Researcher | 2D investigator Support my work ↓
Joined December 2020
- Tweets4.8K
- Following301
- Followers516
- Likes20.2K
This is the beginning of the end...
It's only a matter of time before their data becomes public.
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
Mike | 0x Web3 retweeted
Managed to work with @circle (🤯) to help coordinate another $201k of @bitget proceeds being frozen.
The launderers were trying to shift funds between EVM and Noble, but CCTP has limits on the amount which can be bridged out of Noble. One of their transfers hit the cap and sat pending in the bridge.
That gave a window to get Circle to blacklist the destination address before the limit reset. The transfers can't settle, so $201k is now stuck between Noble and Ethereum, which could provide a path to recovery through legal process.
Mike | 0x Web3 retweeted
Hello kindly advise why addresses linked to you received 4.87K ETH ($15M) from the Raidparty $70M exit scam and why those funds were transferred to CEX deposit addresses?
You disappeared in 2022 and now reappear in September 2026 like nothing happened….
Funny hearing "cops from some hole" from a casino licensed in Anjouan (Comoros, GDP per capita ~$2,000).
When ~230 ETH from the Coldcard hack landed on your platform, did you also wait for the victim country’s GDP to become “significant”?
Offshore classic: Immortal Snail LLC in Nevis, a Comoros gaming license, official X account @[]duel
suspended.
All that’s left is a mouthpiece laughing at other people’s police.
Come back when your AML is more serious than your tweet, and the account isn’t suspended.
This Post is from a suspended account. Learn more
$U tokens are on the move, @union_build
Right now, we're seeing consolidation: dozens of addresses that participated in the initial $U claim are transferring tokens to several other addresses that also previously claimed $U.
I covered the connections and the initial distribution of $U in more detail here:
UNION: fake "distribution" of $U full on-chain picture
teapawt.net/its0xMike/status/20276…
The distributed tokens are now starting to consolidate into larger batches.
Accumulation addresses:
0x7e109397BD09E0bD5B92761766838a55B30B4ae2
0xea12ae5743e7d552ac9a927e8ee857c96e748c3b
I'm continuing to track where the funds move next.
Update:
the consolidated $U has now moved.
The 5 collector wallets I flagged earlier all routed into a single hub:
0x50254276575078722195d976667748c0223b0F38
From there the tokens were deposited to Gate:
0x0D0707963952f2fBA59dD06f2b425ace40b492Fe
Flow:
1000+ claim wallets >> 5 collectors >> 1 hub >> Gate
A separate large batch also entered the same hub from 0x713Ee84e…33C14 on May 25, after funding from a Bybit hot wallet on Oct 7, 2025.
Observed deposits to Gate from this hub:
May 25: 77,316,963 $U
Aug 28: 6,211,492 $U
Aug 28: 8,739,612 $U
Total withdrawn: ~92.27M $U
That’s ~0.8-0.9% of the 10B genesis supply
and ~4.2-4.8% of the ~1.919B circulating supply.
At TGE this was worth roughly $1.1-1.6M.
By the time it was withdrawn to Gate, it was around $28k.
@union_build
I consider the $U fake decentralization story closed at this stage.
We identified 1000+ freshly created wallets with no activity beyond the $U claim, tracked their consolidation, and confirmed the exit to Gate.
The same pattern is now playing out with ETH: leftover gas sent to those wallets, mostly from Binance, is being swept along the same route.
No explanation from the Union team.
Mike | 0x Web3 retweeted
1/ Meet M1llionz (RichMilly666), a French cybercriminal allegedly laundering assets from two violent home invasion robberies in France in April 2026 that netted $667K total, with a history of openly posting about bank and retail fraud on social media.
My work has led to a $93K Tether freeze directly tied to these attacks so far.
There are no secure hardware wallets.
Is there any safe hardware wallet?
Ledger data got leaked, Trezor data got leaked, ColdWallet incident just recently
Best way literally is to get a brand new clean phone, install a software wallet and use that phone as a hardware wallet
just as @zachxbt recommended to do
Mike | 0x Web3 retweeted
1/ Meet Tiffany Milanovich, a US based threat actor tied to at least $5M in thefts from hardware wallet and centralized exchange support impersonation scams.
She's recorded herself taunting victims on calls after draining their funds.
Tiffany openly flaunts luxury purchases, stolen funds, and casino gambling on social media.
An old method, but it still works.
Unfortunately, it has only worked for me a couple of times at most.
OSINT Tip: GitHub OPSEC Mistake by Threat Actors
When investigating threat actors that use GitHub as a malware distribution platform, check whether the commit was uploaded via the GitHub web interface.
If so, the commit author's email may be linked to the GitHub account, meaning you may be able to obtain the threat actor's email address.
→ GET /repos/<user>/<repo>/commits → commit[.]author[.]email
or
→ Append .patch to the commit URL and inspect the From: header.
Bingo.
You can then pivot on that email using OSINT platforms or manual research to uncover additional information about the threat actor.
Note: This only works if the actor has disabled GitHub's "Keep my email addresses private" setting. If the setting is enabled, the author email will appear as …@.users.noreply.github.com instead of the real email address. However, many TA repositories still have this setting disabled.
1/ Over several months in 2024, a network of Telegram channels promoted dozens of scam tokens on Ethereum and BNB Chain.
Many of them used the same person - Ukrainian event host Pavlo Tuptynskyi.
Below is the story of how his voice and videos were used to promote Mystiko, Saga, Aztec, and WalletConnect before their collapse in a classic honeypot scheme.
15/ Current status of Pavlo Tuptynskyi:
> Lives and works in Kyiv, Ukraine;
> Event host;
> CEO of ministry.contento
Social media:
instagram - [@]pavlo_tuptinskiy
YouTube - [@]ПавлоТуптинський
Threads - [@]pavlo_tuptinskiy
Stay safe.
Upd:
On-chain analysis shows that funds originating from the Mystiko, Saga, and Aztec token scams promoted through Telegram channels featuring Pavel Tuptynskyi ultimately converged on the active service wallet 0x2A4F...EC982. Based on its transaction patterns, the address appears to be a high-throughput service wallet, likely operating within the CIS ecosystem.
> do not interact with @gnosis_
This is a must-read.
It tells you everything you need to know about the intellectual capabilities of these kinds of scammers.
A short story about Indian scammers who called the cops on themselves:
Earlier this week a follower DM'd me from his personal account complaining that 5.73 BTC ($475K) of his was 'unjustly' frozen at Changelly in Mar 2025.
So I went and plotted the Bitcoin transaction in my compliance tools.
The inflows trace back to illicit sources via social engineering thefts targeting Americans through US exchanges and Bitcoin ATMs.
The broader cluster of high confidence thefts has taken $1M+ from victims since 2025, with several of them elderly.
His story kept changing. It was a loan. No, his boss sent it. No, his boss invested in Bitcoin "during 2014 and 2015" through a friend in the US.
The best part? In Dec 2025 he claims to have filed a police report in India over these frozen funds (3207-P/2025).
In our DMs he shared email screenshots which I queried to surface more data points and map his group out.
I suspect AmanKesar11 is a mule for his boss 'Mr Parveen,' as the 'proof' he sent included bank statements under a different name / location.
While you can message me for help and I'll respect your privacy, at least use common sense and don't contact me with stolen funds.
5.73 BTC frozen order: fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3
AmanKesar11 BTC address: bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2
AmanKesar11 Tron address: TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm
