On-chain sleuth 👁️
Joined June 2024
- Tweets 819
- Following 642
- Followers 19,632
- Likes 5,981
417 Photos and videos
Pinned Tweet
11 Oct 2025
1/ An investigation into the alleged identity of the mysterious Hyperliquid/Hyperunit whale, who holds over 100,000 BTC. Recently, he sold over $4.23B in BTC to acquire ETH and is the same person behind the $735M BTC short order placed on the same platform.
293
682
3,566
2,642,544
May 28
1/ DxSale allegedly drained $7.3M from some of the oldest liquidity pools on BNB Chain LPs locked back in 2021
According to @Tahax1 the exploit involved a silent ownership transfer, 80 wallet hops and more than 1,400 LPs being exploited
After analyzing the fresh wallet used during the attacks, i believe there are strong indicators pointing to a direct connection with the @DxSale team itself.
0xC4574DDEF299e7E563971e200433e592EeaaFA69
May 28
Back in August 2025, a user asked me to investigate DxSale and shared screenshots showing that someone was already selling a service through their TG channel, claiming they had direct contacts inside the DxSale team and could unlock old LPs from projects launched before late 2021 taking a 20% cut of the recovered funds as payment
The only requirement, according to them was that someone from the original team still had access to the wallet used to raise funds on DxSale
After today’s events, it really feels like this backdoor may have existed for years already, which also raises the possibility that the exploit came from someone with insider-level access potentially even a former DxSale team member who already knew how these LPs could be unlocked all along
5
3
26
6,500
May 28
3/ The address 0xC457 later transferred a total of 3.4K BNB ($1.2M) to these two wallets:
0xb71c1C2A0cD7A88f1317f9A996e4d121E7db5E92
0x4c5ee9703653C8e7725C65593bff372655e0453C
Over the last few hours, the funds were fully off-ramped through multiple Binance deposit addresses, including:
0xE06AcCf50D4F34a5bcA2750D24f943b4F6f7e53B
0xAc69F86C4a43D93f1b7d0B57aEfE6a1b7B9a6773
0x18Dfd8278de50e4A6f3BF1606bA77371451D8602
0x323A1155aA67Aa92CE9306F7c73f8C223568F24d
0x519eD00dd7Be16040Cfe14dDd7D43Db4D77A4A61
0xDd57F5eA9C7CA2C16e243627cA9CAd9F7c2CB3CB
0x8243e20CecafA6D3dDDcF15D5Ac9726dD28F7afD
0x391c5756A9b1924f6C206cC029315CF154B95Eca
0x8eAFD73a26785948d05E89684273304B29a3c0a0
0x582A8eF74c49F5a7435aDD214Cf144f4af7A2aED
0x78Fc689Ccc109be4D8663e353700E1f7e9bD5A6D
0xc87eC86a089C9A15Ce6191444ADBB6f04fCE88D8
0x045F605740Cb1E9954DBB9E174596a59e926a183
0x944D82abc234884f822Ec9E695D4Da91e8e1327A
0xC21C0BC9C911B86dfb659718762806ec409A3dc4
0x67741069FD99B56B5E92C356FE876Efb23658069
0xb39274583Ba7De8b50334A1BA12e7d6a0046C580
0xF9229db0279F1E803b4702b08dC0AD18f50E2694
0xa84d0e8522CFdd8B316F5b215fbC505A522301D3
0x5A5EA07c5Aa921cE424c4e2897051d19b3146934
0x98bf9fF3f51fc57e5602ca7D200d980403de1BdF
0x0c29B1e2Cc5fD9536149Cb497ff18c086663655A
0xC5c04B8236F57090E39C3f67C9B37e218e7aab82
0xD5753F4424eBc6Efb9964E18446B1833FDd52697
1
7
1,068
May 28
4/ This situation shows how thin the line really is between “trust” and hidden control in abandoned crypto platforms.
DxSale was once presented as the trusted infrastructure behind countless launches on BNB Chain, including SAFEMOON a project whose team members were later indicted and prosecuted.
If these allegations are confirmed, it would mean the same people who built and promoted the locker infrastructure may have intentionally left a backdoor open for years, only to eventually exploit it themselves.
