building @mintraqbot & @signward_app / prev @Somnia_Network @unvault maxxing
Joined July 2024
- Tweets10.4K
- Following855
- Followers2.6K
- Likes10.9K
This week I watched one drainer kit open a new wallet for every victim. Same owner behind all of them.
So Signward checks who controls the address, on-chain, in under half a second, before you sign.
Radar caught 38 of them, 24/7, automatic.
If you sign onchain, install it
Drainers have a new trick: a brand new wallet for every single victim.
This week we tracked one kit running a fake OpenSea giveaway. For each victim it quietly deployed a fresh Safe wallet, used it to sweep their tokens, and moved on. 20% of every theft went to the kit operator, 80% to the scammer. A new address every time means no blocklist ever catches up.
Except every one of those Safes had the same hidden owner.
So Signward Radar now does this on its own, 24/7:
🔍 Watches the chain block by block for new drainer activity
🧩 Spots fresh wallets controlled by known drainers the moment they appear
⚡ Adds them to Signward automatically, usually before anyone reports them
And at signing time we don't even need the list. If a site asks you to approve or sign anything, Signward checks on-chain who controls that address, in under half a second. If the owner is a known drainer, you get a red warning before you sign, not after your wallet is empty.
This week alone: 38 new drainer addresses from a single kit, caught and pushed to every user.
Free, no account, nothing to configure.
1
1
145
Speed is everything with drainers. A kit spins up a new wallet and a new domain, and blocklists often catch up days later, after people have already lost money.
So I built @Signward to go after them first. A decoy wallet opens the phishing site and records the drainer contract. Radar watches the chain live, and every wallet that touches the kit is flagged within minutes and added to the Signward database.
Signward users get those addresses automatically. No setting to change, nothing to report. If a site asks them to approve or sign for one of them, Signward stops it before the wallet signs.
This one kit: 5 wallets, 2 sites, 11 addresses, caught live.
One wallet drainer kit. 3 days. 5 drainer wallets, 2 phishing sites, $929 stolen.
Here is how Signward caught it, and what we did about it.
1. We go to the drainers first
Our decoy wallet visits fresh phishing sites found in public phishing lists, certificate logs and scanners. On Nov 1 it opened a fake "OpenSea free giveaway" page and recorded the exact contract the site asks you to approve.
2. We watch the chain live
On Nov 2 a victim signed and lost $907 through Safe wallets, split 80/20 between the operator and the kit owner. Signward Radar followed the money: every new wallet that paid the kit owner its 20% cut was flagged within minutes. It happened twice overnight.
3. A new domain does not reset anything
Today a brand new site showed up with the same drainer contract. A domain blocklist starts from zero on a new domain. Signward does not, because it also checks who you are about to approve.
4. Every address goes into the Signward database
11 addresses so far. Every Signward user's extension picks them up automatically. Approve, sign or send to one of them and Signward stops the request with a clear warning before your wallet signs anything.
Already approved something like this? Revoke it now. Signward can scan your old approvals and links you straight to @RevokeCash .
Free browser extension: signward.app
2
180
Kalos drops are getting busy 👀
I made Kalos minting on @Mintraqbot free for everyone until @Enter_Elysium mainnet. No subscription, just sign in with Discord and add a wallet.
What you get:
• Schedule allowlist and public mints on @kalosfun drops
• Your mint fires right at the opening second, even if you’re away
• Pre-sign in your browser, or let the server sign at the open
• Allowlist proofs are fetched and stored ahead of time, so a busy Kalos API at launch doesn’t stop your mint
• Radar shows upcoming Kalos drops, and tells you on Telegram when your wallet is on the WL
Free accounts can use up to 2 wallets.
1
3
403
Binance Hot Wallet is running an attacker’s contract right now, installed through a single EIP-7702 authorization.
We took the contract apart from its bytecode: one sweep function, locked to the attacker’s relayer, written to empty every token in one go.
The same trick hits ordinary wallets every day. Signward catches that request before you sign it and shows which contract would take over your account.
