Helping individuals understand suspicious transactions, trace digital asset movements, and explore legitimate recovery options. Evidence-driven. Transparent.
Joined January 2017
- Tweets23.1K
- Following1K
- Followers1.7K
- Likes19K
ChainGuard Recovery | Blockchain Investigations retweeted
Binance tarafından yapılan açıklamada, saldırıdan etkilenen kullanıcıların zararlarının karşılanması için şirket kaynaklarından 6,34 milyar doların üzerinde fon ayırdı.
Daha önce etkilenen tutarın yaklaşık yüzde 80'lik kısmının karşılandığı anımsatılan açıklamada, "Karşılanan tutar artık yüzde 90'a ulaştı." ifadesi kullanıldı.
1 günde çalınan zararın %90'nı karşılayıp tüm mağduriyetleri gidermiş. Bizde 45 gün geçti yatırımcının zararının %10 ancak karşılandı:(
ChainGuard Recovery | Blockchain Investigations retweeted
1/ Binance exploit just passed 2 days, and so far the attackers (laundering team) have laundered ~$242M through the Tron leg alone, out of the $3.5 billion they still controlled after the freezes.
Here is the full analysis of the laundering from my tracing 🧵
ChainGuard Recovery | Blockchain Investigations retweeted
💁🏻♀️ZKProof for the latest PoR is ready, users can verify their balances on Binance are backed at a minimum of 1:1.
Please note that there is a time gap between the completion of the Proof of Reserves (POR) and the point at which users can perform their own verification. This duration generally depends on the scale of the assets and is beyond Binance’s control.
ChainGuard Recovery | Blockchain Investigations retweeted
A quienquiera que hackeó BINANCE:
Puede que estés celebrando. Descubriste una vulnerabilidad, ejecutaste el exploit y te fuiste con 1.450 millones de dólares en Bitcoin y 875 millones en ETH.
Pero lo que realmente adquiriste no es solo bitcoin. Adquiriste uno de los conjuntos UTXO más vigilados del planeta.
Cada empresa forense de blockchain ya ha etiquetado esos outputs.
Cada exchange, custodio institucional, proveedor de cumplimiento y investigador estará observando a dónde se mueven esas monedas. CoinJoin, puentes entre cadenas, mixers, peel chains, desks OTC, herramientas de privacidad... ninguna de ellas borra mágicamente la historia. El análisis de blockchain en 2026 es mucho más sofisticado de lo que mucha gente se imagina.
Lo que muchos hackers no logran apreciar es que Bitcoin no tiene prescripción. Cada transacción que hagas a partir de este momento se convierte en parte de un registro público permanente. Dentro de veinte años, la blockchain aún contendrá la historia completa de cada satoshi que muevas. Los datos no van a ninguna parte.
Las herramientas forenses tampoco se quedarán quietas. Modelos de aprendizaje automático, técnicas de agrupación de direcciones, inteligencia de exchanges, bases de datos filtradas, registros KYC, servidores incautados, grabaciones de vigilancia, registros de IP, metadatos telefónicos, registros de viajes y métodos analíticos futuros que ni siquiera existen hoy pueden combinarse retrospectivamente.
Los investigadores no necesitan resolver el rompecabezas hoy. Pueden revisitar exactamente la misma blockchain años después con mejor tecnología e inteligencia nueva, siguiendo tus transacciones históricas como si hubieran ocurrido ayer.
Como alguien que perdió bitcoin durante el colapso de Mt. Gox, sé lo que es ver cómo desaparecen tus monedas. Tomó años de incertidumbre antes de que recuperara algo.
Tú tampoco tienes absolutamente idea de a quién le has quitado el dinero. No son solo individuos y empresas. Algunas víctimas pueden tener recursos extensos, conexiones influyentes o antecedentes de los que no sabes nada. Entre cientos de personas afectadas podría haber exagentes de inteligencia, financieros adinerados, figuras del crimen organizado o personas con tanto los medios como la determinación para perseguir esto indefinidamente. Simplemente no sabes con qué intereses has chocado.
