AMLBot

Blockchain Intelligence at your fingertips.

Crypto Tracing / AML Screening / Incident Response

[AMLBot @AMLBotHQ]

New Product: AI Tracer is Live 🔍

A self-serve crypto investigation tool, built for everyone. Paste a TxID and AI traces where the funds went — every wallet, bridge, and exchange along the path, across 14 chains. A visual map in minutes. No analyst skills needed.

First Trace FREE → https://t.co/wjlwcxk72z

[AMLBot @AMLBotHQ]

@OnchainLens We looked into this too. 27 accounts were drained across three waves, with the first one starting on Oct 20. https://t.co/3vyVH512PJ

[AMLBot @AMLBotHQ]

The @predictdotfun drain is bigger and older than reported: it began on Oct 20 and losses now total ~$393K

Our tracing shows two earlier waves on Oct 20 and Oct 22 that follow the exact same pattern: Predict accounts emptied, funds bridged to Ethereum, then sent to Tornado Cash

27 accounts were drained in USDT across the three waves. One account alone lost $109K. The median loss was ~$4.8K, and the top 5 accounts make up 73% of the total

Nearly all stolen funds have already entered Tornado Cash. We are actively monitoring this case

[AMLBot @AMLBotHQ]

@predictdotfun We are sorry for your loss. We tracked the case as well. Nearly all of the stolen funds have already entered Tornado Cash. https://t.co/3vyVH50v0b

[AMLBot @AMLBotHQ]

The @predictdotfun drain is bigger and older than reported: it began on Oct 20 and losses now total ~$393K

Our tracing shows two earlier waves on Oct 20 and Oct 22 that follow the exact same pattern: Predict accounts emptied, funds bridged to Ethereum, then sent to Tornado Cash

27 accounts were drained in USDT across the three waves. One account alone lost $109K. The median loss was ~$4.8K, and the top 5 accounts make up 73% of the total

Nearly all stolen funds have already entered Tornado Cash. We are actively monitoring this case

[AMLBot @AMLBotHQ]

The @predictdotfun drain is bigger and older than reported: it began on Oct 20 and losses now total ~$393K

Our tracing shows two earlier waves on Oct 20 and Oct 22 that follow the exact same pattern: Predict accounts emptied, funds bridged to Ethereum, then sent to Tornado Cash

27 accounts were drained in USDT across the three waves. One account alone lost $109K. The median loss was ~$4.8K, and the top 5 accounts make up 73% of the total

Nearly all stolen funds have already entered Tornado Cash. We are actively monitoring this case

[AMLBot @AMLBotHQ]

The @predictdotfun drain is bigger and older than reported: it began on Oct 20 and losses now total ~$393K

Our tracing shows two earlier waves on Oct 20 and Oct 22 that follow the exact same pattern: Predict accounts emptied, funds bridged to Ethereum, then sent to Tornado Cash

27 accounts were drained in USDT across the three waves. One account alone lost $109K. The median loss was ~$4.8K, and the top 5 accounts make up 73% of the total

Nearly all stolen funds have already entered Tornado Cash. We are actively monitoring this case

[AMLBot @AMLBotHQ]

~9,408 SOL (~$950K) was stolen from 48 unique addresses linked to @BloomTrading. According to Bloom Trading, the affected wallets belong to 9 users

One address alone lost 1,636 SOL (~$165K). The median loss per address was ~100 SOL (~$10K), and the top 5 addresses account for 54% of the total losses

All stolen funds were swept to 6nYyCzJJzErbmfxvXqzbAqwoBzNvXUiwr15KCkcgmoe9, where they are now lying dormant

We are actively monitoring this case

[AMLBot @AMLBotHQ]

~9,408 SOL (~$950K) was stolen from 48 unique addresses linked to @BloomTrading. According to Bloom Trading, the affected wallets belong to 9 users

One address alone lost 1,636 SOL (~$165K). The median loss per address was ~100 SOL (~$10K), and the top 5 addresses account for 54% of the total losses

All stolen funds were swept to 6nYyCzJJzErbmfxvXqzbAqwoBzNvXUiwr15KCkcgmoe9, where they are now lying dormant

We are actively monitoring this case

[Bloom @BloomTrading]

Official Statement | Security Incident Update

TL;DR: No private keys were compromised, unaffected wallets are safe, and all affected users will be fully reimbursed by Bloom.

Following our investigation, we have identified the exact attack vector and confirmed the scope of the incident.

The attack exploited a third-party module through a complex Remote Code Execution (RCE) vulnerability. No private keys were accessed or compromised, and we have ruled out broader exposure of users' wallets.

Incident Overview

Affected: 49 wallet addresses belonging to 9 users.

• Total losses: Approximately 9,408 SOL ($947,000).
• Root cause: Exploited third-party module enabling an RCE vulnerability.
• Refunds: Bloom will fully reimburse 100% of the stolen funds directly to secure wallets designated by the affected users.
• We are also working to trace the stolen funds, explore recovery and freezing options, and identify the attacker.

Our team has been developing software since 2018 and operating in crypto since 2021. We are an established team, committed to building for the long term and protecting the trust of our users.

