Pinned Tweet
introducing the tracehound wanted board.
got scammed? post it. put a reward on it.
> drop the scammer's addresses
> say what you lost
> offer a reward for information
> anyone who knows something sends you a tip. only you see it
> every address on the board is one click from a full trace
rugged, drained, phished, hacked. 9 chains.
no names, no doxxing. addresses, transactions and what happened.
the reward is between you and whoever helps. we hold no money and take no cut.
and if someone asks you to pay upfront to "recover" your funds, that's a scam too.
the chain never forgets. now neither do we.
HE STOLE $947,000 IN 51 SECONDS.
4 MINUTES AFTER HIS WALLET WENT PUBLIC, HE MOVED EVERYTHING.
THEN HE FROZE. AND NOW OTHER SCAMMERS ARE HUNTING HIM.
this is the Bloom drain, rebuilt from 73 on-chain transactions. timestamps are UTC, and every one of them is public.
> CHAPTER 1: THE KNOCK (00:59)
first move: 1 lamport out of the biggest victim wallet. that's $0.0000001.
he isn't stealing yet. he's checking whether the door is open.
> CHAPTER 2: THE ROLL CALL (01:02)
ten more wallets each send 0.001 SOL to the same address, about one every 2 seconds.
a person doesn't do that. a script is checking which wallets it controls.
> CHAPTER 3: THE 51 SECONDS (01:03:50 → 01:04:41)
41 wallets emptied in 51 seconds.
1,636 SOL, then 1,039, then 1,021, then 765.
every drain was signed by the victim's own wallet, which paid its own fee.
no brute force. no phishing link. the wallets simply said yes.
> CHAPTER 4: HE CAME BACK FOR MORE (01:28)
24 minutes later he sends 0.02 SOL back into one drained wallet.
why give money back? that wallet still held ~$49k in USDC, and it had no SOL left to pay fees.
he tests it with 0.000001 USDC transfers.
the $49k never reaches him.
> CHAPTER 5: SPOTTED (04:26 → 04:30)
04:26:10: Onchain Lens posts his address.
04:30:56: all 9,408.21 SOL leaves in one transaction to a brand-new wallet.
4 minutes 46 seconds. he was watching X too.
> CHAPTER 6: THE FREEZE
since then that wallet hasn't moved. no bridge, no swap, no exchange.
almost $1M, parked in plain sight for 10 hours and counting.
> CHAPTER 7: THE SCAVENGERS
this is the part nobody's talking about.
lookalike wallets start showing up, copying the first and last characters of real addresses, and they send dust to the drainer so a fake shows up in his history.
then they go after the hacker's new wallet with copies of his own address, hoping he pastes the wrong one when he cashes out.
scammers trying to scam the scammer.
> BLOOM'S SIDE
Bloom: a third-party module had a remote code execution bug. no private keys leaked. 9 users, 49 wallets, 100% refund.
on-chain: every drain was signed by the victims' own wallets.
both can be true. if you can run code on the machine that signs, you never need the key. you just ask it to sign.
by 12:41 Bloom was publicly offering to negotiate.
so let's recap:
• 1 lamport to knock
• 10 test transfers
• 41 wallets in 51 seconds
• 4m46s from exposure to exit
• 10+ hours frozen
• a crowd of scammers waiting for him to make one copy-paste mistake
he doesn't have to outsmart anyone. he just has to outwait you.
we don't get bored. we're watching 6nYy…moe9.
TraceHound community in Telegram:
t.me/+ueqWE3JTQKI2Yjgy
SCAMMERS CAN NOW BE WATCHED. EVERY WALLET ON OUR WANTED BOARD IS CHECKED EVERY 6 HOURS. THE MOMENT THE MONEY MOVES, YOU SEE WHERE IT WENT.
here's the problem every victim knows.
you post the scammer's address. people retweet it. a week later everyone forgot.
and the scammer just waits. then moves the money when nobody is looking.
not anymore.
