1/ @Truebitprotocol appears to have been exploited for roughly $26M. As of now, the team hasn’t posted an incident update on their official socials, but we’re have seen large outflows from protocol-linked contracts plus on-chain communications consistent with a compromise. Exploiter: 0x6c8ec8f14be7c01672d31cfa5f2cefeab2562b50

We are actively monitoring the situation and, so far, have identified dozens of theft-related addresses. The tracer below maps EVM outflows from victim wallets, already totaling hundreds of transactions. Thanks to @zachxbt for early alerts. We’ve also observed onward movement into centralized exchanges. For example, 0x463452c356322d463b84891ebda33daed274cb40 has made deposits to multiple CEX deposit addresses like ChangeNow, HTX, KuCoin. Please refer to the images below. If you believe you’ve been affected, we can help with tracing, attribution, and preparing evidence for exchange escalation.

1/ Just yesterday we were discussing CPIMP attacks, and now we have a live example: @USPD_io has been exploited for ~$1M via a malicious backdoor proxy planted over 2 months ago. All the drained funds were swapped to ETH. The exploiter currently holds ~$1.05M at this address: 0x083379bdac3e138cb0c7210e0282fbc466a3215a This wasn't a flash loan attack but a sophisticated "sleeper" job.

On Nov 3, @Balancer V2 Composable Stable Pools were exploited, draining ~$129M worth of assets across multiple networks. The majority of funds currently sit on Ethereum, ~$90M, while a substantial portion has been recovered. In our latest report, we break down what went wrong in the math, how the attacker moved funds, and where the crypto is sitting now, with full root cause analysis, on-chain forensics and tracing. Link: research.blockscope.co/balan…

Today, @gardenfi was exploited, resulting in multi-chain outflows across Arbitrum, Ethereum, BSC, and Solana. Current loss estimates are around $10.8M, with the majority of funds currently held on Ethereum, BSC, and Solana. Exploiter addresses: •0x98bcc6c34a489cefdd9dfa8d792cfefb02ea2d12 •WZy4xxpqktWa1b6MPMRiWsD487CT8mDcapB6GufBJCH In June 2025, @zachxbt alleged that Garden’s fees were largely sourced from laundering flows tied to the Bybit hack. Image 1: Wallet Profiler showing the exploiter’s ETH holdings Image 2: Garden Finance team reaching out to the exploiter with a white-hat bounty offer

On Sept 22, @UXLINKofficial’s multisigs were compromised. The exploiter minted trillions of $UXLINK on @arbitrum , drained treasuries, and bridged proceeds to @ethereum. Our analysis confirms, so far ~$41M held in DAI and ETH across 10 wallets. This was a chaotic incident: A project nearly collapsed, the hacker was phished mid-operation, and early loss figures varied widely. Read more: research.blockscope.co/uxlin…

Yesterday, @rcmpgrcpolice dismantled @TradeOgre, a crypto exchange, for illicit activity and alleged AML failures. It’s Canada’s largest crypto seizure to date, nearly $56M in seized assets. On-chain analysis reveals that the exchange ops halted in late July while seizures began Sep 15 across BTC/ETH/XRP/LTC/TRX/Qubic. As of now, all the users funds remain frozen. Read the full story: research.blockscope.co/rcmp-…

@zachxbt just flagged a fresh exploit: ~$3.047M USDC drained on Ethereum. Attacker swapped to ETH and funneled into Tornado cash. Exploiter: 0xf0a6c5b65a81f0e8ddb2d14e2edcF7d10c928020 Blockscope’s quick pass: • Victim appears to be a Safe (Gnosis Safe multisig) • Two theft txs: ≈$3.0M + ≈$47K • Traces show a possible association of the victim with @SingularityNET.

🚨 Yesterday, Billions of npm sessions put at risk, yet the attacker only netted a few hundred dollars. Blockscope did a thorough analysis of the situation, decoded the malware, traced early on-chain signals & analyzed how to harden against this vector. Read the full analysis: research.blockscope.co/npm-h…

1/ A @VenusProtocol user got vicitm of a phishing attack, losing nearly $27M. The incident happened when the vicitm signed a malicious tx, updateDelegate function approving the attacker. Tx hash: 0x75eee705a234bf047050140197aeb9616418435688cfed4d072be75fcb9be0e2 Image: Transaction Decoder showing signed delegateUpdate function by the victim

🚨New Tutorial: Cross-Chain Tracing 🚨 We break down the @CoinDCX hack, showing how investigators & analysts can trace multi-hop transfers step by step. No auto-tracing. No AI. Just the simplest manual method using explorers + decoded input data. 🎥 Watch here: youtube.com/watch?v=zMxYGZIK… Cross-chain forensics is possible with core knowledge and Blockscope just makes it faster & smarter.

1/ Yesterday @zachxbt highlighted a major social engineering theft where a victim lost 783 BTC (~$91M) after impostors posed as exchange & hardware wallet support. Using Tracer, we tracked the stolen funds: • Funds were funneled through a peel chain • Few addresses made deposits into CoinJoin Mixers (Wasabi). • A significant portion of BTC still sits in related addresses.

@coinbase Approval Exploit: Mis-scoped Allowances Open the Door to MEV Drain On August 13, 2025, a configuration error—approving ERC-20 allowances to the @0xProject Mainnet Settler—led to a ~$550K drain from Coinbase’s fee-receiver wallet via an MEV bot exploiting permissionless execution. This wasn’t an exploit in the traditional sense, but rather a misconfiguration. Comparisons have been drawn to @zora 2025 composability attacks, which resulted in ~$203K in combined losses across two incidents, highlighting how stronger controls could have prevented or mitigated both cases. Read our full breakdown: technical timeline, on-chain activity, risk insights, and prevention strategies: research.blockscope.co/coinb…

1/ 🚨 Earlier today, @BTCTurk, a Turkish crypto exchange, was exploited for nearly $48M where more than 90 types of tokens were drained. Early patterns suggest a private-key compromise or insider access. Image: Tracer shows multiple outflows from hot wallets to the exploiter.

Following the $4.4M exploit of @CrediX_fi, users were told a deal had been struck with the attacker and funds would be returned within 24–48 hours. But now it seems the team has vanished. 🔇 The X account is inactive 🕸️ Website has been offline since Aug 4 But our Watchtower is still monitoring the exploiter, and a part of the funds has been moved to @TornadoCash. 🔗:blockscope.co/community/watc…

The biggest crypto heist ever—hidden for 5 years. Last week, @arkham uncovered the 2020 LuBian Hack: 🔻 127,426 BTC stolen 🔻 $14.5B in value today 🔻 No disclosure, no trace—until now. Even the Bybit hack is pale in comparison. Read our latest article on how the biggest theft in crypto went unnoticed: research.blockscope.co/augus…

1/ 🚨 In the early hours of today, @CrediX_fi was exploited on Sonic for ~$4.56M today. Setup: a compromised admin account (0xF321…662e) with BRIDGE/other roles was used. Six days earlier, the multisig added the attacker via ACLManager. Setup tx: sonicscan.org/tx/0x0cc352095…