Muchas víctimas tienen historias similares. Algunas pueden restarle importancia. Otras pueden dedicar años, o mucho más, a identificar a los responsables. Simplemente no sabes quién está detrás de esas billeteras o cuán determinados pueden estar.
Si piensas que el desafío ha terminado porque el exploit funcionó, has confundido la parte más fácil con la más difícil. Robar el bitcoin fue el comienzo.
Vivir con él es el verdadero problema. Cada intento de cobrar, cada billetera que toques, cada servicio que uses, cada error que cometas, aumenta la probabilidad de conectar tu identidad en línea con la real.
Si estuviera en tu lugar, consideraría seriamente acercarme a Binance y negociar la devolución de los fondos a cambio de una recompensa razonable o una tarifa de auditoría. Probaste tu habilidad técnica.
Eso es mucho mejor que pasar el resto de tu vida tratando de mover una de las colecciones de bitcoin contaminado más notorias jamás creadas, mientras te preguntas constantemente quién está vigilando tu próxima transacción.
Solo lo digo.
ChainGuard Recovery | Blockchain Investigations retweeted
🚨 ¡LAS SALIDAS DE CAPITAL DE BINANCE YA SUPERAN LAS QUE PRECEDIERON AL COLAPSO DE FTX!
Los datos difundidos apuntan a que las salidas netas de Binance han superado las registradas por FTX antes de su quiebra.
⚠️ La comparación está disparando las alarmas en todo el mercado crypto, especialmente después del reciente hack de 6.300 MILLONES DE DÓLARES.
¿Estamos ante un pánico temporal o hay algo mucho más preocupante detrás de estos movimientos?
👀 ¡Todos los ojos puestos en Binance!
ChainGuard Recovery | Blockchain Investigations retweeted
🔎 Un faux entretien d'embauche, un logiciel espion et une IA interne détournée... Binance révèle le mode opératoire des hackers.
L'opération aurait été préparée pendant plusieurs mois, avec une première infiltration dès juin.
Tout commence en juin 2026, lorsqu'un ingénieur de l'équipe des portefeuilles télécharge une version piégée d'un outil de développement lié à l'IA. Binance détecte l'infection, remplace son ordinateur et renouvelle ses identifiants, mais les hackers ont déjà obtenu des informations sur son poste et ses collègues.
En septembre, ils changent de stratégie et approchent un autre ingénieur ayant publié son profil sur une plateforme d'emploi. Un faux directeur de projet lui propose un poste, puis organise un entretien vidéo avec un prétendu recruteur qui montre son visage et partage ses réseaux sociaux, remplis de photos et de vidéos personnelles pour inspirer confiance.
Un deuxième entretien est ensuite organisé avec le soi-disant CEO d'une entreprise qui, en réalité, n'existe pas. À la fin, l'ingénieur reçoit un exercice de programmation à télécharger et à exécuter sur son ordinateur professionnel. Le piège se referme....
Le code contient un logiciel malveillant qui remplace discrètement l'outil de développement pyenv par une version infectée, communique avec les serveurs des hackers et efface ses traces. Le système de protection de Binance ne détecte rien.
Le 20 octobre, les attaquants utilisent cet ordinateur compromis et un outil d'IA interne pour accéder aux machines de deux ingénieurs chargés des portefeuilles. Ils récupèrent des identifiants et des droits d'accès sensibles, puis attendent le 29 octobre pour déclencher l'opération.
Grâce au système de signature compromis et au mécanisme EIP-7702 d'Ethereum, ils obtiennent des autorisations malveillantes permettant de transférer des fonds hors du processus normal de retrait.
Même la suspension des retraits ne suffit pas à arrêter le pillage, car ces autorisations doivent être révoquées séparément.
L'enquête se poursuit, mais une chose est désormais claire, cette attaque ne reposait pas simplement sur une faille informatique. Elle a commencé par la manipulation méthodique de plusieurs employés.
ChainGuard Recovery | Blockchain Investigations retweeted
Binance’in kurucusu CZ, 6,3 milyar dolarlık saldırıyla ilgili Trump veya Washington’daki yetkililerle görüşmediğini açıkladı.
