CEO & Lead Crypto Investigator at @Intell_on_Chain | Blockchain Forensics, OSINT & Crypto Crime Investigations | Victim of crypto crime? @IOC_Support
Scammed? 👉
Joined December 2021
- Tweets8.1K
- Following1.1K
- Followers51.9K
- Likes6.5K
Fill in the blank 👇
"The biggest mistake new crypto investigators make is __________."
Go. The most-liked reply goes into the next Level 1 class, taught by @rugpullfinder
Confirmed @BloomTrading exploit with nearly $1M in losses!
All victims to be re-imbursed
Official Statement | Security Incident Update
TL;DR: No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom.
Following our investigation, we have identified the exact attack vector and confirmed the scope of the incident.
The attack exploited a third-party module through a complex Remote Code Execution (RCE) vulnerability. No private keys were accessed or compromised, and we have ruled out broader exposure of users' wallets.
Incident Overview
Affected: 49 wallet addresses belonging to 9 users.
• Total losses: Approximately 9,408 SOL ($947,000).
• Root cause: Exploited third-party module enabling an RCE vulnerability.
• Refunds: Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users.
• We are also working to trace the stolen funds, explore recovery and freezing options, and identify the attacker.
Our team has been developing software since 2018 and operating in crypto since 2021. We are an established team, committed to building for the long term and protecting the trust of our users.
Security threats are an unfortunate reality of this industry, even with extensive precautions in place. Our commitment to user safety, transparency, and business continuity remains unchanged.
The Bloom Team
Anyone affected by this can reach out to @ioc_support for help!
We're ready and waiting to go!
. @BloomTrading is draining people now, possible exitscam.
bad actor wallet: solscan.io/account/7kY8qx8Mq…
@casino847 & @domyxbt got drained for $200k.
get your funds out asap.
Be honest 👇 I'm genuinely curious to see the responses
Where did you buy your hardware wallet?
57%Official manufacturer sit
14%Amazon / marketplace
0%Third-party reseller
29%I don't use one
7 votes • 19 hoursSome of the most valuable things I've learned as an investigator have come from other investigators.
I've been fortunate enough to learn from some of the best in the industry, and I've always believed that when we share knowledge, everyone benefits.
A rising tide lifts all boats.
That's the thinking behind something we're launching tonight:
🔎 IOC Investigator Roundtables.
A free, monthly opportunity for investigators in the IOC community to come together behind closed doors in our Discord server.
The idea is simple.
Bring something useful to the table. A case, a tool, a technique, a piece of intelligence, a lesson learned, or even just a question you've been trying to answer.
Share what you know. Learn from what others have experienced. Help each other become better investigators.
Because no single investigator has all the answers, and some of the best learning happens through conversations with people doing the work.
I'm really looking forward to seeing what comes out of these sessions.
The first IOC Investigator Roundtable takes place tonight.
#BlockchainInvestigations #CryptoInvestigations #InvestigatorCommunity #KnowledgeSharing #OSInt
🚨 PSA: @cryptocom Phishing Campaign
The case below is linked directly to a phishing campaign that happened between the 22nd July and 30th July.
$3.2 Million lost.
The attackers ONLY removed ETH. Full chart and attacker outflow addresses posted below 👇
To whom it may concern / To the person who took the funds,
My name is the owner of the Ethereum address below. On 29 July 2026, approximately 23.99 ETH was stolen from my Crypto.com account.
It took me 7 years to save this money. It was for my kids. You stole it.
One of the outflow addresses: 0xd0e1eB55638e5216B11Cf8b55a7A2D9B7b63b86e
Is linked to a "CDC SendGrid Hack" reported through @_SEAL_Org
AI Description:
1. CDC Impersonation via Email Exploitation
During major health events, cybercriminals frequently orchestrate phishing scams by spoofing or compromising official communication channels. [1]
The Tactic: Attackers send fraudulent emails that appear to come from the CDC, leveraging fear and urgency regarding public health updates, directives, or critical alerts. [1]
The Mechanism: To guarantee that these emails bypass standard spam filters and achieve high delivery rates, attackers often abuse legitimate mass-email delivery platforms like Twilio SendGrid. Since SendGrid is a highly trusted domain, malicious emails can easily slip into a victim's main inbox. [1, 2]
2. Compromised SendGrid Accounts & API Keys
When SendGrid is mentioned in relation to a "hack," it is usually regarding Account Takeovers (ATOs) or compromised API keys rather than a direct breach of SendGrid's core infrastructure. [1, 2, 3]
How it happens: Attackers steal a company or agency's SendGrid credentials or API keys via malware, credential stuffing, or phishing.
