Alerts stop at the hack. We don't. 👁️ On-chain tracing, the next hop, with receipts. Verify, then trust.
Joined August 2014
- Tweets11K
- Following6.3K
- Followers7K
- Likes21.9K
Pinned Tweet
🚨 Following the BTCPay Server incident (versions ≤2.4.1), on-chain tracing shows \~6.55 BTC still sitting dormant in three staging addresses.
These were consolidated from the main collector address (publicly labeled as attacker by @NicolasDorier). Each has exactly 1 inbound and 0 outbound transactions.
📡 Monitoring is active. Full details already shared privately with @BtcpayServer.
🤖 Made with AI
Update: @Bitquery_io independently confirmed the same collector and the 4.71 BTC staging address.
Two additional dormant addresses (\~1.84 BTC) from the same consolidation pattern remain unmoved and were not listed in their report. Full details already shared privately with @BtcpayServer. Monitoring still active.
🔍 Live monitoring is running on the three addresses. Any outbound >0.001 BTC will be flagged immediately.
@BtcpayServer
🧊 Each of the three staging addresses has exactly one incoming transaction and zero outgoing. No further movement so far.
✅ Full addresses + TXIDs already sent privately to @BtcpayServer (Telegram + security@). Happy to share more details with the team if needed for incident response.
🔗 Collector address: mempool.space/address/bc1p0f…
Shows classic consolidation behavior: multiple inputs from the incident period into fresh P2WPKH outputs.
🧊 Three of those outputs remain completely dormant. Combined balance: 6.552 BTC. Verified via mempool.space API.
@NicolasDorier @BtcpayServer
🚨 $6.3B Binance hot-wallet drain (Oct 29): money moving
💸 1,017.56 $ETH left 0x2274…64b0, a throwaway wallet that dumped stolen $LSK
➡️ To the attacker's consolidation wallet 0x8d4b…9E19 (8,927 $ETH) at 21:02 CET
🔗 etherscan.io/tx/0xf10ede10ba…
👀 ~862 $ETH still parked in dump wallets
🔄 Update $6.3B Binance hot-wallet drain (Oct 29)
The main consolidation wallets are still sitting untouched:
▪️ 0x8d4b…9E19 holds \~8,927 $ETH and has never sent a single transaction
▪️ 0xc209…850a still holds its \~7,003 $ETH (no outgoing txs)
No bridge, mixer or exchange deposit has been observed from these wallets since the last update. The attacker continues to hold the cash-out ETH in cold-style holding wallets.
Still watching for the first outgoing move.
🚨 StepDrainer infrastructure exposed
The Oct 31 DNS hijack stole user funds across multiple DeFi frontends. While the incident is public, the operator EOA and custom malware signature stayed largely unlabeled.
Custom sweep selector + official phishing labels + active operator.
Full breakdown below. 👇
🤖 Made with AI
🔍 Monitoring the operator EOA and selector 0x2fbd0ebc for further activity.
Verify, then trust.
CC: @flapdotsh @Kintsu
🚫 WHAT WE DO NOT CLAIM
▪️ No identity attribution
▪️ No direct on-chain link proven between all September addresses and the current operator
▪️ This is on-chain data, not legal evidence
🎯 SEPTEMBER INFRASTRUCTURE
▪️ 0x407f9570E44C554F9e51b9f06ED98FBe7F4d9CfD — labeled Fake_Phishing1334081
🔗 etherscan.io/address/0x407f9…
▪️ 0x89a771da028dC95FC2CFEA585aDd5F3bd06B0627 — funded via Relay solvers
🔗 etherscan.io/address/0x89a77…
⚙️ CUSTOM SELECTOR: 0x2fbd0ebc
Not a standard ERC-20 or protocol function.
Used by the operator to interact with contracts.
No public match in common selector databases.
🕵️♂️ OPERATOR EOA: 0x3Ef5A8755376EF4C89405649D73e2597299b6E0b
▪️ Recently called custom selector 0x2fbd0ebc
▪️ Active on Ethereum
▪️ No recent EIP-7702 revocation visible
🔗 etherscan.io/address/0x3Ef5A…
🚨 $464,600 drained from @PremiaLabs vaults on Arbitrum.
While the macro incident is public, the root infrastructure remained unlabeled. Our deep-dive workflow has isolated the attacker's multi-contract setup and custom logic.
Full clinical breakdown & forensic map below. 👇
🚨 The StepDrainer crew behind the @namedotcom DNS hijack (@Kintsu, @flapdotsh + 10 sites) isn't new
🕵️ Their helper wallet leads to a June cash-out: @TornadoCash → $USDT → LBank
🏦 ~5.23M $MON still parked on @monad
🧵 Every wallet linked, verify it yourself 👇
Follow-up on the StepDrainer trail.
100,000 USDT is still sitting unmoved in this wallet:
0xd672aa811f8ed59ca23205a01a37eeb5515f187d
This is part of the funds linked to the same helper wallet used in the recent DNS hijacks.
A freeze request via @Tether_to is still possible while it remains there.
@Kintsu @flapdotsh
🔍 Additional technical observation:
The attacker used a custom exploit contract with unpublished method selector 0xbcea0a12, paired with a helper that routed funds directly to the Chainflip Vault.
Compared to the older Optimism deployment of the same deployer, the Arbitrum version dropped same-block withdrawal protections and underwriter approval checks.
This remains our on-chain observation.
📊 Damage breakdown (public data):
\~3.64 WBTC
\~43.47 WETH
\~48.5K USDC.e
\~46.2K ARB
Two transactions, \~1 second apart.
Premia v3 TVL was \~$533K before the attack — over 80% drained.
Still no official statement from @PremiaLabs.
🔍 We continue to monitor the Bitcoin UTXOs for the final destination.
Verify, then trust.
CC: @zachxbt @PeckShieldAlert @Blockaid_ @SlowMist_Team @CertiKAlert @Phalcon_xyz @PremiaLabs @Chainflip @near_intents @NEARProtocol
🚫 WHAT WE DO NOT CLAIM:
▪️ We do NOT claim @PremiaLabs has officially acknowledged the breach (currently radio silence).
▪️ We do NOT claim @Chainflip was exploited; their permissionless infrastructure was used as a routing tool.
▪️ This is a pure smart contract logic exploit, unrelated to recent Web2 DNS hijacks.
🌪️ ROUTING & LAUNDERING:
Stolen $USDC.e and $WETH were routed through the Helper Contract directly to the Chainflip Vault on Arbitrum:
🔗 arbiscan.io/address/0x79001a…
Assets were then cross-chain swapped via @Chainflip and @near_intents into native $BTC, breaking the EVM trace.
