BitOK

Crypto AML & blockchain intelligence for risk management, compliance and investigations.

[BitOK @BitOK_org]

Everyone’s talking about stablecoins. We looked at the data 📊

From China pushing a yuan-pegged coin to Deutsche Bank launching a euro stablecoin, this space is heating up fast.

So we analyzed transaction volumes of USDT and USDC across four major networks — @ethereum, @trondao, @solana and @BNBCHAIN — comparing all of 2024 to just H1 of 2025.

Here’s what we found (see chart)👇
◾️ USDT leads on BSC and Tron, while USDC dominates Solana and shows strong growth on Ethereum (H1 2025 > full 2024).
◾️ Solana’s USDC volumes are down in 2025 — a sharp drop after last year’s peak.
◾️ BSC is booming: USDT & USDC have already surpassed 2024 volumes — in just 6 months.
📌 Yes, USDT on BSC is wrapped — but the volume is real.

Stablecoins aren’t just a crypto tool anymore. They’re becoming a real financial infrastructure.

#Stablecoins #USDT #USDC #CryptoAnalytics #BitOK #Ethereum #Tron #BSC #Solana

[BitOK @BitOK_org]

Think you know crypto? Let’s test it

We put together a short 10-question quiz covering wallets, scams, blockchain security, real-world crypto cases

👉 Take the quiz and find out your level: https://t.co/UiUyjUdN2j

And no cheating!

[BitOK @BitOK_org]

🇨🇭 BitOK is heading to Plan ₿ Forum!

Let’s talk Bitcoin adoption, source of funds, transaction risks, and real-world AML/KYT investigations. Looking forward to connecting with the industry!

📍 Oct 23–24 | Lugano, Switzerland

@LuganoPlanB #PlanBForum #BitOK #Bitcoin

[BitOK @BitOK_org]

🚩 A wallet can look low risk while a specific transfer gets flagged

Address screening looks at the wallet. Transaction screening looks at where this amount came from.
Dmitry Machikhin explains the difference 👇

#TransactionScreening #WalletRisk #CryptoAML

[BitOK @BitOK_org]

🚨 Scammers Read Tether Freeze Requests: 148 Wallets Targeted Before the Freeze

BitOK traced how “unfreeze” operators monitor public @tether blacklist requests on TRON:

➤ 148 wallets received a Risk / ContactMe token before the freeze
➤ 126 of 148 were targeted within 10 minutes of the request
➤ Median delay: 196 seconds
➤ The token never arrived before the blacklist request. It always followed the on-chain request
➤ 14 targets moved $5.275M USDT before the freeze was completed. No causal link to the token was established

📍 Only @tether can remove an address from the USDT blacklist. Public freeze requests can also become real-time targeting signals for scammers.

@trondao #USDT #Tether #TRON #CryptoScam #OnChain #CryptoInvestigations

[BitOK @BitOK_org]

🎰 $2.87B Moved Through Gambling Wallets in 3 Months. Some Came Back in 72 Seconds

BitOK traced flows around 8 gambling platforms across Ethereum and TRON:

➤ $2.87B+ USDT in outbound transfers.
➤ At @Stake, 924,983 USDC returned to the same node in just 72 seconds.
➤ @Roobet sent $207.58M USDT to intermediaries that also routed funds back toward deposit addresses.
➤ Stake and Shuffle sent $3.118M USDT to an address later blacklisted by @tether.

📍 This is transfer volume, not revenue. What stands out is the routing: return loops, shared intermediaries and repeated paths.

#Gambling #CryptoGambling #CryptoCasino

[BitOK @BitOK_org]

🇬🇧 Next stop: London!

BitOK is heading to London Blockchain Conference on Oct 22–23!

Let’s talk source of funds, cross-chain tracing, and real-world AML/KYT challenges with Web3 teams and industry experts.

Going to be there? Let’s connect!