The Abuse: Once they gain access, they use that legitimate account to send out massive waves of phishing emails. Because the account has properly configured SPF, DKIM, and DMARC settings, the fake "CDC" emails look completely authentic to recipient servers. [1, 2, 3, 4]
@ioc_support case ref: 20261023MT
0xac072479b4b449a5b51482a685b646a5805b9bce
0xf071cc03d193b4b69efee674c830c7f49cbe1ccf
0xb924a83ef98bf353043b604890aa9152021e817f
0xe25b6faf528572a9fdb8b5f5d9d8dd697656802a
0x6fe59974a7cbfb6bde21734bf2592541b8c42a0d
0xba4a066c59b6ff47d508535680ab087c173cd28e
0x98b827824d12c5383d392ea8a98da1df6dd206aa
0x488fc943a78f24c50777924b0aec4060821a542d
0x048686388620e3d9092a7fac067e9379234d5224
0x0c10ff8629c1b2beb36ee975037158e5c183068c
0x6f4f2694f0cd0bb05bbdf416665a859211b75647
0x765648d1c56d75f195a75d3e60c51d071457dcf7
0xee542d0c8cee0972ad195a2d148fc1bf6693f211
0x204ae11fecfe8c114e6a4c6e667cd749cffdc1e1
0x2c581ffba57adf9d2738276d4d5c1770bef5ad2b
0xc4c1a6a3cc7bf9690be3e523c66fcfbdaac73c1c
0x8abae788d678a108c09c4fab65d23faad0dd0a59
0xdecf1ec192e7159270d06f55ab5ac30cca209676
0x3b7859893e404b7c173fa7898314f7af4fcaed1d
0xb0be267cc48c014dc986316e779262e60f023098
0x4761b0aa1890bcdf25d202a4f3a4ef3799b6def8
0x944842f492dd05271feb8843d4b720c024242c47
0xbacf95c7198183cd59e99b17f7932c1ecabe17f5
0x1de7d24ce5d0e01954bca21e0697cff91e55df57
0xab1011e9c3e6091375c031d075b59a53c9840a6b
0x9768ab2db5d9edccca4d273adf0d9b1becfc3b06
0x33159dde3a61076fbb51b06232b4c8128eb79182
0x8add853b7030c2a96e7d0152c6d731c38bacd5a7
0x6e30b6cca34e60614f62f1999f6cf490d68ec2c8
0x5486191ea084ba1ed240276ffe1f3dd53db304b5
0x4104e80fdae15b59f7b16ab5a9576f811417a66c
0x3965660271fb28c374991e0e1ff34d293cb5eb3b
0xe6a5cfb6b362283b93cb22e517872f5c5e05b853
0x0af502741154b633362a477ecd30b332f32b0e81
0xcaf31587067aac99d243f020fd4621d246cbae9a
0x6f093a084101492f50a2708027fee07a44632cd2
0x3ade986f298524a25fe579a2f2a30d294999a3c4
0xa3e962dc7f5236bd6a2fede73e8c64e661fa382b
0x2b7fae8f6f38653f6eb5d6ed64a8ca02870204ab
0x3b32c7319c2029e8246f8b59ff5826598d7b07a7
0x934d8daad65ac78e6b80479c9e5213b3dc9ac57b
0x4f79d3e60782ad527c0a353f1248051b28967df6
0xf9b57c87175789fbd1550fcfe0086c0a8b8df83d
0x8c8c8aa3ea463d668944b7d6213970fc8a65658e
0xf24de39a28ab0789824736be90f5dbb6ff3e2436
0x17a4b860a06d209b0f77779635a847ad6b35cc85
0xb0013b379309f9fdf6272d73a4e2098d3ed698a4
0x686a765f55c5f10c4b98ba8eea04ce62f2cfa299
0xf7139edf16af2109233a90844ce09a7cca4676de
0x03ea54d679fc448ef2972b9f7fd27e704f059e8d
0x7316e5fc0d310790db0a50f59c0bfc7272e8a884
0x222d322fc63f518c1ef736ab59e592c175b51b7f
0x07626c75ba3163b3ea94d5eb891fd1c6624292a2
0xdca1c530de7cd9e4b448a174c3f593b3c6c60f07
0x463c340839c28355aed20f529f7ab1939ccd18b7
0xc707fd25cdac81fe21a3c7f5e4e1958a5aadcf83
0x5b110ec61f30e052c4759e4cc59a9cf0a9319076
0x9549dd22dfee9ebb19111de19397769ff34fd397
0x2d337b3c4f73633bd3f4fad09ff209ed9bad09fa
0xfe75471d1396ab1e79081c3fc00e4d18d04260d5
0xda22147ae67f061585cc2ab9c761290c63a7c306
0x09827b162e7b24756ad418bdc113f7e2637a7963
0xa5446e2ee886e09a16e3c5e8f020c8ddf8785626
0xec7c0a24f7aa2fc19294078bd73d1b6592b30a2b
