoin since 2016. The operation led to the seizure of €25 million in cryptocurrency and the dismantling of critical infrastructure in Zurich.
For those in crypto compliance and investigation, the most significant outcome is the seizure of 12 terabytes of operational data, along with the domain cryptomixer.io. This "treasure trove" of logs likely contains years of transaction history and user patterns, previously thought to be untraceable. This data will be instrumental in unmasking historical illicit activity related to ransomware groups and darknet markets for years to come.
Read the official announcement here: europol.europa.eu/media-pres…
2
5
270
20 Nov 2025
1/ Yesterday, @GANA_PayFi (Gana Payments) was exploited for approximately $3.147M on BSC. The exploiter drained the project liquidity across multiple transactions.
Credit to @zachxbt for the initial alert.
Primary Exploiter: 0x2e8A8670B734E260ceDBC6d5a05532264aae5C38
2
3
6
513
20 Nov 2025
3/ The remaining balance of roughly $1.049M was transferred to a separate address: 0xd10Ed57534Dc63f2ea9dC0cB0096086F3CC8fA4d, which eventually deposited the totality of the funds into Tornado Cash as well.
2
214
20 Nov 2025
2/ Approximately two-thirds of the stolen funds (~$2.1M) were bridged to the Ethereum Mainnet using deBridge and Stargate, and subsequently deposited into Tornado Cash.
Involved Addresses:
• 0x7a503e3ab9433ebf13afb4f7f1793c25733b3cca
• 0x98fc13632ff112e4667fc4f21ae980571f122b5a
2
226
13 Nov 2025
On Nov 3, @Balancer V2 Composable Stable Pools were exploited, draining ~$129M worth of assets across multiple networks. The majority of funds currently sit on Ethereum, ~$90M, while a substantial portion has been recovered.
In our latest report, we break down what went wrong in the math, how the attacker moved funds, and where the crypto is sitting now, with full root cause analysis, on-chain forensics and tracing.
Link: research.blockscope.co/balan…
2
6
554
4 Nov 2025
1/ 🚨 Hack Alert - @MoonwellDeFi
Multiple transactions exploited Moonwell’s lending contract. An incorrect oracle returned a wildly inflated wrst price (~$5.8M), letting the exploiter repeatedly borrow >20 wstETH after flash-borrowing only ~0.02 wrstETH.
Using Blockscope AI Investigator we can trace exactly how the exploiter profitted in multiple transactions by understanding the exploit mechanics.
3
1
10
1,528
4 Nov 2025
3/ The on-chain tracer shows the exploiter walked away with ~295 ETH (~$1.03M) in proceeds.
4
262
4 Nov 2025
2/ Possible Root cause: A faulty oracle / collateral price feed → over-borrowing.
Analysis found that specifically this transaction corrupted the collateral price (tx: 0x77e308091f9eee86bb4e5571ee3bf8be001ce84208501c6aba3f251b5f9150d4), enabling the looped borrow pattern.
Using Blockscope AI Investigator we can trace exactly how the price feed was changed.
3
320