E.Laszlo

Onchain attribution

[E.Laszlo @ELaszlo_]

A thread explaining how more than 14k users have sent +187ETH in excess to FriendTech’s SC as a result of incorrect key pricing.

Check if you have been affected: https://t.co/8RzvNBiAVP

A joint report (@elaszlo & @h0wlu) submitted to @friendtech and classified as out of scope.

[aaaaaaaaaaway @aaaaaaaaaaway]

oh that's clever, i didnt think at all about unclaimed bridges when looking for contracts to integrate!

withdrawals have been integrated into https://t.co/89eF4FKuJm for most of these bridges

*any donation will be shared with the guys at stuckfunds

[E.Laszlo @ELaszlo_]

2 other addresses linked to LedgerPrime thay may also be tied to the FTX/Alameda bankruptcy estate:

a) ~$1M 0x6A04941De896E4215Eeb8e6eb1b72AD2904D2402

Tx: 0x76ad052d46c948ee04f83bf2493473d7e937f748ed06384c0612f60cabad1208

b) ~$1.3M 0xdCA313c4Df33c2142B2aDf202D6AbF4Fa56e1d41

Tx: 0xd70f0648b7ac7ca87cd347a15158c8e64b792c1bc9eb76df6b70a7fb0e4d01d9

Entity attribution by @arkham

[E.Laszlo @ELaszlo_]

@Moudinho3 found an Alameda Research linked address with ~$15M in USDC pending to be withdrawn from the NEAR Bridge since Nov. 7–8, 2022, just days before filing for bankruptcy

3 hours later, 0x9790E2f55C718A3c3d701542072D7c1D3D2E3F5f just withdrew the funds

+$100M in similar situations, you can check if you have any in Moudinho3's tool: https://t.co/rGKbs23azi

[E.Laszlo @ELaszlo_]

@Moudinho3 found an Alameda Research linked address with ~$15M in USDC pending to be withdrawn from the NEAR Bridge since Nov. 7–8, 2022, just days before filing for bankruptcy

3 hours later, 0x9790E2f55C718A3c3d701542072D7c1D3D2E3F5f just withdrew the funds

+$100M in similar situations, you can check if you have any in Moudinho3's tool: https://t.co/rGKbs23azi

[E.Laszlo @ELaszlo_]

Great work

[moudinho @Moudinho3]

4 days since i launched https://t.co/ArB2SVTaum:

💸 $4.36M in forgotten bridge withdrawals reclaimed
👛 2,596 wallets
🔗 20+ chains hit: Polygon, Optimism, Arbitrum, Blast, zkSync, Scroll, Linea, dYdX...
📈 15x increase in forgotten withdrawals claimed

Some of these had been sitting unclaimed since 2021.

Paste your address, takes 5 seconds 👇
https://t.co/ArB2SVTaum

[E.Laszlo @ELaszlo_]

@flx2255 looks like 0xe07bd590e1198666230932bad5db3dbbe21e7d57 got ~100k usdc frozen!

[E.Laszlo @ELaszlo_]

Contract: 0x66be1bc6C6aF47900BBD4F3711801bE6C2c6CB32 (3FMutual insurance, by Hakka Finance)

Deployed in 2020, it was designed so only active insurance holders would get paid if MakerDAO shut down. Coverage lasted up to 100 days and after 6 years almost the entire 1899 ETH pool is now “orphan”

Meaning that right now a claim on ~1,687 ETH would cost just 0.1, triggered if Sky’s DAO decides to end operations

dyor nfa

[E.Laszlo @ELaszlo_]

@dieselbabyy @osint_based thank you, and agreed, its a matter of time

[VAL @osint_based]

‼️ More than $230,000 drained from hundreds of wallets in the last 2 days

Attack vector is still unknown, probably session hijacking

Amounts from each victim are mostly small, but the total is already big

Most of the funds are sitting in $USDC

Attacker wallet: 0x7028174ED69A237DE0791101b5b85D1E6Db35887

[E.Laszlo @ELaszlo_]

~45,000 addresses swept, what's going on? leaked keystore / weak keygen?