Security threats are an unfortunate reality of this industry, even with extensive precautions in place. Our commitment to user safety, transparency, and business continuity remains unchanged.

The Bloom Team

[AMLBot @AMLBotHQ]

3/ The report breaks this down by target, network and attack type. Download the full report:

https://t.co/fojC79hWBg

[AMLBot @AMLBotHQ]

1/ According to AMLBot’s 2026 report, exchanges were just 7% of cases from January to mid-October, but carried almost a fifth of reported losses.

[AMLBot @AMLBotHQ]

2/ But it’s not only exchanges that get hacked. Individual users were the target in 40% of hacks and exploits.

[AMLBot @AMLBotHQ]

Update: @tether has frozen ~$2.2M linked to the @CoinDCX exploit

Both parked addresses from our last post moved one hop before the freeze: TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V ($720K) → TETvPCoHdB6KorVS3PL1jxf4hh78B7KZKG ($401K) + TGj6jwiBxgdrBByGJSaDs9SFT2BJVCrpqs ($319K) TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 ($665K) → TErumSEPUCZif1kdh3Ja2wNiyynNwM6n8a ($665K)

All three are now frozen. ~$800K more is frozen across 5 other addresses

[AMLBot @AMLBotHQ]

Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT

Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large share went through unidentified services

~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet

We are actively monitoring this case

[AMLBot @AMLBotHQ]

@Cointelegraph We tracked this case as well. About $2.8M of the swept USDT was deposited to Binance. https://t.co/F2fMMtVs2J

[AMLBot @AMLBotHQ]

Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT

Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large share went through unidentified services

~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet

We are actively monitoring this case

[AMLBot @AMLBotHQ]

@CoinDCX We are sorry for your loss. We looked into the case too. ~$2.4M is still parked across fresh addresses. https://t.co/F2fMMtVs2J

[AMLBot @AMLBotHQ]

Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT

Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large share went through unidentified services

~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet

We are actively monitoring this case

[AMLBot @AMLBotHQ]

@BitcoinArchive We tracked this case as well. About $5.5M of the stolen USDT was deposited to OKX. https://t.co/F2fMMtVZSh

[AMLBot @AMLBotHQ]

Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT

Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large share went through unidentified services

~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet

We are actively monitoring this case

[AMLBot @AMLBotHQ]

Wallets on TRON linked to @CoinDCX were drained of ~$16M USDT on Oct 21. ~40 deposit addresses, one of them holding $15.8M, were swept to
TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT

Tracing shows the funds were deposited to @okx (~$5.5M), @binance (~$2.8M) and @Gate (~$1.4M). A large share went through unidentified services

~$2.4M is still parked across fresh addresses, including TQPyFb2HodpR9WYRidAye1V2NzJXKNHS1V (720K) and TMHURkhvUHSNdLmGeD2akjZC2YExGDQYD5 (664K). None are frozen by @tether yet

We are actively monitoring this case

[AMLBot @AMLBotHQ]

AMLBot Plan Update ⚡️

We've made our plans better for you: there are now two, with more features, and each one is built around what you need.

🔹 Personal (formerly Lite) is for checking wallets yourself. Same risk assessment as Business, plus a detailed breakdown of each address you check.

🔹 Business (formerly PRO+) is for VASPs and crypto companies. Our most powerful plan, now with Travel Rule.

See what's in each plan: https://t.co/YL0I9eAzqs

[AMLBot @AMLBotHQ]

@utila_io @Presto_Labs Congratulations on the partnership!

[AMLBot @AMLBotHQ]

Drift exploiter is actively laundering stolen funds through Tornado Cash

~50,595 ETH ($124M) deposited across 520 deposits within 2 days (Oct 20–21, 2026) on Ethereum

[AMLBot @AMLBotHQ]

@WuBlockchain Both FXMR and XMR1 on Hyperliquid are heavily used by money launderers. We have covered this before as well

https://t.co/rDxXwAfdOt

[AMLBot @AMLBotHQ]

Seems like the @Fetch_ai / @ASI_Alliance exploiter has started laundering the stolen funds

100 ETH was swapped to ~266K USDC, bridged via Circle CCTP to Arbitrum and deposited into Hyperliquid, then converted into "FXMR" which is likely a Monero variant

The other 100 ETH was sent to @Chainflip, where the broker rejected the deposit. The attacker was refunded and pivoted to @THORChain, swapped into ~3.28 BTC and began peeling it through a chain of Bitcoin addresses

The remaining ~433 ETH are still parked at the main address 0x2dcc1085fDCf418B421E45e86e4e54637cc21dfE

[AMLBot @AMLBotHQ]

3/ It’s a victim-side view of crypto crime, built from investigations as well as public cases.
Download the full report:
https://t.co/fojC79hWBg

[AMLBot @AMLBotHQ]

1/ Many crypto crime reports focus on publicly known incidents. AMLBot's 2026 report draws on 250+ investigations, including cases reported directly by victims to its team.

Private data that's not shown in public cases reveals that claimed losses rose 41% from Q1 to Q3, while the median claim fell 49%.

[AMLBot @AMLBotHQ]

2/ The findings show two sides of the threat: scams, phishing and wallet compromise made up 72% of cases from January to September. In Q3, hacks were 19% of cases but accounted for 40% of reported losses.