> you post the scam on the wanted board: the addresses, what you lost, a reward
> tracehound checks those wallets every 6 hours
> money leaves the wallet -> it shows up on the board
> where it landed: a fresh wallet, a bridge, a mixer, or an exchange
> if the next wallet forwards to an exchange, we flag it as that exchange's deposit address
> you get a telegram message
> every move links to its transaction
why the exchange part matters:
an exchange deposit is the one place stolen money can still be frozen.
but only if someone asks fast. with the tx, the address, the amount and the time.
that's what this gives you.
we ran it on the bybit hacker's wallets.
4 addresses. 57 moves. every one on chain, every one with its tx.
the video is that.
the scammer stopped being anonymous the moment they touched the chain.
now they can't move quietly either.
got scammed? put it on the wanted board.
TraceHound retweeted
TRACEHOUND ROADMAP: WE'RE HIRING ON-CHAIN ANALYSTS AND BUILDING 14 NEW WAYS TO HUNT SCAMMERS
our DMs are full.
hacked wallets. drained savings. rug pulls. fake exchanges. "investment managers" who vanished.
every message ends the same way: "can you find them?"
we read every one of them.
and we can't answer them fast enough.
so we're hiring.
> ON-CHAIN ANALYSTS WANTED
tools find the trail. people close the case.
we're building a team that takes every request from our DMs and the wanted board and traces it end to end:
- every request read by a human, not a bot
- hop by hop: swaps, splits, bridges, all the way to the exchange, the tx and the deposit address
- a report the victim can actually hand to the exchange and the police
- public case files when the victim agrees
trace wallets for fun or for work? DM us. show us a trail you followed.
> ALREADY LIVE
- hack trace on 9 chains: ethereum, base, arbitrum, bsc, polygon, optimism, solana, tron, bitcoin
- crosses bridges: thorchain, cctp, across, wormhole, stargate, debridge, mayan
- exchange deposits found and labeled
- token check, rug radar, wanted board, exit liquidity score, telegram bot, public API
> NEXT. FROM THE COOLEST DOWN
02 "scammer moved": wanted wallets under watch. the second the money moves, we post it
03 check before you send: paste an address before sending. tied to a scam? you know first
04 freeze request kit: tx, deposit address, amounts, times. one click, formatted for exchange compliance
05 case desk: submit a case, track it like a parcel. received -> tracing -> exchange found -> report ready
06 operator files: different scams, different chains, same person. one file per operator
07 was I drained?: which drainer, which approval, what to revoke right now
08 address poisoning alarm: looks like your contact. isn't. flagged before you copy it
> LATER
09 hunter leaderboard: tips that found the exchange, ranked in public
10 drainer & phishing database, open to everyone
11 scams of the week: fresh scams, traced and explained
12 AI case report: the whole trace told as a story
13 new chains: TON, hyperliquid, sui, XRP
14 telegram mini app
15 sharper verdicts: every red flag with its real hit rate
> THE GOAL
right now a victim hears "sorry, crypto is untraceable."
it isn't. it never was.
every scam should end with a file:
the trail. the exit. the name.
got scammed? DM us or post it on the wanted board.
want to hunt with us? DM us too.
the blockchain never forgets.
TRACEHOUND ROADMAP: WE'RE HIRING ON-CHAIN ANALYSTS AND BUILDING 14 NEW WAYS TO HUNT SCAMMERS
our DMs are full.
hacked wallets. drained savings. rug pulls. fake exchanges. "investment managers" who vanished.
every message ends the same way: "can you find them?"
we read every one of them.
and we can't answer them fast enough.
so we're hiring.
> ON-CHAIN ANALYSTS WANTED
tools find the trail. people close the case.
we're building a team that takes every request from our DMs and the wanted board and traces it end to end:
- every request read by a human, not a bot
- hop by hop: swaps, splits, bridges, all the way to the exchange, the tx and the deposit address
- a report the victim can actually hand to the exchange and the police
- public case files when the victim agrees
trace wallets for fun or for work? DM us. show us a trail you followed.
> ALREADY LIVE
- hack trace on 9 chains: ethereum, base, arbitrum, bsc, polygon, optimism, solana, tron, bitcoin
- crosses bridges: thorchain, cctp, across, wormhole, stargate, debridge, mayan
- exchange deposits found and labeled
- token check, rug radar, wanted board, exit liquidity score, telegram bot, public API
> NEXT. FROM THE COOLEST DOWN
02 "scammer moved": wanted wallets under watch. the second the money moves, we post it
03 check before you send: paste an address before sending. tied to a scam? you know first
04 freeze request kit: tx, deposit address, amounts, times. one click, formatted for exchange compliance
05 case desk: submit a case, track it like a parcel. received -> tracing -> exchange found -> report ready
06 operator files: different scams, different chains, same person. one file per operator
07 was I drained?: which drainer, which approval, what to revoke right now
08 address poisoning alarm: looks like your contact. isn't. flagged before you copy it
> LATER
09 hunter leaderboard: tips that found the exchange, ranked in public
10 drainer & phishing database, open to everyone
11 scams of the week: fresh scams, traced and explained
12 AI case report: the whole trace told as a story
13 new chains: TON, hyperliquid, sui, XRP
14 telegram mini app
15 sharper verdicts: every red flag with its real hit rate
> THE GOAL
right now a victim hears "sorry, crypto is untraceable."
it isn't. it never was.
every scam should end with a file:
the trail. the exit. the name.
got scammed? DM us or post it on the wanted board.
want to hunt with us? DM us too.
the blockchain never forgets.
RADIANT CAPITAL LOST ~$50M TO NORTH KOREA. THE LAUNDERING WAS COMPETENT. IT STILL FAILED, FOR A REASON MOST PEOPLE MISS.
laundering doesn't destroy information. it can't. every swap, bridge and split is a public state change. all laundering can do is add noise and hope nobody separates it from the signal.
which creates a brutal asymmetry:
the launderer has to break every path between the theft and the cash-out.
the tracer only needs one path to survive.
I ran the Radiant exploiter through tracehound to see which paths survived.
2 chains. 33 wallets. 89 flows. 11 findings. 169 seconds.
the tricks weren't the problem. the habits were
> 1. THE SWAP THAT POINTS TO ITS OWN EXIT
the exploiter routed swaps through aggregators and had the output paid to a fresh wallet instead of back to itself. on an explorer, the funds appear to vanish into a contract.
but a swap is a single atomic transaction. input and recipient live in the same tx. you can't swap into a stranger without writing the stranger's address on-chain.
CCTP burns on the source chain and mints on the destination. the two events are cryptographically paired, by design. Across works the same way: every deposit carries an index that resolves to its fill.
bridges are built to be verifiable, because users need to prove their funds arrived. that same property makes them traceable. you can't have one without the other.
> 3. THE MISTAKE THAT ACTUALLY MATTERED: ONE KEY, TWO CHAINS
here's the part most people miss. an EVM address is derived from a private key, and that key works on every EVM chain. same key, same address, everywhere.
so when the same addresses show up on arbitrum AND ethereum, that's not a coincidence. that's the same key holder:
- 0x3904…7ebc received swap outputs on both chains
- 0x5703…dba6 received direct transfers on both chains, plus all three bridge exits
- 0x97a0…e4e8 and 0x8b75…0887 got 12.13k ETH each on arbitrum, and are labeled Radiant Capital Exploiter 2 and 3 on ethereum
hopping chains doesn't give you a new identity if you bring your keys with you.
> 4. SYMMETRY IS A SIGNATURE
on ethereum, exploiter wallets 2, 3 and 4 each received exactly 707.05 ETH.
on arbitrum, two of the same wallets each received exactly 12.13k ETH.
humans don't split money into identical parts across multiple chains. scripts do. and scripts are reproducible, which is the opposite of what you want when hiding.
> 5. SILENCE IS DATA TOO, WEAKLY
across 79 transactions, the main wallet never moved between 09:00 and 17:00 UTC.
that's a hint, not evidence. tracehound marks it low confidence, and so should you. the honest way to trace is to separate what the chain proves from what it suggests.