Active drainer right now: 0x5723168BfdF49D832B3A09fD028c3b03EC7Bfd52 (94 ETH)

Past drained tokens held at:
0xe4a219fBEd16E5c62e335082521F44C508B19191 (2907 ETH)

0x8D7C20e3B88Bc70246306d9620C2d555448523f7 (101 ETH)

0x220eCBB6c968FbD6F73cfE56017D78FCc4f18647 ($115k)

0xA586B23b0a0847f82B40e56C8b40d141C43BAa81 ($30k)

0x2Ce7230e56aD6dbabb014eE17935C4F47af829a4 ($150k)

0x9c9cf4713Ef140FaA6DA2C18486990f04C079Ca9 ($93k)

0x97daC64bC5F98D215EFF1d3d7F8d544ba13aacd4 ($150k)

0x3886B93a0C4F9b214D50FD6e6d268f5937DBD1E4 ($163k)

to name a few!

[E.Laszlo @ELaszlo_]

1/ One entity (likely) has swept ~4,545 ETH (~$11,5M) out of ~44,000 addresses tied to LastWinner, a 2018 Ethereum game

3,000 ETH sitting on the wallets + 1,545 ETH held in the game contract. Run in 4 phases since May 2026

Consolidation or theft?

[E.Laszlo @ELaszlo_]

@ncerovac Hey Nemo, I've just DMed you on TG. I hope you'll look into what I shared, so you can verify it's true. If there's anything I can do to help, please let me know

Thank you

[E.Laszlo @ELaszlo_]

6/ Most of the ETH is currently parked at 0xe4a219fBEd16E5c62e335082521F44C508B19191 (2,907 ETH)

If you want to take it further this is where I stored all addresses, scripts and open questions. Hopefully its useful:
https://t.co/QvnE7xOLUW

[E.Laszlo @ELaszlo_]

1/ One entity (likely) has swept ~4,545 ETH (~$11,5M) out of ~44,000 addresses tied to LastWinner, a 2018 Ethereum game

3,000 ETH sitting on the wallets + 1,545 ETH held in the game contract. Run in 4 phases since May 2026

Consolidation or theft?

[E.Laszlo @ELaszlo_]

5/ Why could it be theft

b) most are wallets created on the app: ~94% of them had the LastWinner contract as their nonce 0 tx

c) it doesn’t look like a basic automated bot fleet: tx counts vary (5–50), gas prices vary and the median time from funding to first play is ~52 minutes

d) per 2018 third party reviews, app minted wallets couldn't export their key: ~95% of the addresses have 0 transactions between 2018 and the 2026 sweep

[E.Laszlo @ELaszlo_]

Attack 2, Argent:

If an Argent v1 wallet has no guardians set, anyone can start a recovery naming themselves as the new owner, wait the 36-hour timelock and own the wallet

Which is what happened on this 400 UNI airdrop claim drain on 2026/08/28:
0xde7e5d505de8986670ec912c29b6ea0f417f70de55a89fcde2e3bfb42918c40f

[E.Laszlo @ELaszlo_]

‼️~$117,000 worth of UNI + DAI drained from 148 Augur v2 wallets in the last 3 months, via a bug in the AugurWalletRegistry

56 wallets drained for $90,000 worth of UNI airdrop tokens

🧵

[E.Laszlo @ELaszlo_]

Addresses that received drained funds:

0xbe236580034e054273CD27f765934BeBFdc3920F

0x1167957FABACC17a5FC013CA5937f1a13196e543

0x33D5FC293F9F038B3361266508AC9FA894560AFF

0x3C44355364706D94707A21DA32736431F9F9474A
0xB00B527D6C15BD6FED0E147C27CAB675A340107B

0xCCAC10CA9E5592CF2F9DF81FF3E466DFB83FF3B1

0xFC3FACD67138966AB0C841E905B0C4BCA1ABE92F