0x5cbf3e38ababab917b811da2813f0625919fbb68
0xc23029137be06afa6af53adb198383802dc81fab
0xf7a508c67ca6908b17d8b2dc0353cf0761c2fa5f
0x1d677c70dfc7e01d84da8aad40fcd3546cdd2fde
0xbda5b9fb7dce723f72bc4cd949b8a4913567c1f6
0xbb7e3ffc9259868199cb40b457c365d523a90917
0x0934a3e067860cbea139d6171c8316941df7c73f
0x5fa2a5ec1a6904be077c3877e515f956ffae100f
0x938b8da8fe9c84b4e2ac313e1787496c757474cc
0xa0d6379de7c82c746ba4aca927d27de0ddfd2ff0
0x0d322a52b0741ea5f5265d3224e5ddf2cca0d6f6
0xa2b73b9b55eb5474f369be05805c12667133e398
0x136934658a761b163b3a2f523dafc66c05272201
0x2a146a6342f44c94ea33ecb5d6195b69e4276d18
0x49668164370b070f99ae4e4792ac40153bcde818
0x443e9ca3b8d674f4acbc7a73071830542e2f8743
0x584f669f6762b6e4d52aa2c275f83987bb39921d
0xe2963a5026437d7a859106c963429f4432374dca
0xce10eaf432b90a91bd99697d39a553cf2ec2255b
0x101997aca7f06fc5a714f05b3f88a57e6b7f5c68
0x44ef127a9e99de2535109c3069f1ce791e91e32a
0x256cdf056883c41d3cac52d4277663492afb462b
0xc5608f92bb4869e6f05d9a3d8084a636cf220841
0x95f0e205e549bcf29f1de3955e23a10b3d9b6b11
0x8319fa11623fe1f66b2dff0232a6060d41c6eda0
0x3bfb612d00eed3d12300f9e4df54b60e45e42539
0x2bb9e6dabfc00b7283b4b3bbefd6f5cb3ced0774
0xed5cf66736dbf692ff7bda0f56b3cf23675015e7
0x8a44237f9b7bcf672ec5817ed0fea15d8dedbdbb
0xfb2507d0220e527805d7a9a7de3bd185d9ee7fd1
0xf7b8b8bd986c3e7e9cd78182d85ac4ffde9f963c
0x634ca24b22c7c3cbc4ed3740c78349adf8b583b2
0x6f9dc612f6364d8bb444c9cbd567ab4a1421336a
0x4f60144a76cac09cd955e91c60c4bc6d7f2f6e94
0xb0390449d38b5ececa77b065aca36adf06113913
0xe4c84e17cbfe8e82458a6ca7d45c9186130b601f
0x1cb7e6eacad3461bd643cbc4ccbe198bd743cb55
0x2c9381305913a9ea6ff75da29a64f585af0e3058
0x47b1e1bfa7de9a5189fec20f831cdf77cad6ee65
0x5761d652a3dcaf34b94d3aead8d9765a207a2ea3
0xc49aa39fa3e52778833a72f70405f0a67bfdb933
0x656e3695aeda3597924ff536a5ce9d7e59024899
0x5e393c289ffaa410cd540433e055697ecf7fded0
0xeadfffb23760dfed80d291a49a2ef29e69bfe731
0x0cec3c3b7558a88c6614ddf2fa0fc015c315b82d
0xd28bab26dae5aa189bcb87dc6427af7edc5e6516
0xb061abcf623c4939e7a4ea48dfd3bfb9cd972e35
0x9017d6a74ddd9fd1350c4df1844868fbd9279629
0xf0f6e249099a3f3f70ca44758d8e5cf28b1ec156
0x7f588772c780f99b8a9a218638bca0e359ece0b4
0x30797a97cfff6491c2e4edcec3616a6c3e53d5d7
0x5c47f355a31a00592277ffee4c041175b466d768
0x3ec03a68a0d08bd138dbcf4d0040986e86a46843
0x825cabcd76c9701168df2dff5f1fad9043a7ae16
0x1858dba2e6b73a55e4c0adc643b998261509f30d
0xb13ab0bef9fa99dc0a6b24b4f86c4828adb16142
0xe1888b1063727d7911b30a9504ce138c61d1f35b
0xee1bc6891ec8d86f249c93996212e3b89b69cd01
0x027c65e536f031d339ec6d0e90c31691539a8ad4
0x40b2ac64fd0b00a239064c714fee403a823e5844
0x1b8e95b75fc211fa66be7b6c6336b423daef9a4c
0x1bfb91bff274c3898de23a0e452abd76a208e4cd
0x1c9b14b3a66e816aab81a45ed3221a5c9e9b212e
0xfc48311835495dd34be282693c755ea52a0dac75
0xb2a2b7de242e61036a7f0e1eaaad49f9281e2817
0xb464774d55b537ab1b7649c34bf6d23a1c438ae4
0xe5d574577940c40415a4e7e4286255ea01c5a549
0xa516db512bf98377289c07eb3bc8c93a139956a7
0xfc02c50a34fb4f3f0c7f024e933dbeb9f8ef1db3
0x396c8424d1158439e711e1e60394717e8d2f193c
