0xChecker

Smart Contract Researcher

[Noxos Intelligence @NoxosIntel]

1/ CERBERUS, our monitoring engine, alerted us that the attacker behind the @x100global exploit has begun laundering funds through Tornado Cash.

The following addresses made deposits:

0x8296721489d0a7e934edd66ea27159b1c88a42e5
↳ 420.8 #ETH across multiple deposits of 0.1 and 10 ETH.

0xF637DCeE7Dd96E8FDaB926C5993D558B52D635ea
↳ 400.4 #ETH across multiple deposits of 0.1 and 100 ETH.

[0xChecker @Checker0x]

@NoxosIntel @x100global and now?

[0xChecker @Checker0x]

@NoxosIntel @x100global Good, good 👌

[Noxos Intelligence @NoxosIntel]

An hour ago, @x100global was exploited for ~$4.75M in #USDT on Ethereum.

Our initial tracing shows the stolen funds were swapped to ~2,022 #ETH via Uniswap and are now split across 5 addresses:

0x8296721489d0a7e934edd66ea27159b1c88a42e5: 422 ETH

0xf637dcee7dd96e8fdab926c5993d558b52d635ea: 400 ETH

0x64b135af3d80733c9c290d58873e2cccb34a81ae: 400 ETH

0x4fdb9f9a44b356c8a9c2ea060a40fb7a9caabef3: 400 ETH

0x6790cf09ba33d05ada2c13cbb4104f5b8b666391: 400 ETH

We’re monitoring these addresses and will post updates.

[Noxos Intelligence @NoxosIntel]

An attacker exploited the Newmont (NEM) token contract on BNB Smart Chain and drained ~$726K in #USDT.

Attacker: 0xFd929B0F270DFeA6C4827262b4E2bF6Ea50FE9b6

Fund flow (traced by HYDRA):

1. Stolen USDT bridged from BNB Smart Chain to Ethereum via Relay.
2. USDT swapped for 296 #ETH on CoW Swap across 3 transactions.

Current status: The funds are still held at the attacker’s address: https://t.co/qVTk6xE2Gg

We’re monitoring the address and will post updates if the funds move.

[0xChecker @Checker0x]

@NoxosIntel Lovely ❤️ Hope the people will appreciate it

[0xChecker @Checker0x]

@NoxosIntel I see. Well, this sounds like a great contribution for the space. Is it going to be paid?

[0xChecker @Checker0x]

@NoxosIntel That's interesting. What is it about?

[0xChecker @Checker0x]

@NoxosIntel Awesome news, guys 🫡

[Noxos Intelligence @NoxosIntel]

1/
HYDRA, the tracing engine behind Noxos Intelligence, has finished its 2-month testing phase.

Our in-house team and a group of volunteer private investigators ran 240+ multi-chain traces through it.

Here's what comes next 👇

[0xChecker @Checker0x]

@NoxosIntel @BitMartExchange Good questions. Hope they will be answered....

[Noxos Intelligence @NoxosIntel]

You're paying out selectively and still collecting deposits.

From Aug 29 to Sep 8, all 148 stablecoin payouts from BitMart 16 were under $100. On Sep 18 it sent $106K to 17 addresses in under three minutes. Hours later you swept deposits sent after your July 26 suspension.

On-chain, Aug 29 to Sep 28:

- BitMart 16 made 169 stablecoin payouts (~$119K) and has sent nothing since Sep 18. It still holds ~277 ETH and ~$131K in stablecoins.

- A BitMart-attributed Solana hot wallet paid 36,030 USDC to four Binance deposit addresses on Sep 23. It still holds 222K USDC and 2,894 SOL.

- You suspended deposits on July 26: https://t.co/pHANWc64d5

On Sep 18 you still swept at least $19K in deposits made between Aug 22 and Sep 15 into your hot wallets.

Example, 4,000 USDT deposited Aug 29: https://t.co/K0f9ymGDgC

On May 23 you said you'd publish proof of reserves: https://t.co/rlCdwXp2YO

You still haven't.

On Sep 9 you said you'd update users on the action plan within three weeks: https://t.co/LbMAOffjNo

That's Sep 30. The update needs to answer:

1. What qualified users for the Sep 18 and Sep 23 batches: amount, VIP status, request date? Why was every payout from Aug 29 to Sep 8 under $100? Where is everyone else in the queue?

2. Were the post-suspension deposits you swept credited to their senders? If not, when will they be returned?

3. Your User Agreement (§2.7.1) says assets in customers' wallets are not BitMart's property, cannot be lent out, and are not subject to creditors' claims: https://t.co/I7aH4mPhAs

Are they all still there, 1:1? If yes, why does your Aug 21 update talk about distributions to creditors? https://t.co/EdvoDoWA2A

4. On what date will you publish assets and liabilities by asset, with a Merkle tree users can check their own balances against?

5. Since July 1, has any insider, affiliate, VIP account, market maker or listed project withdrawn while other users waited? Yes or no, and how much?

6. Who is the independent custody overseer, and on what date does it take control of keys and withdrawal approvals?

7. Will users face any haircut, forced conversion or lock-up? What is the date of the first distribution?

[0xChecker @Checker0x]

@NoxosIntel Here we go again, another crit damage.

[0xChecker @Checker0x]

@dLegion_Sec @NoxosIntel @flamincome Most likely fund another exploit...

[0xChecker @Checker0x]

@NoxosIntel @flamincome Good job guys!

Didn't saw anything from you past weeks or so. Glad you are back

[Noxos Intelligence @NoxosIntel]

1/4
Flamincome Finance (@flamincome) has reportedly been drained for 345,902 #USDT on Ethereum.

The attacker swapped the funds to 144.1 #ETH via LiFi and deposited them into Tornado Cash across 37 transactions.

Details 👇

[0xChecker @Checker0x]

@NoxosIntel Liked, retweeted, and bookmarked! It'll be good if the CEXs cooperate here as well!

[Noxos Intelligence @NoxosIntel]

7/ We'd like to hear from law enforcement or anyone in a legal role who can check this case and act on it.

This is not a one-off. A few weeks ago one of our own team got a call from "Binance Support." They said his funds were at risk because of new EU rules (MiCA) and he had to move them to a "safe wallet." The wallet was a Trust Wallet browser extension with a seed phrase the scammers had made themselves — and sent to him by email.

These scammers are getting bolder. They belong in jail, but that takes government agencies around the world working together.

If you're reading this, please share it. The more people who see it, the better the chance it reaches someone who can act.

[Noxos Intelligence @NoxosIntel]

1/ Following up on our previous thread — here's the trace for the Aug 10 attack, ~$870K+ drained.

Attacker address: 0x5172F58981ddD5230F4650e8809A83263A5F2c0e

Ethereum again as the starting chain. The full investigation is ongoing; we'll publish the rest once it's finalized. This thread covers the #Ethereum branch only.

Breakdown👇