Blockchain Intelligence at your fingertips. Crypto Tracing / AML Screening / Incident Response
Joined October 2020
- Tweets2.2K
- Following624
- Followers8.2K
- Likes4.4K
AMLBot retweeted
Onchain data from the recent incident involving @Ledger devices sold through reseller @cryptobilis shows most drained wallets were first funded between June and September 2026
We checked when each of the 258 drained addresses first received funds. ~90% were first funded after June 1. The median date is Aug 6, and none was funded after Oct 4
But 98 of them (38%), holding ~46% of the value drained from these addresses, were already in use before July 11. That is outside the 90-day window in Ledger’s advisory. This points to devices bought earlier, or existing seeds restored onto newer devices
If you bought from this reseller this year, or entered an existing seed into one of its devices, don’t rely on the 90-day cutoff. Move your funds to a new seed generated on a device bought directly from the manufacturer
AMLBot retweeted
🤝 Thank you @AMLBotHQ for supporting 79VAULT with on-chain monitoring and transaction tracing following the recent security incident involving 16,249 BNB.
🔐We’re grateful the funds have been returned safely. Strong collaboration and blockchain intelligence made a real difference.
#79AU #79VAULT #AMLBot
AMLBot retweeted
Update: @near_intents has confirmed the security incident
xitter.cf/near_intents/status/21…
Earlier today NEAR Intents services were stopped after a security incident was detected. The incident was caused by a bug in the Omni deposit and withdrawal infrastructure interaction with NEAR Intents smart contract.
The preliminary report indicates the total loss of approximately $3.8M. These funds will be compensated in full.
The contract-side vulnerability has been patched. The operations of the NEAR Intents and near(.)com are expected to resume within 1h.
Deposits and withdrawals on the following networks will remain unavailable for an additional ~12 hours while fixes to the Omni infrastructure are completed: BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, LayerX, Adi, Scroll and Plasma.
In case users hold any assets from these chains inside NEAR Intents (for example, in HOT wallet or on near(.)com), they will be able to swap them into other assets once NEAR Intents is back up (in ~1h).
The incident has been reported to law enforcement, and we are working with security and blockchain analytics partners to trace the funds and pursue recovery. A detailed report will be shared publicly in the following days.
AMLBot retweeted
Bitget exploiters are laundering through @THORChain affiliates they appear to control themselves
Our tracing shows 3 affiliates were used only by @bitget attacker wallets: ~3.7K swaps worth ~$58.7M, mostly XRP/ETH to BTC. No swaps from any other users at all
The affiliates collected ~330K RUNE (~$245K) in fees. One cashed out ~132K USDT and ~0.56 BTC, all of which ended up at @okx. Another swapped its fees straight back into an attacker wallet
One affiliate is still holding ~72K RUNE (~$54K), unmoved
thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4
thor1rj9f7m7n72nwslau7jzla09u0l4zr4ru8277d2
thor199tl2t4fkxqn7pawk8dgera79dl70rnczu6jsl
Update: It seems stolen funds from the @bitget hack have started to be laundered through Wasabi CoinJoin (mixer)
Our tracing links ~4 BTC in a CoinJoin round back to a Bitget TRON wallet. The funds were swapped from TRX to USDT, bridged to Ethereum via @USDT0_to, swapped to ~145 ETH, then sent through @THORChain to ~4.59 BTC. The BTC was then split and prepared before entering the CoinJoin
We have blacklisted the related addresses and are monitoring the attacker's BTC for further CoinJoin activity
AMLBot retweeted
Two Safes using Makina modules on Ethereum were drained on Sep 15
Safe #1 lost 2,900 rsETH ($7.7M). An MEV bot intercepted the extraction in-block - 2,882 rsETH is now dormant at 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, likely the Yoink MEV address. The attacker got nothing from this one
