1/ CERBERUS, our monitoring engine, alerted us that the attacker behind the @x100global exploit has begun laundering funds through Tornado Cash. The following addresses made deposits: 0x8296721489d0a7e934edd66ea27159b1c88a42e5 ↳ 420.8 #ETH across multiple deposits of 0.1 and 10 ETH. 0xF637DCeE7Dd96E8FDaB926C5993D558B52D635ea ↳ 400.4 #ETH across multiple deposits of 0.1 and 100 ETH.

An hour ago, @x100global was exploited for ~$4.75M in #USDT on Ethereum. Our initial tracing shows the stolen funds were swapped to ~2,022 #ETH via Uniswap and are now split across 5 addresses: 0x8296721489d0a7e934edd66ea27159b1c88a42e5: 422 ETH 0xf637dcee7dd96e8fdab926c5993d558b52d635ea: 400 ETH 0x64b135af3d80733c9c290d58873e2cccb34a81ae: 400 ETH 0x4fdb9f9a44b356c8a9c2ea060a40fb7a9caabef3: 400 ETH 0x6790cf09ba33d05ada2c13cbb4104f5b8b666391: 400 ETH We’re monitoring these addresses and will post updates.

An attacker exploited the Newmont (NEM) token contract on BNB Smart Chain and drained ~$726K in #USDT. Attacker: 0xFd929B0F270DFeA6C4827262b4E2bF6Ea50FE9b6 Fund flow (traced by HYDRA): 1. Stolen USDT bridged from BNB Smart Chain to Ethereum via Relay. 2. USDT swapped for 296 #ETH on CoW Swap across 3 transactions. Current status: The funds are still held at the attacker’s address: etherscan.io/address/0xfd929… We’re monitoring the address and will post updates if the funds move.

1/ For the past 3 weeks we’ve been upgrading our systems based on what we learned in the last testing period. The latest changes to the HYDRA automated tracing engine are showing impressive results. Here’s a real-world test case 🧵

1/ HYDRA, the tracing engine behind Noxos Intelligence, has finished its 2-month testing phase. Our in-house team and a group of volunteer private investigators ran 240+ multi-chain traces through it. Here's what comes next 👇

You're paying out selectively and still collecting deposits. From Aug 29 to Sep 8, all 148 stablecoin payouts from BitMart 16 were under $100. On Sep 18 it sent $106K to 17 addresses in under three minutes. Hours later you swept deposits sent after your July 26 suspension. On-chain, Aug 29 to Sep 28: - BitMart 16 made 169 stablecoin payouts (~$119K) and has sent nothing since Sep 18. It still holds ~277 ETH and ~$131K in stablecoins. - A BitMart-attributed Solana hot wallet paid 36,030 USDC to four Binance deposit addresses on Sep 23. It still holds 222K USDC and 2,894 SOL. - You suspended deposits on July 26: bitmart.com/en-US/support/ar… On Sep 18 you still swept at least $19K in deposits made between Aug 22 and Sep 15 into your hot wallets. Example, 4,000 USDT deposited Aug 29: etherscan.io/tx/0xd554dd7613… On May 23 you said you'd publish proof of reserves: bitmart.zendesk.com/hc/en-us… You still haven't. On Sep 9 you said you'd update users on the action plan within three weeks: bitmart.com/en-US/support/ar… That's Sep 30. The update needs to answer: 1. What qualified users for the Sep 18 and Sep 23 batches: amount, VIP status, request date? Why was every payout from Aug 29 to Sep 8 under $100? Where is everyone else in the queue? 2. Were the post-suspension deposits you swept credited to their senders? If not, when will they be returned? 3. Your User Agreement (§2.7.1) says assets in customers' wallets are not BitMart's property, cannot be lent out, and are not subject to creditors' claims: bitmart.com/en-US/support/ar… Are they all still there, 1:1? If yes, why does your Aug 21 update talk about distributions to creditors? bitmart.com/en-US/support/ar… 4. On what date will you publish assets and liabilities by asset, with a Merkle tree users can check their own balances against? 5. Since July 1, has any insider, affiliate, VIP account, market maker or listed project withdrawn while other users waited? Yes or no, and how much? 6. Who is the independent custody overseer, and on what date does it take control of keys and withdrawal approvals? 7. Will users face any haircut, forced conversion or lock-up? What is the date of the first distribution?