> THE GENERAL PRINCIPLE
every obfuscation technique attacks one type of link:
- swaps attack the token link
- bridges attack the chain link
- fresh wallets attack the address link
- time delays attack the timing link
but attribution doesn't rest on one link type. it rests on redundancy. cut the token link and the address link remains. change addresses and the amounts still rhyme. jump chains and the key comes with you.
to disappear, you have to break all of them, on every hop, every time. Radiant's launderers broke some of them, on some hops, some of the time.
and the trail is still live: the funds on these addresses were still moving in 2026.
that's what tracehound is built for. not the hop you can see on an explorer, but the links between hops that survive every trick.
which hack should I break down next?
$625 million. The biggest DeFi hack in history.
In March 2022, someone walked out of the Ronin Bridge with 173,600 ETH and 25.5M USDC. Nobody noticed for six days.
We pasted the exploiter's address into tracehound and let it run. 53 seconds later, this is what came back.
It started with 1.06 ETH.
Before the attacker could move $300M, they needed gas. That gas came from a Binance withdrawal: 1.06 ETH, about $3,100 at the time. An exchange withdrawal means an exchange account, and an exchange knows who asked for it.
Then the money moved. 103,854 ETH, $305.6M at the moment it left, went out in four pieces:
-> 33,568 ETH
-> 25,127 ETH
-> 23,528 ETH
-> 21,629 ETH
Those four wallets split it again, into fifteen. And the fifteen started feeding a mixer in clean, round amounts: 7,000. 5,800. 8,700. 3,000. 3,000. 3,000. 3,000.
Round numbers are not how people spend money. They're how people launder it.
By May, 70,500 ETH ($175.6M) had gone into Tornado Cash. The full path, from the Binance withdrawal to the mixer, is on one graph: 22 wallets, 35 flows, every arrow a real transaction you can open.
What tracehound found on its own:
- The gas was funded by an exchange withdrawal (high confidence)
- The suspect is a labeled exploiter: Ronin Bridge Exploiter
- 70.5k ETH went into Tornado Cash, with the deposit transactions listed
- A daily 8-hour window with no activity across every transaction. A weak hint at a timezone, and we label it that way.
That's the job: find where the money came from, where it went, and which transactions prove it, then mark how sure we are about each claim.
$625M heists get investigated by teams over weeks. This trace took less than a minute
New on Tracehound: Exit Liquidity Score.
Paste a Solana wallet. Tracehound reads its last 500 transactions, finds every memecoin it bought, and counts the ones that are now 90%+ below its entry with the wallet still at a loss.
We ran it on an active trader's wallet:
> 403 SOL through 17 memecoins
> 9 of them now worth next to nothing
> net −34.9 SOL, worst single coin −20.2 SOL
Then it opens a token check on the three coins that cost the most:
> coin #1: the developer bought 37.6% of supply in the launch tx and sold all of it
> coin #2: the developer's circle had launched 14 tokens before it, all 14 dead
> coin #3: developer funded from KuCoin two hours before launch, launch bag fully sold
Why it's useful:
> see your real hit rate, not the one you remember
> learn what your losers had in common: big dev bags, serial launchers, freshly funded devs. Those are the flags to check before the next buy
> vet a wallet before you copy it. Paste a caller's or copy-trade wallet and see how its picks actually ended
Every figure links to the chain. Read-only, no wallet connect, no signing.
WE BUILT A RADAR FOR PUMPFUN RUGS
first hour live, it caught:
> one wallet launching 143 coins in 13 minutes
> two more doing 100+ in 25 minutes
> HELLO launched 38 times in under 5 minutes
> ~70% of new launches flagged
this is what you're "aping early" into.
introducing RUG RADAR
every pumpfun launch hits the dish the second it's created
> serial devs
> cloned tickers
> known ruggers from our database
> devs buying their own launch with 5+ SOL
hover any dot and watch it thread to every other coin that dev launched
live. free. open source.