CZ, Kuzey Kore ile iletişim kurulabilmesi için ABD ve Çin’den yardım istedi.
ChainGuard Recovery | Blockchain Investigations retweeted
ternyata hacker binance masuk bukan lewat bug smart contract. awalnya dari aplikasi palsu sama interview kerja palsu 😳
semalam binance rilis laporan awal soal kejadian 29 okt. paman rangkum urutannya:
juni: engineer A di tim wallet nyari AI coding tool di mesin pencari, terus download homebrew (aplikasi buat install software di mac) yg uda diubah hacker. laptopnya ketahuan dan diganti, tapi nama dia dan timnya uda keburu kebaca.
september: engineer B dihubungi lewat situs cari kerja yg resmi. ada 2 kali interview, salah satunya video call. di akhir interview dia disuruh download "tugas" ke laptop kerja. isinya malware.
20 okt: dari laptop engineer B, hacker pakai AI tool internal binance buat masuk ke laptop engineer lain.
29 okt: akses itu dipakai buat jalanin layanan tanda tangan wallet. 233 juta XRP keluar dari hot wallet cuma dalam 4 menit.
total yg kena sekitar $6,34 miliar. yg uda dibekukan $2,85 miliar, dan 98% aset uda diganti pakai dana binance sendiri.
binance juga bilang sepanjang 2026 mereka uda nahan 57 percobaan serangan yg diduga dari korea utara. jadi ini bukan serangan sekali jalan, tapi disiapin berbulan-bulan.
buat kita: jangan download aplikasi dari iklan di hasil pencarian, dan hati2 kalau ada tawaran kerja atau "project" yg nyuruh download file.
kamu pernah dapet tawaran kerja crypto yg aneh kayak gini? 👀
ChainGuard Recovery | Blockchain Investigations retweeted
A Binance publicou um relatório preliminar detalhando como foi vítima de um roubo de mais de US$ 6 bilhões por hackers.
Tudo começou quando um engenheiro de software da empresa, que estava com o currículo ativo em uma plataforma de empregos, foi contatado por alguém que se passava por um diretor de projetos oferecendo uma vaga.
Os golpistas organizaram uma entrevista em vídeo com um suposto profissional de RH, com direito a rosto à mostra. Para baixar a guarda do engenheiro, esse "RH" chegou a enviar suas redes sociais, repletas de fotos e vídeos pessoais, parecendo ser alguém totalmente real.
Na segunda rodada, a conversa mudou para um aplicativo de chat comum, onde ele conversou com quem se apresentava como o CEO da empresa (que na verdade era uma fachada).
Quase no fim da entrevista, pediram que ele baixasse um conjunto de códigos para um teste técnico. O funcionário acabou baixando e executando o arquivo em seu computador de trabalho.
O script, durante a instalação, rodava secretamente em segundo plano e substituía uma ferramenta de desenvolvimento comum (pyenv) por uma versão modificada com um Trojan. O malware se conectava ao servidor dos invasores e apagava os próprios rastros, passando totalmente despercebido pelo antivírus da época.
A partir desse computador comprometido, os hackers se infiltraram gradualmente na rede até alcançarem o sistema de carteiras da exchange. Pouco mais de um mês depois, o golpe de mais de US$ 6 bilhões foi consumado.
O mais assustador é que o LinkedIn continua cheio de informações de funcionários atuais da Binance, que seguem como alvos em potencial desses grupos de hackers.
ChainGuard Recovery | Blockchain Investigations retweeted
Elliptic: Binance Hacker Uses CoinJoin for First Time as 44% of Stolen Funds Are Frozen
Elliptic said laundering of the roughly $6.43 billion stolen from Binance has involved 11 blockchains, around 12,000 wallets and more than 40,000 transactions. About $2.85 billion, or 44%, has been frozen or seized, while roughly $3.24 billion remains in linked addresses. Tron was a major route, with funds spread across about 7,700 addresses; the attacker has also begun using CoinJoin, while about $16 million was sent to addresses linked to the earlier Bitget hack.
