BlockSec MetaSleuth

Crypto Tracking by @BlockSecTeam / Monitor Movements / Track Crime / DYOR / TG: / 🚀 NEW: Try Phalcon Compliance FREE @Phalcon_xyz

[BlockSec MetaSleuth @MetaSleuth]

Funds now parked across 4 ETH addresses. The laundering was elaborate, dozens of hops, splits, and swaps.

Full trace:
https://t.co/Ds58fRqv8u

#DriftProtocol #AML #crypto #Solana

[BlockSec MetaSleuth @MetaSleuth]

The @DriftProtocol attacker moved stolen funds ($285M) from Solana to Ethereum, using CCTP for most of it. The initial ETH for laundering came from Tornado Cash, bridges, except two addresses used @FixedFloat. That might be a lead.

[BlockSec Phalcon @Phalcon_xyz]

Our detailed analysis of the @DriftProtocol incident, based on public information:
https://t.co/Sisgi1Jsq3

[BlockSec MetaSleuth @MetaSleuth]

Detailed fund flow available here 👇
https://t.co/LZ3gxrS5Lc

[BlockSec Phalcon @Phalcon_xyz]

1/5 Phalcon Network flagged a critical alert: 1.1M USDT deposited into Binance on Tron — with 62% of the sender's funds traced to blocked addresses, the closest frozen just one day earlier.

Here's what we found. 🧵👇

[BlockSec Phalcon @Phalcon_xyz]

#ThePhalconReport — Complete.

It is a four-chapter investigation into the state of crypto crime in 2025.

Full report ↓
https://t.co/7dWkGGNeeG

🟧 Powered by #PhalconCompliance · @BlockSecTeam

[BlockSec MetaSleuth @MetaSleuth]

Go and get our full crypto crime reprot (2025)👇
https://t.co/GHVrIZlJ07

You'll be shocked by the numbers.

[BlockSec Phalcon @Phalcon_xyz]

75% of all frozen USDT in 2025 was held by just 275 addresses, each with balances over $1M.

Stablecoin freezing is not a blunt instrument. It's precision leverage on the nodes that matter most.

#ThePhalconReport · Chapter II · The Freeze

[BlockSec MetaSleuth @MetaSleuth]

Huge. 👀

[ZachXBT @zachxbt]

NEW: Major investigation dropping February 26 on one of crypto’s most profitable businesses where multiple employees abused internal data to insider trade over a prolonged period of time.

[BlockSec MetaSleuth @MetaSleuth]

@zachxbt Huge.

[BlockSec MetaSleuth @MetaSleuth]

@stacy_muur @zachxbt Thanks for mentioning us :)

[BlockSec MetaSleuth @MetaSleuth]

@Phalcon_xyz @okx An updated fund flow graph:

https://t.co/Dnjp2hvVgO

[BlockSec MetaSleuth @MetaSleuth]

The fund flow graph

https://t.co/Dnjp2hvVgO

[BlockSec Phalcon @Phalcon_xyz]

Phalcon Network has identified a seller conducting human trafficking, is laundering illicit profits via complex on-chain routes and funneling funds into OKX @okx exchange. The latest transaction involved $115K.

See @MetaSleuth fund flow graph:

https://t.co/c9HhlN4IIb

#PhalconNetwork

[OnchainSurfer @onchainsurferx]

Truebit Protocol exploit (Jan 8, 2026): ~$26M (~8,535 ETH) lost.

On-chain trace below.
https://t.co/hscnY5eOTz

@BlockSecTeam @MetaSleuth

#OnChainAnalysis #Ethereum

[BlockSec MetaSleuth @MetaSleuth]

There's something in #PhalconNetwork.

Real-time alerts. Free for all.

Join it.

[BlockSec Phalcon @Phalcon_xyz]

🚨 OKX Hot Wallet @wallet has just triggered multiple urgent alerts in a span of 60 minutes

In just 60 minutes, Phalcon detected 6 separate illicit transactions—each one with escalating risk, totaling over $200k:

1️⃣ Blocked Transfer: $59,935.81 from a suspicious source
2️⃣ Laundering & Sanctioned: $19,294.00 flagged for human trafficking links
3️⃣ Laundering & Sanctioned: $69,925.11 connected to a sanctioned entity
4️⃣ Laundering & Sanctioned: $20,006.95 with dark web ties
5️⃣ Blocked Transfer: $75,382.26 from another suspicious source
6️⃣ Laundering & Sanctioned: $14,561.40 with sanctions and laundering activity

These funds are connected to multiple high-risk sources, including #Huione Group.

🟧 Alerted in #PhalconNetwork, Verified in #PhalconCompliance.

[BlockSec Phalcon @Phalcon_xyz]

🌐Introducing Phalcon Network：

A public intelligence network that tracks illicit funds across blockchains and alerts your platform BEFORE they're withdrawn.

Real-time detection. Instant alerts. Verifiable evidence.

Join Phalcon Network in 3 steps 👇https://t.co/rqyiEpYF0r

[BlockSec Phalcon @Phalcon_xyz]

U.S. prosecutors in EDVA charged #Venezuelan national #JorgeFigueira in an alleged ~$1B money-laundering scheme involving crypto wallets, shell companies, and liquidity providers to convert crypto to dollars.

🟧 Verified in #PhalconCompliance.

[BlockSec MetaSleuth @MetaSleuth]

Relay Bridge parsing expanded beyond EVM

Now supports TRON, Bitcoin & Solana!

