IOC Investigations

🕵️‍♂️ It really feels great to help people during dark times Today we helped @NiwinEth, a proud owner of @cryptopunks #8832! Their wallet was compromised, which saw the theft of the Punk among other assets! 😱 This is how it started ⬇️ Then @lorepunk got in touch on Niwin's behalf and we didn't hesitate! 1️⃣ The first priority is always secure any remaining assets. 2️⃣ Then we set about doing what we do best - Tracing 3️⃣ We also need to try to understand the cause! 4️⃣ Next, we watch and wait. This is where the break came from. The Punk was sold for 40 ETH and that was deposited to @okx 5️⃣ Now it's all about timing and luck. Luckily on this occasion, we caught it in time. 6️⃣ OKX didn't hesitate either - they were successful in freezing the proceeds. 7️⃣ Now its all about law enforcement - They NEED to get involved. @NiwinEth is working hard to achieve this! Here is how it is now! Still work to do but Niwin now has a much higher chance of success. Best of luck @NiwinEth 💙

SlowMist has published analysis of a tampered version of the Udesk customer-service script, the kind of chat widget many exchanges and fintech sites embed without a second thought. The modified script quietly loaded a second payload from a lookalike domain (udeskqlobal[.]com, with a "q", not a "g"). On any site that loaded it, it collected cookies, browser storage and anything typed into login, sign-up and password forms. On three specific crypto exchange sites it went further: it replaced the deposit addresses shown on the page across six networks (BTC, EVM, TRON, Solana, LTC, DOGE) and hijacked the copy button and clipboard. That last detail is the one I'd want every user to understand. The usual advice is "check the address you pasted matches the one on screen". Here, both were the attacker's. For platforms: third-party scripts run with the same access as your own code. Pin versions, use integrity checks and restrict where scripts can send data. For users: confirm a deposit address on a second device or in the official app, and compare it against a previous deposit before sending anything large. What's your second check before you send to a deposit address?

Predict[.]fun, a prediction market on BNB Chain, has now confirmed roughly 400,000 USDT taken from a small number of user wallets. Its preliminary view is that its API documentation site, hosted by a third party, may have been compromised. The site is offline, full reimbursement is promised, and a post-mortem is coming. What stands out from the on-chain work: independent analysts say each withdrawal was signed with the victim's own wallet key, just not through the app. One tracker counts this as the second hit in five days. No smart-contract bug and no bad approval. Someone was able to sign for those accounts. That is the uncomfortable pattern this month. Bloom (a third-party module), NGRAVE (a third-party notification service), Keystone (a third-party monitoring tool) and now Predict.fun: the weak point sat next to the user, not with the user. If a platform holds or generates your keys, its suppliers are part of your security. If you were affected: rotate any key that touched the platform's API, and treat every "claim your refund" message or link as hostile. A genuine refund comes through the platform itself. Where do you draw the line on trusting platform-managed wallets?

Are crypto recovery services legit? Red flags: ❌ they contacted you first ❌ upfront fee ❌ they promise your money back ❌ they want your seed phrase That's a recovery scam. Free case assessment from Intelligence On Chain (IOC) @ioc_support

Your iPhone's iOS version is now part of your wallet security. SlowMist says the DarkSword exploit kit can grab crypto wallet data just from opening a malicious page in Safari. Window: iOS 18.6–18.7.2 and 26.0–26.1. When did you last update? 👇

Scammers!