ChainGuard Recovery | Blockchain Investigations retweeted
スゴイ手口だな💦
バイナンスの1人が求人サイトで応募
↓
チャットアプリ上で架空企業のCEOを装う人物と面接
↓
採用課題として悪意あるプログラムを含む開発用ファイル一式をダウンロード
↓
ハッカー侵入
バイナンス暗号資産1兆円盗難、偽の採用面接がハッカーの突破口に
approach.yahoo.co.jp/r/QUyHC…
ChainGuard Recovery | Blockchain Investigations retweeted
🚨 BITCOIN IS BEING MANIPULATED, AND I HAVE PROOF
Everyone is talking about how Bitcoin went down $3,500 in 15 minutes.
Everyone’s posting about it…
But almost nobody is explaining what actually caused it.
Stop staring at the chart. Look at the flows:
Within minutes, wallets tied to Coinbase, Binance, Wintermute, and ETF-linked addresses all became active simultaneously.
Large blocks moving between exchanges.
MASSIVE market sells hitting thin order books.
Why?
To trigger PANIC, liquidate longs, and pull new shorts into the market.
Here’s what really happened:
– Liquidity was thin
– Leverage was heavily stacked
– Funding was already stretched
So price gets pushed lower aggressively.
But here’s the part almost nobody is watching:
On November 27, one of the BIGGEST Bitcoin options expiries of the month hits.
And the level insiders are watching is $74,700.
That is where the manipulation gets interesting.
They push Bitcoin lower.
Liquidate longs. Trigger panic.
Force retail to short the breakdown.
And drag price toward $74,700 before expiry.
WHY?
Because that is where the options positioning becomes most profitable for the players already on the right side of the trade.
Insiders opened the positions first.
Then they move the market toward the level they need.
And once November 27 passes?
The pressure disappears.
The manipulation is finished.
And Bitcoin is free to continue higher.
That is why I’m watching $74,700 more closely than ANY other level right now.
And insiders don’t have to choose one side.
They can attack both:
Push Bitcoin lower. Liquidate longs. Trigger panic. Pull new shorts into the market.
Make everyone believe the bull run is OVER.
Then, once retail starts panic-selling and the leverage is gone…
BUY THE SAME BITCOIN BACK CHEAPER.
If you’re new to this market, understand one thing:
Bitcoin almost never makes violent moves like this because of headlines alone.
It moves toward liquidity.
Watch funding rates. Watch open interest. Watch the liquidation map.
Reminder: I called the Bitcoin top at $126,000 and told you to start buying again around $60,000.
The next call will matter even more.
When I EXIT the markets completely, I’ll post it here publicly like I always do.
Turn notifications on.
If you’re not following yet, you’ll understand why that was a mistake later.
ChainGuard Recovery | Blockchain Investigations retweeted
The funniest part of the Binance hack is CZ pretending he doesn’t run Binance anymore
It’s okay brother
We know
ChainGuard Recovery | Blockchain Investigations retweeted
BINANCE ON HACK: WILL ABSORB THE FINANCIAL IMPACT OF THESE STOLEN FUNDS, NOT OUR USERS
ChainGuard Recovery | Blockchain Investigations retweeted
Alright guys.
Stop talking shit about the #Binance hack.
I’m one of Binance’s harshest critics, and I do not trust this crypto bank.
I brought the Trump-Binance deal and plenty of other issues to your attention here.
I was reporting on the October crash and Binance from the very first minutes, with concrete numbers and facts.
That is precisely why I won’t pretend we have evidence for the inside-job stories and other nonsense circulating now.
The reality is already ugly enough without adding accusations we cannot substantiate.
Some of the self-proclaimed researchers on here are taking this way too far.
I’m watching people make confident claims about things they barely understand, then circulate speculation until repetition starts looking like evidence.
If I cannot substantiate something after digging through the available evidence, I seriously doubt most of the accounts shouting about it have done better.