Free on the Chrome Web Store
Binance 14 is now running someone else’s code.
eth_getCode on the wallet returns 0xef0100 + 63e842b0..., an EIP-7702 delegation. We read that delegate from bytecode alone: one sweep() function, locked to a single relayer, no storage, no signature checks.
How to check your own wallet:
signward.app/blog/binance-14…
signward.app/blog/binance-14…
1
9
2,873
ok safe to say binance is pwned
The biggest assets were approximately:
• 1.615B USDT
• 62.6M RLUSD
• 29,934 wBETH
• 11,372 XAUt
• 6.19M UNI
• 198.4M ENA
• 7.175T PEPE
• 27.8M USD1
• 2.26M LINK
• 127,853 AAVE
about $2.5B at the explorer’s prices.
1. The attacker deployed a delegate contract, 0x63e842b0...73e9c6fAe, from the relayer at 15:59 UTC.
2. About four hours later, the relayer submitted an EIP-7702 authorization transaction
That installed the malicious 7702 delegate code on Binance 14.
3. The relayer then made a call to Binance 14, executing the delegate code, and transferring Binance 14’s ETH and token balances.
4. The calldata is labeled sweep(address, address[]). The second argument is a list of recognizable token-contract addresses plus the zero-address (eth).
5. The same relayer later used the same delegate to move 780M USDC from Binance Hot Wallet 34 into the same pool
• The relayer 0x7C... was funded by three Tornado Cash 0.1 ETH withdrawals over the prior two days.
• The same pool also received 28,005.6 ETH from Binance 16 24 seconds after the main sweep.
• The pool then forwarded 195,460 ETH to a fresh, unlabeled EOA
• That EOA has only one transaction and currently holds the 195,460 ETH.
What's a bit unclear is why the relayer was needed in the first place. If they had the private keys to the Binance wallets, they could have just sent the assets out in an atomic bundle without needing a relayer at all.
So it seems likely that they didn't have the private keys and instead just had the 7702 auth signatures, which must have been phished somehow.
I think we can go ahead and assume DPRK.
120
I built @Signward because every wallet-security extension I tried did the same one thing well: explain the transaction in the moment before you sign.
But a wallet rarely gets drained at the signature. It starts earlier: a lookalike site, a fake claim page, a seed-phrase form, a clipboard trick.
Signward covers the whole path. It reads each request in plain language and simulates it before you sign, blocks phishing and impersonation sites on load, and warns you the second a page reaches for your seed phrase or clipboard.
And the part most tools skip: if a contract you already approved is later flagged as compromised, Signward sends a desktop alert that takes you straight to revoke.
All of it quietly: scoring runs on your device, full URLs are never sent. No account, no transaction fees, no paid coverage tier.
My #Zecathon entry is in: @ZandGlass⏳ thanks @zksnarks_
• Inheritance for shielded $ZEC
• Heir fire drill (practice kit in 60s)
• Savings lock you can't break early
• Paper kits as QR codes
• Real mainnet txs, zero onchain fingerprint
1
9
317
3 weeks into the @unvault closed beta as a tester, and the next phase is the one i've been waiting for. we testers get to try the bugz mint and divit before anyone else 👇
🧑💻life as a tester
every new build gets the full pass from me. list, buy, offer, accept, transfer, cancel, with 2 wallets trading against each other on 6 chains. then i put the data side by side with opensea, floors, volumes, traits, rarity, and send whatever doesn't add up. 220+ reports and suggestions so far
and honestly it's become a place i actually like trading on. one cart across all chains that pulls in opensea listings too, offers on a single trait or on a bunch of nfts at once, listing in eth usdc or weth, and copycat collections get flagged before you buy
💎 divit, next in the beta
next up for us testers is the divit rewards distribution system. divit is marketing rewards paid to nft holders from collection royalty pools. so instead of royalties just disappearing, part of them flows back to the people holding the collection, and you claim it from one dashboard
it pairs with unvault itself: move your nft across 7 chains, locked on the origin chain and claimed on the destination. no wrapping, no duplicates, provenance stays intact
🐛 genesis bugz, mint test next
before the real mint, we testers get to run the bugz mint flow with a debugz test collection, so the real mint day goes smooth
genesis bugz is unvault's own collection
6,250 bugz, free mint, gas only, 7 chains
holding a bug gets you in first on launches on the unvault mint launchpad
mint a participating collection while holding your bug and you earn a minters' bonus
and those bonuses stay with the bug, if you sell it the history and claimable bonuses go with it
🎯 which partner nft should you hold?