Safe #2 lost ~$125K in USDC and DUSD. Those funds were swapped to ETH, bridged to Hyperliquid and converted to XMR. The attacker profited around $58K
Attacker wallet was seeded from Railgun and used to deploy the malicious contracts
AMLBot retweeted
On September 11, @symbiosis_fi syBTC was exploited. ~184.47B syBTC was minted to the attacker on each of BNB, Ethereum and Rootstock
Tracing shows attacker dumped all the tokens and bridged to Ethereum. The funds are now consolidated at 0x7cd28D8E6210E6E4A8b1947FC9b44DC01C600192 ~309 ETH (~$748K)
The attacker's gas was funded via @ChangeNOW
We are actively monitoring this case and will post updates if the funds move
AMLBot retweeted
Term Finance (@term_labs) was exploited for ~$8.5M on Ethereum
Both attacker wallets appear to have been seeded with ~1 ETH each from Tornado Cash beforehand. Tracing shows the proceeds - ~2,842 WETH was unwrapped to ETH and the ~$1.68M USDC swapped to DAI via DEX
Both branches converging on one address:
└ 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 now holding ~2,843 ETH + ~1.68M DAI (~$8.5M)
Funds are lying dormant - no mixer, no CEX. We are monitoring for movement
AMLBot retweeted
⚠️ Beware of fake AMLBot sites
Scammers are cloning our brand to run fake "AML checks" that ask you to connect your wallet. A real AML check only needs your public wallet address - never a wallet connection, an approval, or a signature
The connect exposes your holdings so they can craft a drainer tx for you to sign. One click of "approve" and the wallet is emptied
AMLBot will never ask you to connect your wallet
Fake Crypto AML Checkers Are Trying to Drain Users' Wallets
decrypt.co/376029/fake-crypt…
AMLBot retweeted
Project @TheSandboxGame (ethereum:0x3845badade8e6dff049820680d1f14bd3903a5d0) was exploited on Base. The attacker minted unbacked ethereum:0x3845badade8e6dff049820680d1f14bd3903a5d0 while also draining the SAND OFT adapter on Ethereum
Tracing shows the minted and drained SAND were sold for WETH across DEXes and consolidated into a single wallet on Ethereum, 0xac76b04397c9296dfc00e25c96d8e51b4edfaf29, which now holds ~396 ETH (~$958K) and is sitting dormant. Notably, the attacker's wallet was gas-funded from CCE.cash on Aug 21, shortly before the attack
We are tracing the flows and monitoring the wallet, and will update if it moves
AMLBot retweeted
How Business Leaders Can Guard Themselves Against Pig Butchering Scams hubs.li/Q04qXFcn0 Written by @demchukvm of @amlbothq
AMLBot retweeted
Polymarket attacker started to launder funds
0xea0a80...441f, funded from the exploit consolidation wallet (0xe65b1C...E1eD), pooled ~100 ETH with ~102 ETH from another attacker wallet (0x0155FD...C80C2) and deposited ~201 ETH into Railgun
Two other related wallets (0x975268...78aC0, 0xE3c8c6...bD922) remain untouched, holding ~1,788 ETH and ~3.4 ETH respectively
Polymarket Under Attack
Polymarket users were drained of ~$3.1M in PUSD on Polygon via phishing / malicious EIP-7702 delegated execution.
Funds were converted to USDC.e via Relay, bridged to Ethereum, swapped to ETH, and consolidated at 0xe65b1C586757c5510B60F998Eebb14C1eF71E1eD.
~1,891.9 ETH now sits parked across three fresh wallets:
0x975268a2a71e4A7e282B962Ec0b1Ee01d3778aC0: 1,788.5 ETH 0xea0A80070C38F63C10d7FED95286e83EB415441f: 100 ETH 0xE3c8c6cFCfB8edFa83b86e5A98E58568f78bD922: 3.4 ETH
We are currently actively monitoring these addresses
AMLBot retweeted
in may, Taylor Hornby (@DefuseSec) used claude opus 4.8 to find a counterfeiting bug in zcash's orchard pool: one missing constraint = unlimited undetectable ZEC.
TronZ (@trondao) shielded USDT is "based on zcash", ~$1.02M in the pool. cooked too?
spent a day checking. thread
AMLBot retweeted
Comparison of Crypto Volumes: Revolut vs Robinhood
I analyzed the crypto trading volumes of two of the world’s largest fintech platforms across 2023–2025, and the results turned out to be both surprising and insightful.