Anyone with stronger evidence should publish it. My distrust of Binance does not give me permission to make shit up, and yours does not either.
I don’t believe this was an inside job, and I haven’t seen credible evidence that the accounts supposedly predicting it had advance knowledge or were involved.
The FBI has attributed the theft to North Korea’s TraderTraitor operation.
It’s 2026, crypto hacks are routine, and an exchange holding billions is an obvious target.
Binance has serious questions to answer about how its security controls failed this badly, but recognising that risk beforehand does not make someone an insider or a fucking prophet.
On the financial side, public estimates suggest Binance generates billions in annual revenue.
Binance says it allocated more than $6.34 billion to cover the theft and, as of November 1, has replenished approximately 95% of the affected assets.
I think it is plausible they can absorb the loss, but revenue is not profit or available cash.
Without a reliable, complete picture of the group’s finances, this remains a black box whose assurances we cannot independently verify in full.
That money did not appear out of nowhere.
Customers helped build this business and its financial resources through the fees they paid, and they continue funding it every time they trade.
An additional customer charge is inevitable.
Covering billions in losses consumes real resources, and rebuilding those buffers has a cost. Calling it company money does not erase where much of that money came from.
My recommendation remains self-custody, with proper key management.
You have just experienced what it means to leave your money somewhere that can suspend your access to it.
A balance displayed in an exchange account does not give you control over the keys or the decision to reopen withdrawals.
And to everyone confidently declaring Binance insolvent: show the evidence.
I don’t believe they are, but years of estimated revenue cannot prove their current solvency.
Binance has access to financial information the public does not.
Until that information can be independently assessed, certainty in either direction is bullshit.
I refuse to trust this bank blindly, and I refuse to invent evidence against it just because I despise how it operates.
ChainGuard Recovery | Blockchain Investigations retweeted
Binance、約1兆円相当の暗号資産が流出した問題に関し、検索エンジンに表示されたWebサイトから改ざんされたHomebrewをインストールした事が始まりだったと発表。 applech2.com/archives/202611…
ChainGuard Recovery | Blockchain Investigations retweeted
🚨 BINANCE ACABA DE PUBLICAR EL INFORME DEL HACKEO
Basicamente fue un ataque de phishing mediante ingenieria social dividido en dos partes
La primera: uno de los ingenieros descargo una version falsa de Homebrew a traves de un enlace fraudulento en Google
Aunque el equipo de seguridad detecto la anomalia y cambio el equipo
El rol y los colegas del ingeniero ya habian quedado expuestos
La segunda: otro ingeniero tenia su CV en un portal de empleo
Alguien que se presento como Project Director lo contacto
Primera ronda: entrevista por video llamada con un HR
El HR le mando su red social con fotos y videos personales para generar confianza
Segunda ronda: en una app de chat con alguien que decia ser el CEO de una empresa ficticia
Al final le pidieron que descargara un ejercicio de codigo como prueba tecnica
Lo bajo y ejecuto en su PC de trabajo
- El codigo reemplazo una herramienta legitima (pyenv) por una version con malware
- Se conecto al servidor de los atacantes y borro sus huellas
- El antivirus de Binance ni lo detecto
Desde ahi los atacantes usaron una herramienta interna de IA para comprometer a dos ingenieros mas del equipo de wallets
Y el 29 de octubre vaciaron hot wallets en minutos
~6.340 MILLONES DE DOLARES
Segun el FBI, detras esta Corea del Norte
Binance dice que cubre todas las perdidas
Ya repusieron el 98% de los tokens afectados
Y congelaron ~2.850 millones on-chain
Stay safe
Y NUNCA uses el PC de la empresa para hacer otras cosas
ChainGuard Recovery | Blockchain Investigations retweeted
The only thing I have to say about the North Korean hack of Binance is, get used to it, it's only going to get worse for you.
ChainGuard Recovery | Blockchain Investigations retweeted
DATA: North Korea’s Lazarus Group has stolen ~$11.87B in crypto to date, equivalent to 45% of North Korea’s GDP following the $6.3B @Binance hack, per @Darkfost_Coc.