#LDNblockchain #BitOK #AML

[BitOK @BitOK_org]

🧩 Grinex: 163.67 BTC Went Into CoinJoin: The Same Playbook Came Out the Other Side

BitOK traced the April 15 theft:

➤ 46.09M TRX + 547.95 ETH moved from Grinex-linked wallets.
➤ After 72 days, the funds started moving again through fresh wallets, @THORChain and Wasabi.
➤ By Oct 13, 163.67 BTC had entered CoinJoin across 103 traced inputs.
➤ On the other side, the same patterns reappeared: test transfers, equal-sized splits, fresh wallets funded for gas and the same THORChain memo format.
➤ 6 of 7 exit sessions matched the operator’s working windows. Across 120 shifted control windows, none reproduced six matches.

The wider post-CoinJoin branch accounts for 73.04 BTC.

⚙️ CoinJoin broke the direct trail. The playbook survived.

#Grinex #OnChain #CryptoInvestigations #Bitcoin

[BitOK @BitOK_org]

@rrealist Sorry this happened to you. BitOK traced where the stolen funds went.

$718K USDC reached an address labeled HitBTC. 346 SOL was swapped for 14.7 ETH in 44 seconds, with 93% of the ETH still in 3 wallets as of Oct 15.

Full on-chain investigation: https://t.co/aqu5C9PjdX

[BitOK @BitOK_org]

@Ledger @Ledger, we kept tracing the fund flow tied to this incident. On Oct 15, 390 ETH moved into Tornado, with the next visible moves reaching Railgun and post-Zcash wallets. Full update: https://t.co/9W5Qi79mAN

[BitOK @BitOK_org]

🚨 Ledger Funds Are Moving Again: 390 ETH Hit Tornado, $314K Reached Railgun

BitOK kept tracing the flow after our previous update:

➤ On Oct 15, 390 ETH moved into Tornado in 8 transfers.
➤ We identified 17 candidate recipients across 39 withdrawals of 10 ETH.
➤ 4 of those wallets swapped 130 ETH into USDT; 314,375 USDT then moved into Railgun.
➤ A separate Zcash branch led to 12 candidate recipients that received 10.03M USDC, 384.14 ETH and 12.22 BTC.
➤ At our latest snapshot, two post-Zcash candidates still held 200K USDC, while another held 487.92 ETH.

📍 The flow is still active across Tornado, Railgun and post-Zcash wallets.

@Ledger #Ledger #CryptoSecurity #OnChain #CryptoInvestigations

[BitOK @BitOK_org]

🚨 Ledger Funds Are Moving Again: 390 ETH Hit Tornado, $314K Reached Railgun

BitOK kept tracing the flow after our previous update:

➤ On Oct 15, 390 ETH moved into Tornado in 8 transfers.
➤ We identified 17 candidate recipients across 39 withdrawals of 10 ETH.
➤ 4 of those wallets swapped 130 ETH into USDT; 314,375 USDT then moved into Railgun.
➤ A separate Zcash branch led to 12 candidate recipients that received 10.03M USDC, 384.14 ETH and 12.22 BTC.
➤ At our latest snapshot, two post-Zcash candidates still held 200K USDC, while another held 487.92 ETH.

📍 The flow is still active across Tornado, Railgun and post-Zcash wallets.

@Ledger #Ledger #CryptoSecurity #OnChain #CryptoInvestigations

[BitOK @BitOK_org]

🔄 Bitget Update: 126 BTC Entered CoinJoin, $6.05M USDT Sits on 3 TRON Addresses

BitOK kept tracing the Sept 24 @bitget outflow:

➤ 45 new CoinJoin inputs totaling 126.11 BTC appeared on Oct 14–15, bringing the checked set to 566.70 BTC.
➤ Beyond CoinJoin, BitOK found likely continuations through @THORChain, with USDT moving into Ethereum and TRON.
➤ $22.61M USDT0 moved to 15 TRON recipients across 80 transfers.
➤ Three priority TRON addresses now hold $6.055M USDT in total.

⛓️‍💥 The trail is still active, but these figures cover different stages and mixed flows. They shouldn’t be added together as “remaining Bitget funds.”

@GracyBitget, this is where the latest trace stands.

#Bitget #OnChain #CryptoInvestigations #Bitcoin #TRON

[BitOK @BitOK_org]

🔪 $800K Home Invasion: 346 SOL Became 14.7 ETH in 44 Seconds

@rrealist reported that intruders broke into his home, held him at knifepoint and forced him to transfer crypto. He later published the receiving address.