Even if many of these LPs were abandoned or forgotten, this still represents a massive breach of trust and potentially fraud against investors who believed their liquidity was safely locked.
I believe the funds that were moved through @Binance should be immediately frozen, as they may ultimately belong to investors from projects that originally raised funds through DxSale.
@cz_binance @_RichardTeng @heyibinance
7
699
May 28
Back in August 2025, a user asked me to investigate DxSale and shared screenshots showing that someone was already selling a service through their TG channel, claiming they had direct contacts inside the DxSale team and could unlock old LPs from projects launched before late 2021 taking a 20% cut of the recovered funds as payment
The only requirement, according to them was that someone from the original team still had access to the wallet used to raise funds on DxSale
After today’s events, it really feels like this backdoor may have existed for years already, which also raises the possibility that the exploit came from someone with insider-level access potentially even a former DxSale team member who already knew how these LPs could be unlocked all along
🚨 BREAKING: @DxSale just drained ~$7.3M from OG @BNBCHAIN LPs
DxSale ran the largest liquidity locker of 2021. Hundreds of millions sat inside it. Even $SAFEMOON was locked here
The team is now mixing the funds through what looks like @anyswapbot, and funds are now untraceable
8
5
27
14,545
May 21
20 hours ago, Garrett ( @GarrettBullish ) transferred $39.5M USDC from the address 0x1cBa79CF8DD10D0D6cD6f098B34DFc3499377829 to Binance. He is still holding $263M USDC in that address.
15 minutes later, the wallet 0x92ea19ECeB7a8dE0f50978A1583A5D8b018050e9, which had been inactive for 2 months, received $40M USDC from Binance.
10 hours after that, Garrett deposited $10M USDC on Hyperliquid to buy 42.5K $HYPE (~$2.1M) at an average price of $50.1 and opened a long position of 504.4 $BTC (~$39.1M) with an entry price of $77,394.
The position is currently up $158K PnL.
1
18
1,759
May 13
1/ After multiple callouts from @ZachXBT regarding transparency concerns surrounding the project, LAB has now reached the $6.20 price mark.
Someone reported to me that an OTC deal involving $LAB allocations was posted in the "Cybertim Ventures" TG channel, a broker known for facilitating OTC deals
Based on the vesting structure and terms that were shared, this appears to match one of the early investor allocations, suggesting that an investor may have sold part of their allocation at a 50% discount as early as January 5
14
17
120
28,858
May 13
5/ His personal email, which is connected across multiple social profiles, also appears to be linked to a female TikTok profile, presumably his girlfriend based on the Russian accent
The profile was promoting a campaign built around a “$1 in crypto for every new follower” concept with a stated goal of buying $1M worth of crypto
Despite the effort, the campaign gained little traction, failed to establish any meaningful presence within the crypto influencer space and the associated Instagram account was later deleted, while the TikTok account appears to have been abandoned
1
16
2,852
May 13
DISCLAIMER: All information shared in this thread comes exclusively from publicly available sources, including onchain data, social media activity, OSINT and compliance research tools. No private information, unauthorized access or non public materials were used in this research
16
2,408
May 10
Garrett (@GarrettBullish ) just deposited another 225.62K ETH ($528M) to Binance
0xc47D0b74331Cf27d3BdcB6fa9A758731903F06C1
1
1
32
4,033
May 8
While @GarrettBullish is busy sharing alpha on his Substack… his wallets have been making moves of their own
Over the past 5 days, he has deposited more than $793M to Binance:
220M USDT
244K ETH
2
4
46
5,039
Mar 29
Yesterday my account was compromised via a session hijack. The attacker removed my 2FA and I was locked out for 3 hrs
x.com/1kpier/status/20378407…
my friend @eyeonchains account has currently been compromised.
Someone managed to log into his account, change his password and activate the 2fa to promote a crappy memecoin.
They already deleted the posts after getting caught red-handed.
7
2
24
6,583
Mar 29
That access has now been revoked and the situation is fully resolved.
Apologies to everyone for what happened, I realized some of this too late.
I can now confirm 100% that my account is back under my control
1
1
10
1,568
Mar 29
I dissociate myself from all the things this Turkish hacker has done, I am searching for his traces, it seems that someone is trying to ruin me because of all the things Im doing in terms of investigations
10
1,403