Kyle Estes

Nomad update: a primary attacker appears to have stolen the largest single portion of the funds, approx $95 million. The rest of the stolen funds were distributed to a much wider spread of wallets, which could represent distinct attackers — or opportunists 1/3

TRM investigators are tracking a 55% month-on-month increase in the number of phishing attacks deployed through Discord in June 2022, with dozens of these recent account compromises likely being related. Read the full report here: lnkd.in/eUN-iP6m

The NFT community has suffered more than 150 compromises targeting NFT projects' Discord servers since May 2022. A sampling... (1/2)

...of TRM's analysis indicates dozens of these attacks are likely related. In the recent Yuga Labs exploit, a consolidation wallet used by the attacker was linked to wallets with direct exposure to other compromises from May & June. Read the report: bit.ly/3z3LJJf (2/2)

Unfortunately, this prediction was spot on: #harmonybridge attackers started moving the stolen ETH into Tornado Cash this AM at a speed that reminds us of the #ronin hack 💨. An eerily familiar on-chain pattern we see when following funds stolen from #defi exploits:

The ~$100 million in assets stolen from @harmonyprotocol 's bridge have been swapped for nearly 86K ETH and are now sitting in the original hack address👇. Next stop - a mixer? 🌪️ etherscan.io/address/0x0d043…

What keeps crypto compliance teams up at night? Next week's #TRMTalk is a live discussion with experts from @FTX_Official, @BatesGroup, @Clifford_Chance and @trmlabs on hot topics 🌶️ of the day. Join us on June 23 here: bit.ly/3Okb47S

📰 Big news today at TRM || CSITech — the leading crypto investigations training firm led by Nick Furneaux — is now part of the TRM family! Get the full scoop here: bit.ly/3aTIefY and learn more about our growing suite of training offerings here: bit.ly/3NRUj3O

Hey...we know that guy 👀 .@trmlabs is honored to be included on the @Forbes Fintech 50 list — one of 9 crypto companies featured this year. forbes.com/sites/ninabambysh…

Fresh alpha: the TRM crew is at @money2020 Europe this week and there's a hot 🔥 NFT drop scheduled! Stop by the TRM booth at A66 to see the 🌷 collection and enter to win 🖼

Thrilled to welcome Wei Wang and Chini Reddy to TRM, who join as senior legal counsel from @Uber and @Tinder, respectively. Let's go, legal team 🚀

Proud to announce the launch of a new tool for the crypto community today, @chainabuse — a multi-chain platform where you can report and alert others to scams and fraud. It's free to use; join us in making the crypto economy a safer place to operate: chainabuse.com

Earlier today, @DeusDao, a market for #DeFi services, lost ~$13.4M in a flash loan attack that manipulated its price oracle. A similar attack occurred only weeks ago for a loss of ~$3M. In both, @TornadoCash was used to prime the attack wallet and attempt to obscure stolen funds.

Yesterday, the compromised #BAYC Instagram account phished users into signing a safeTransferFrom transaction via a fake airdrop. 134 NFTs were stolen & sold for ~$2.4 million in WETH. As we monitor attacker flows👇, let’s look back to similar NFT scams 👀:bit.ly/3vf7Pb0

New #OFAC sanctions added 3 ETH addresses associated with #LazarusGroup. They received funds from the initial sanctioned address associated with the #RoninHack. TRM continues to track the movement of funds on chain.

Moments ago, OFAC sanctioned an Ethereum address as part of a sanctions package against North Korea state-sponsored cybercriminal group #Lazarus. @trmlabs analysts tied the same address to the #Ronin Bridge hack....

Three years after the fall of ISIS’s physical caliphate, crypto-based fundraising campaigns for ISIS families remain a significant driver of crypto use and innovation among ISIS supporters. Read the report from TRM's Threat Intelligence team here: bit.ly/38yJvb5

TRM has detected more than $135 million in cryptocurrency donation campaigns for #Ukraine between February 22 and March 28 alone. Read findings from our analysis of 50+ campaigns here: bit.ly/3qKNU0L

Our investigation of the #Ronin exploit reveals the stolen 25.5 million USDC were swapped for ETH via @Uniswap V3 and @1inch within 30 minutes of the heist. Yet, no further transactions occurred from the hacker’s primary address from then until Wed, 3/28. 1/3