1/4 Flamincome Finance (@flamincome) has reportedly been drained for 345,902 #USDT on Ethereum. The attacker swapped the funds to 144.1 #ETH via LiFi and deposited them into Tornado Cash across 37 transactions. Details 👇

7/ We'd like to hear from law enforcement or anyone in a legal role who can check this case and act on it. This is not a one-off. A few weeks ago one of our own team got a call from "Binance Support." They said his funds were at risk because of new EU rules (MiCA) and he had to move them to a "safe wallet." The wallet was a Trust Wallet browser extension with a seed phrase the scammers had made themselves — and sent to him by email. These scammers are getting bolder. They belong in jail, but that takes government agencies around the world working together. If you're reading this, please share it. The more people who see it, the better the chance it reaches someone who can act.

1/ A user contacted us claiming his Ledger wallet had been hacked. A short conversation made it clear the hardware wallet was never compromised. He was social-engineered: a phishing message told him his funds were "at risk" and walked him into transferring them. The pattern points to an organized group. Law enforcement should look at this one. Details 👇

1/ Following up on our previous thread — here's the trace for the Aug 10 attack, ~$870K+ drained. Attacker address: 0x5172F58981ddD5230F4650e8809A83263A5F2c0e Ethereum again as the starting chain. The full investigation is ongoing; we'll publish the rest once it's finalized. This thread covers the #Ethereum branch only. Breakdown👇

1/ Two wallet-drain campaigns across multiple EVM chains were reported this month. Aug 25 — ~$500K+ drained Attacker address: 0x861EbCC056e0645cF7BA7F5BB528faE9fbA8BA55 Aug 10 — separate incident, ~$870K+ drained Attacker address: 0x5172F58981ddD5230F4650e8809A83263A5F2c0e Different addresses. Whether it's the same actor behind both is still open. Both drains span several EVM chains — we're starting the Aug 25 trace from Ethereum and following the funds out from there. Breakdown 👇

1/ On August 23, @term_labs (Term Finance) was exploited for ~$8.5M on Ethereum. We ran the incident through our HYDRA engine — and for the first time, we're publishing results from both tracing modes: Forward tracing — point at a source address, HYDRA follows the funds to their final destination. Backward tracing — select any address, HYDRA reconstructs the path funds took before arriving. Attacker wallet 1: 0xa908b3472d76e7744baB0A5911768a4a6300612B Sent the stolen 2800 #ETH to the consolidation address: 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 Attacker wallet 2: 0x686457a7468B9B31c5dbA43b1b16077B48520691 Swapped the stolen ~1.7M #USDC to #DAI and moved it to the same consolidation address. From there, the attacker began depositing into Tornado Cash.

On August 19, @Allbridge_io was exploited for $189,751 The attacker (0x2419432344b0B892E592b2601B98eaE702Ba360e) swapped the stolen #USDC into #ETH — putting it out of reach of Circle's freeze function — then bridged from #Base to #Ethereum and forwarded the balance to 0x1fb4cf26ce82ad4dcd8f055a4092c625cebbdb85. The funds are still sitting there, untouched.

On August 9, #Coinsbuy was exploited for roughly $8M across two chains - #Ethereum and #Tron. Several independent investigators reported the stolen funds moving into the FixedFloat and ChangeNOW instant exchanges. We ran the case through our newly upgraded HYDRA engine and independently confirmed those deposits. Beyond that, we identified two CEX exit points: #HitBTC and #BingX. Given the size of the theft, we tightened the tracing criteria and narrowed the time window - fewer hops, higher confidence. HitBTC: 30 #ETH sent directly from one of the theft wallets. BingX: 100 #ETH, routed through multiple intermediary addresses before the final deposit. We've also completed an extended trace that surfaced considerably more. That stays internal until every hop is verified.