that's why we built unvaultodds.fun. it ranks all 60 pools by how many active wallets are actually competing, not floor or supply, and shows what it costs to get in. right now:
least crowded: alpha dogs 2.9x, pixel pups 2.1x, clutch puppies 2.1x
best value: bears on the block ($6.55), monster mob ($4.53), bulls evo ($5.83)
84,525 holder spots chasing 6,250 bugz. pick your pool, get bit 🐛
unofficial community tool, not affiliated with unvault, estimates not guarantees, nfa
Hailey retweeted
🐛 The DIVIT is your key to STACKING REWARDS! 🎁
And we're starting with a reward of our own!
🎁 BUGZ NFT GIVEAWAY! 🎁
ONE lucky winner will receive a Bugz NFT from our
Un-Vault!
Here's how to enter:
🧡 Follow UnVault
🔁 Repost this post
🏷️ Tag an NFT collection you'd love to see using the DIVIT!
Now, how does the DIVIT work? 👀
1️⃣ Hold DIVIT-eligible NFTs
2️⃣ Opt in
3️⃣ Follow your collection's rules (like DON'T LIST!)
4️⃣ Share your collection's pre-filled DIVIT marketing post on X (once per collection)
5️⃣ Once verified, CLAIM YOUR CRYPTO REWARDS! 💰
🔥 1 eligible NFT = 1 potential DIVIT reward
🔥 69 eligible NFTs = 69 potential rewards 😏
🔥 100? 1,000? KEEP STACKING!
Each collection decides and supplies their own rewards and you'll be able to compare and shop collections on our Divit page.
Every eligible NFT is another opportunity to earn and stack rewards!
Powered by UnVault's internationally patent-pending DIVIT technology.
🧡 How many DIVIT rewards could YOU stack?
Axis airdrop went live today. So did the fake claim pages.
Guard3 caught the clone the moment it loaded: it knows the project’s real domain from its verified X and our brand database, and checks the page against it plus live phishing lists, right on load.
real airdrop.axisrobotics[.]ai → clean
airdrop-axisrobotics[.]live → blocked, 100/100
Onload did not flag it and you are still not sure?
Hit Deep scan: an AI running in the backend inspects the page for the most critical drainer and phishing tactics and re-scores it in seconds.
Automatic on load, with a one-click deep scan when you want certainty.
Coming soon, free and open source once it is on the store
Stay safe frens🛡️
2
7
446
The fake QQL mint is live and draining people (@0xQuit posted a PSA today). I’ve spent the past week building a browser extension that stops exactly this, and it goes well past a blocklist.
It runs in layers. Before a page even loads it scores the domain: lookalike and typo domains (qql-auction .com isn’t qql .art), brand impersonation, registrations only days old (live RDAP check), “claim” and “allocation” bait paths, even links that arrived from a fake X account.
If you do connect, it intercepts the request before your wallet ever opens, decodes what you’re actually signing (unlimited approvals, Permit2, setApprovalForAll, eth_sign, EIP-7702) and simulates it on-chain, so you see “this drains your USDC” instead of a blind signature.
Still unsure about a site? It opens it server-side in a throwaway decoy wallet and watches what it tries to do, without ever touching yours. And the moment one user’s wallet catches a live drain, everyone else gets warned within the hour.
In review on the Chrome Web Store now. Demo below.
10) 2 of my reports were critical security issues. both went to the team privately, so no details here
finding those before launch is exactly what a closed beta is for
1
18