🔍 BitOK traced the on-chain trail:

➤ 718,735 USDC moved to a HitBTC-labeled deposit address.
➤ 346 SOL → 14.7 ETH via @NEARProtocol / @SwapKitPowered, with the Ethereum payout landing just 44 secondsafter the Solana deposit.
➤ As of Oct 15, 13.73 ETH still remained across 3 main wallets.

@solana #OnChain #CryptoSecurity

[BitOK @BitOK_org]

🚨 Ledger Attack: The Missing Piece Was Inside the Device

Ledger has disclosed how the wallets were compromised.

📲 A criminal group bought genuine Ledger devices, installed hidden hardware to capture recovery phrases during setup, and returned the modified wallets to reseller channels in Southeast Asia.

➤ Ledger says its chip, OS and servers weren’t compromised.
➤ Sales through resellers in Southeast Asia and Hong Kong have been suspended.

🔎 BitOK previously traced 37.5M USDT moved in 500K batches, 1,253.9 ETH sent to Tornado Cash and coordinated BTC sweeps.

The transactions were validly signed. The hardware implant now explains how that access may have been obtained.

@Ledger #Ledger #CryptoSecurity #OnChain

[BitOK @BitOK_org]

🔐 Ledger Case: 37.5M USDT Moved in 500K Batches. 1,253.9 ETH Hit Tornado Cash

BitOK traced the October 9 flows after @Ledger_Support warned about complaints tied to a reseller in Southeast Asia.

➤ 75 of 88 TRON outflows were exactly 500K USDT, 37.5M in total, with median gaps of 27 to 28.5 seconds.
➤ 76 Bitcoin addresses swept their full available UTXO sets to one recipient, with no change.
➤ 1,253.9 ETH reached Tornado Cash in 74 confirmed deposits from 14 addresses.
➤ 20 TRON EOAs in the broader trace were blacklisted by @tether and held about 10M USDT at our snapshot.
➤ Cross-chain branches continued through @RelayProtocol and @Chainflip.

The approvals and source-wallet transfers were validly signed on-chain.

🔍 What stands out is the pattern around them: fixed-size batches, synchronized sweeps and repeated routing across networks.

#Ledger #CryptoHack #CryptoSecurity #OnChain #BlockchainForensics #AML

[BitOK @BitOK_org]

🎮 Cyberleek’s GTA 6 “Leak” Campaign: 2,676 SOL in Fees and 821K CYBERLEEK From Votes

BitOK traced how Cyberleek monetized its campaign around purported GTA 6 files on @solana.

➤ The first CYBERLEEK token generated 2,676.67 SOL in one confirmed fee-extraction episode on @RaydiumProtocol.
➤ Six completed votes sent 821,533 CYBERLEEK to the publication key’s token account.
➤ The site displayed “SOL donated,” while the underlying vote accounts actually received CYBERLEEK.
➤ BitOK decoded 37 program accounts and matched 28 site records with current on-chain data.

💵 The payments, token flows and control keys are verifiable on-chain. The authenticity of the GTA 6 files and access to Rockstar systems are not.

#GTA6 #Solana #OnChain #CryptoInvestigations

[BitOK @BitOK_org]

🛡️ Want to check an address or transaction before funds move? Check the risk in BitOK Bot: https://t.co/0IVBA8rFmU

[BitOK @BitOK_org]

🎰 $56.1M Through One Duel/Shuffle User. ≤$11.3M Was New Tornado Inflow

BitOK traced one user behind 75% of Tornado-linked inflows to @Duelcomcasino and 96% to @shufflecom in 2025–2026.

➤ Duel payouts of about 801 ETH and 900 ETH returned to Tornado 33 and 40 hours later.
➤ A 2,000 ETH branch has a strong on-chain link to the @summerfinance_ exploit.
➤ Another branch is probably tied to a ~1,000 BTC theft routed through @THORChain and Tornado.