See it in action: 500 USDT on TRON → Relay Bridge → 497.53 USDC on Solana👇
https://t.co/1JCPDyJRBA

[BlockSec MetaSleuth @MetaSleuth]

Cross-chain tracking upgraded!

MetaSleuth now supports Relay Bridge parsing 😎 @RelayProtocol

Funds withdrawn from Binance → bridged to another chain? Track the full flow in one view 🔍

Example 👉 https://t.co/qpjK0tWBZL

[BlockSec MetaSleuth @MetaSleuth]

Full list of supported cross-chain bridges:
✅ Across
✅ Arbitrum Bridge
✅ Avalanche Bridge
✅ Bridgers
✅ CBridge
✅ Hop
✅ Optimism Gateway
✅ PoS Bridge
✅ Relay
✅ Stargate / Stargate V2
✅ Synapse
✅ Wormhole

Cross-chain ≠ untraceable
👉 https://t.co/cosFbNb1b7

[BlockSec MetaSleuth @MetaSleuth]

Cross-chain tracking upgraded!

MetaSleuth now supports Relay Bridge parsing 😎 @RelayProtocol

Funds withdrawn from Binance → bridged to another chain? Track the full flow in one view 🔍

Example 👉 https://t.co/qpjK0tWBZL

[BlockSec MetaSleuth @MetaSleuth]

@Andrey_10gwei @beincrypto @Polymarket Great investigation! We mapped the flows from your work into a labelled flow graph. Sharing here: https://t.co/LbnF2Yrafx

[BlockSec MetaSleuth @MetaSleuth]

Coinbase→#Polymarket→Coinbase loop behind a suspected insider bettor.

252 SOL timing overlaps with a wallet reportedly linked to a WLFI cofounder. ~$400k gains, then funds route back toward the original wallet (incl. Fartcoin).

Worth scrutiny. DYOR. Flow👇

[BlockSec MetaSleuth @MetaSleuth]

📎MS Canva :https://t.co/tbsBcEb1Kc

[BlockSec MetaSleuth @MetaSleuth]

Coinbase→#Polymarket→Coinbase loop behind a suspected insider bettor.

252 SOL timing overlaps with a wallet reportedly linked to a WLFI cofounder. ~$400k gains, then funds route back toward the original wallet (incl. Fartcoin).

Worth scrutiny. DYOR. Flow👇

[Andrew 10 GWEI @Andrey_10gwei]

Insider who made $400,000 on Maduro's capture at Polymarket – could turn out to be someone connected to Steven Charles Witkoff (WLFI Co-Founder)

The entire CT was talking yesterday about an insider who placed around $32k just a few hours before the well–known events in Venezuela, earning a total of $400,000.

Insider's account:
https://t.co/WAG6JeRZ3X

The market where he won the $400k:
https://t.co/s70PNUejJA

I decided to dig into the chain in search of any clues.
Found 2 wallets that were funding the @Polymarket account:
- 0x9c7fca7d24162f0dd09d853e999c3f954ed0f8d1 (https://t.co/CujwkcSqEN)
- 2i7HJJTs8Ht25H8fSjJJSsgGp2HE3umxMrcEa1Cq6hV3 (https://t.co/C7lT419DKz)

Both accounts have no transactions other than funding from the Coinbase exchange and the subsequent deposit to Polymarket.

I noticed that the second wallet (2i7HJJ) was funded from Coinbase with 252.39 SOL on January 1st at 11:53 PM UTC.

I decided to check all deposits to Coinbase within a day before the insider's wallet withdrawal and found one match with 99% accuracy.

BCcTrxcowNeUqhr4yPtAMy5PhhQ5eD8hsjHYmMS8FaV8 (STVLU.SOL) – from this wallet there was a deposit to Coinbase through a deposit address of 252.91 SOL on January 1st at 00:48 AM UTC, meaning approximately 23 hours before the withdrawal to the insider's wallet.

I noticed that this wallet had several registered ENS domains: STVLU.SOL and StCharles.SOL

And the first funder – ES6SiK66UZcsPevTgfVtKtay4o1vWUepeVvb5kfWnJXF with ENS Solhundred.sol

Moving to the latter, we see transactions of $11 million with someone with ENS Stevencharles.sol (22Tqm7fBbrGb5XmT9UkcZhSPjT1Q1DMBatacpmsJGkUz)

Steven Charles – or Steven Charles Witkoff(?), one of the co–founders of World Liberty Finance (WLFI), meaning a person who potentially had access to insider information.

All 3 wallets (STVLU.sol, Solhundred.sol, StevenCharles.sol) – are connected by the same deposit addresses on the Coinbase exchange.

From the insider account on Polymarket, the winnings of approximately $440k were withdrawn to Coinbase 18 hours ago.

14 hours ago, Fartcoin tokens worth $170k were withdrawn from Coinbase to the STVLU.sol (stcharles.sol) wallet.

Another coincidence? Or was part of the profits from insider trading on Polymarket used to buy Fartcoin?

In total, we have several interesting coincidences:

- The amount of the deposit to Coinbase and the amount withdrawn to the insider's wallet for the deposit to Polymarket match with 99% accuracy with a 23–hour difference.

- The ENS(SNS) StevenCharles.sol and StCharles.sol on these wallets match with Steven Charles Witkoff. (Together with the first point, such a coincidence looks strange, doesn't it?)

- The time interval between the withdrawal of winnings from Polymarket to Coinbase and the receipt of Fartcoin to the stvlu.sol wallet is 3–4 hours.

Your take?

Are these just coincidences, or is it really someone connected to Steven Witkoff using insider information to trade on Polymarket?