What I did: I identified crypto addresses for both companies using @arkham, @Dune, and @AMLBotHQ Pro for Revolut - and cross-referenced them with Robinhood data from @TheBlockCo.
In Q4 2024, Robinhood posted a record quarterly volume of $71B. Revolut, in the same period, reached only $22.5B. At first glance, the winner seemed obvious - but the story doesn’t end there.
By Q1 2025, the picture had shifted dramatically: Revolut hit $90B versus $46B for Robinhood. Nearly a 2x difference, and not in favor of the American platform.
Cumulative totals (Q1 2023 – Q4 2025):
@RobinhoodApp - $330.9B
@Revolut - $534.1B
Revolut has overtaken Robinhood in total crypto volume, despite entering the market later - with its first meaningful volumes only appearing in Q4 2023.
AMLBot retweeted
⚡️ UPDATE: Between 2023–2025, Tether froze ~$3.3B in assets, while Circle froze ~$109M, a ~30× gap, per AMLBot.
AMLBot retweeted
🚨TETHER FROZE $182M IN USDT
Tether froze $182M across 5 Tron wallets holding $12M to $50M each with no disclosed reason.
Since 2023, Tether has frozen $3.3B and blacklisted 7,268 wallets, according to AMLBot.
AMLBot retweeted
🤖 AMLBot x Cware Labs
We’re excited to announce our strategic partnership with @AMLBotHQ – a provider of AML analysis and blockchain transaction monitoring solutions.
The company specializes in screening crypto wallets and transactions for AML/KYC compliance, detecting risks, and preventing interactions with sanctioned or fraudulent addresses.
Together, we’ll provide #Web3 startups with the tools to launch and grow safely, strengthening trust from both investors and users.
🔗 Learn more:
AMLBot: amlbot.com
Cware Labs: cwarelabs.com
AMLBot retweeted
Let’s look at the India market 🇮🇳
Heavy capital controls. Tight limits on moving money in and out. A huge, tech-savvy population. On paper, it’s the perfect storm for crypto adoption — but the why matters as much as the how.
Earlier this year, our CEO Viacheslav Demchuk, spoke with George Basiladze @wert_io about markets with unique dynamics like India.
His take on this:
1️⃣ Payments — Crypto and stablecoins work as alternative rails for sending and receiving money abroad.
2️⃣ Investments — People buy crypto to profit and build wealth, just like they do with stocks or bonds.
The challenge? Too many investors fall for scams and rug pulls because there’s no strong framework for how these investments are offered.
The goal shouldn’t be to block investment.
It should be to:
🔹 Keep the payment rail use case alive.
🔹 Build rules so investments go through regulated local platforms.
🔹 Protect users without killing utility.
Because in fast-growth markets like India, regulation done right isn’t a brake on adoption — it’s the fuel for it.
#AMLBot #AML #Wert
AMLBot retweeted
💥 In August, Tether added 39 new USDT addresses to its blacklist.
The total number of blacklisted addresses by Tether has now reached 2,417, with a combined value of $1.5B in $USDT.
Since the beginning of the year, Tether has added 413 new addresses to the list. By comparison, the blacklist grew by 740 addresses throughout all of 2024.
The company is ramping up its efforts to detect suspicious activity, consistently expanding the blacklist each month.
You can also track the number and list of blacklisted addresses through our analytics dashboard: dune.com/amlbot/usdt-usdc-ba…
#AMLBot #Blacklist
AMLBot retweeted
💀💰 Crypto Hacks Recap (July-Aug 2025)
Over the past two months, several projects suffered significant losses due to hacks.
The biggest hits include:
1⃣ Nobitex: $82m - Devastating hot wallet hack exposed security flaws.
2⃣ CoinDCX: $44.2m - Infrastructure breach disrupted operations.
3⃣ GMX V1 Perps: $42m - Re-entrancy exploit targeted smart contract vulnerabilities.
4⃣ WOO X: $14m - Social engineering attack compromised the ecosystem.
5⃣ Resupply: $9.6m - Price Oracle Manipulation exploited market data weaknesses.
These incidents highlight ongoing risks in protocol logic, infrastructure, and wallet security.
Stay vigilant! 🫡
#AMLBot #Hacked