Noxos Intelligence - Engine Update Investigations and public reports resume in the coming days. As you know, we've been running HYDRA against publicly reported exploits as test cases. Those runs exposed the engine's weak points, and we've spent the past days closing them. ✅Shipped: - 9 updates to the tracing engine, across multiple algorithms - Bitcoin integration nearly complete - Backward tracing rewritten - enabled within days 🔃In progress: - Our known-address database is being rebuilt to 10-20x its current size. Broader coverage means better attribution and higher tracing accuracy. - A few more updates land this week, then testing resumes. After that, we'll run full investigations on every incident reported over the past week and change, and publish the results.

🚨To private investigators, law enforcement, incident response and security teams — read to point 6. While testing our HYDRA tracing engine against publicly reported exploits, we observed an attacker behaviour worth flagging. The known patterns first: 1. Fragmentation. Funds are split across hundreds to thousands of addresses to inflate the search space. 2. Token poisoning. Attackers deploy synthetic ERC-20 contracts reusing the name and ticker of major assets — #USDT, #USDC, #ETH, #BNB, etc — polluting the graph with worthless transfers that read as legitimate flow. 3. Bridges. Cross-chain hops remain core to the arsenal, breaking continuity for any engine that doesn't reconcile across chains. 4. Mule CEX accounts. Tracing frequently terminates at an exchange account registered to someone who has no idea what it is used for — they were paid to open it. The trace is technically correct; the identity behind it is not the one you are looking for. 5. Mixers. Mixers remain the hardest break in any trace. As noted in an earlier post, we already have work underway here — an engine aimed at raising the share of mixer-involved cases that reach a resolution rather than stopping at the deposit. 6. The one we are seeing now — spoofed deposit behaviour. Normally a user deposits to an exchange-controlled address they don't own. The exchange sweeps those funds to its hot wallet and pays the gas itself. Most tracing engines rely on that pattern: an address that forwards into a known hot wallet gets labelled a deposit address for that exchange, and automated tracing stops there — the funds are treated as being inside the CEX. Attackers are now targeting the heuristic itself. After obfuscating across multiple hops, they send directly from their own wallet into the CEX hot wallet, skipping the deposit address entirely. The engine sees the hot-wallet inflow, mislabels the attacker's wallet as a deposit address, and closes the branch. The attribution is wrong and the trail ends early. We are tuning HYDRA to separate genuine sweeps from spoofed deposits. A full write-up follows in the coming days. If you have seen the same behaviour, we would like to compare notes.

🧵A few days ago, a victim of a honeypot scam reached out to us after his funds were stolen. Our first step was to run the malicious contract - unverified on-chain - through our PROMETHEUS engine to see what we were dealing with. It was every bit as nasty as expected. (Screenshots below 👇) Next, we ran a trace with our HYDRA engine, and the results were staggering - one of the most complex obfuscation setups we've come across. Hundreds of thousands in funds had been stolen from multiple victims, all broken into small amounts between $20 and $50, then bridged through Relay to hundreds of addresses across multiple chains and assets, over hundreds of transactions. The video below shows just the first few steps of the laundering process. Despite the complexity, our HYDRA engine successfully traced the funds all the way to multiple CEXs.

On August 2nd, LOOPSDAO / LpdFi (BSC) was exploited for ~$690K. Using a malicious smart contract, the attacker funneled the assets to this address: 0x5d289266d85EF671561bA3F253FB79327C193f33 From there, the funds were sent to a second address: 0xa16f5ba49954C5ed6273CF8578586bE4344F8968 Here they were converted from #USDC to #BNB via Relay, then deposited into Tornado Cash. We used our PROMETHEUS engine to reconstruct the contract. For security reasons, we can't share much detail publicly.