📍Two confirmed cycles followed the same route: Tornado → Duel → payout → Tornado

#TornadoCash #OnChain #CryptoInvestigations #AML

[BitOK @BitOK_org]

@Ledger_Support BitOK traced the on-chain side of the incident: 75 TRON outflows moved in exact 500K USDT batches, 76 BTC addresses swept their full UTXO sets to one recipient, and 1,253.9 ETH later reached Tornado Cash across 74 deposits. Full investigation: https://t.co/pgIVmW7EbT

[BitOK @BitOK_org]

🔐 Ledger Case: 37.5M USDT Moved in 500K Batches. 1,253.9 ETH Hit Tornado Cash

BitOK traced the October 9 flows after @Ledger_Support warned about complaints tied to a reseller in Southeast Asia.

➤ 75 of 88 TRON outflows were exactly 500K USDT, 37.5M in total, with median gaps of 27 to 28.5 seconds.
➤ 76 Bitcoin addresses swept their full available UTXO sets to one recipient, with no change.
➤ 1,253.9 ETH reached Tornado Cash in 74 confirmed deposits from 14 addresses.
➤ 20 TRON EOAs in the broader trace were blacklisted by @tether and held about 10M USDT at our snapshot.
➤ Cross-chain branches continued through @RelayProtocol and @Chainflip.

The approvals and source-wallet transfers were validly signed on-chain.

🔍 What stands out is the pattern around them: fixed-size batches, synchronized sweeps and repeated routing across networks.

#Ledger #CryptoHack #CryptoSecurity #OnChain #BlockchainForensics #AML

[BitOK @BitOK_org]

🔐 Ledger Case: 37.5M USDT Moved in 500K Batches. 1,253.9 ETH Hit Tornado Cash

BitOK traced the October 9 flows after @Ledger_Support warned about complaints tied to a reseller in Southeast Asia.

➤ 75 of 88 TRON outflows were exactly 500K USDT, 37.5M in total, with median gaps of 27 to 28.5 seconds.
➤ 76 Bitcoin addresses swept their full available UTXO sets to one recipient, with no change.
➤ 1,253.9 ETH reached Tornado Cash in 74 confirmed deposits from 14 addresses.
➤ 20 TRON EOAs in the broader trace were blacklisted by @tether and held about 10M USDT at our snapshot.
➤ Cross-chain branches continued through @RelayProtocol and @Chainflip.

The approvals and source-wallet transfers were validly signed on-chain.

🔍 What stands out is the pattern around them: fixed-size batches, synchronized sweeps and repeated routing across networks.

#Ledger #CryptoHack #CryptoSecurity #OnChain #BlockchainForensics #AML

[BitOK @BitOK_org]

@79thVault Hi @79thVault team, we traced what happened on-chain after the operator access was used, from the sell-back into the pool to the later Ethereum routes.
Full investigation: https://t.co/sSHGr0TjeM

[BitOK @BitOK_org]

🧠 79thVault: 2.01M 79AU Left Through Operator Access

BitOK traced the October 7 flow on @BNBCHAIN.

⛓️‍💥 An address that already held an operator role moved 79AU directly out of the pool. The main recipient then sold the tokens back into the same pool.

➤ 2.01M 79AU went to the main seller.
➤ 92 sells produced 16,249 BNB.
➤ Sales continued even after the operator role was revoked.
➤ 485 BNB later crossed to Ethereum via @RelayProtocol and @AcrossProtocol.
➤ Other traced branches reached labeled Kraken, KuCoin and https://t.co/2WqynCRPmM addresses.

🔐 BitOK found no access-control bypass in this series. The operator already had the required permission.

#OnChain #DeFiSecurity #CryptoInvestigations #BNBChain

[BitOK @BitOK_org]

🧠 79thVault: 2.01M 79AU Left Through Operator Access

BitOK traced the October 7 flow on @BNBCHAIN.

⛓️‍💥 An address that already held an operator role moved 79AU directly out of the pool. The main recipient then sold the tokens back into the same pool.

➤ 2.01M 79AU went to the main seller.
➤ 92 sells produced 16,249 BNB.
➤ Sales continued even after the operator role was revoked.
➤ 485 BNB later crossed to Ethereum via @RelayProtocol and @AcrossProtocol.
➤ Other traced branches reached labeled Kraken, KuCoin and https://t.co/2WqynCRPmM addresses.

🔐 BitOK found no access-control bypass in this series. The operator already had the required permission.

#OnChain #DeFiSecurity #CryptoInvestigations #BNBChain