0xd59aaef989e771ea7ef3f61ae73b688e5b9923e3
0x4e02c3ed8a427d9dc9abb05ffbcad16d1c28e3d7
0x35d420866be91e449335281cffec7e273bdbdf31
0x96add5ad3580c8b3e2919ac9f2cafd7dff3c457b
0xeeca2ed60c95f114f91ef67b75b64834edc1d245
0xc198073617e8480e223a55dfe759ac71819b7e5f
0x40ea18bdacc2920a2c4e4c87e20a29ad3278efe4
0xa7ad9001ebd780500c62b55c175eb7d4fc4c5223
0xcb819c2ebcab4a21d48e3479b4e3f07f03c18c6b
0xa7a758783b0a86fc55a1358ee823ed2ca669ce7c
0x515ccd04099c04b82ff7c61b4b9eff6338e34b65
0x8f6d9edc972eeea5f36d6ae74c4140c666a26b56
0x56292bce63b3331c36d39d5dd0f8df75ea67203e
0xb2c9aa3dcf2e77de8d786e342d7ddeb02f729ccd
0x44244524056131fb7d219b3226314383fe3ae392
0xb933fa938418a7b23bddcb79e5f3d15456b52963
0x2aace2096fe514f69d9a539a4e00f8d0b6180b73
0x76c522f559d3719bd454209124f1a82af2eee2cd
0x3488de64a3ec9ef5a5bbafac048ada88c1527e1b
0x1f45fa6372ae05bf495480eefb82d7cb075f098f
0x1d83b65a628932b68de3ffd1a7b7c9bd97c7e7cc
0xd8149b7e7b5ff5a25fd089f81b35992a76268ea0
0xcc1097df97ce0435172d716b89a8cf5f6aaf36d2
0xa3f8370839f206e708e2176fd4a8ff1eab843496
JP retweeted
BREAKING: ZetaChain was reportedly exploited, with hackers stealing $87 from the chain.
Devastating day for 4 ZetaChain users.
Right.... 🛑 Stop 🛑 I need your help.
His profile says he's from Florida...
He's actually from Africa.
This account and many more like it will take you for every penny you have if your reach out to them.
They're known as recovery scams and they're the worst of the worst. They prey on people's hope to get money back.
These horrible people know what the victim has just been through and they WILL take money and do nothing in return - then disappear. He tagged me earlier (see image). If no-one responds, they delete the posts
These MFers need to be banned - Report him
@ RECOVERY_GUIDEe
We support victims for FREE over at @ioc_support
Need help? Reach out and give them a follow
Potentially $2M in fraud identified
The scammers approach victims on @indeed initially
They targeted people looking for work to entice them to join an investment platform.
Heres more info:
Polkadot has issued a security alert for Fearless Wallet, a third-party wallet built by an independent team. An investigation by the Polkadot Technical Fellowship found the browser extension had been compromised and was leaking users' private keys since February 2025.
That is roughly 20 months of silent exposure. No phishing link, no bad signature, just a trusted extension doing the attacker's work in the background.
If you or your clients ever used the Fearless browser extension: create a new keypair in a different wallet and move funds now. Changing a password does nothing once a key has left the device. Any seed shared with other wallets is exposed too.
Two things we see after incidents like this: victims who wait because nothing has been stolen yet, and "recovery" accounts that show up in the replies within hours. Move first, and never pay anyone to get funds back.
A question for the security folks here: how often do you actually review the browser extensions with wallet access on your team's machines?
