Funds now parked across 4 ETH addresses. The laundering was elaborate, dozens of hops, splits, and swaps.
Full trace:
https://t.co/Ds58fRqv8u
#DriftProtocol#AML#crypto#Solana
The @DriftProtocol attacker moved stolen funds ($285M) from Solana to Ethereum, using CCTP for most of it. The initial ETH for laundering came from Tornado Cash, bridges, except two addresses used @FixedFloat. That might be a lead.
1/5 Phalcon Network flagged a critical alert: 1.1M USDT deposited into Binance on Tron — with 62% of the sender's funds traced to blocked addresses, the closest frozen just one day earlier.
Here's what we found. 🧵👇
75% of all frozen USDT in 2025 was held by just 275 addresses, each with balances over $1M.
Stablecoin freezing is not a blunt instrument. It's precision leverage on the nodes that matter most.
#ThePhalconReport · Chapter II · The Freeze
NEW: Major investigation dropping February 26 on one of crypto’s most profitable businesses where multiple employees abused internal data to insider trade over a prolonged period of time.
Phalcon Network has identified a seller conducting human trafficking, is laundering illicit profits via complex on-chain routes and funneling funds into OKX @okx exchange. The latest transaction involved $115K.
See @MetaSleuth fund flow graph:
https://t.co/c9HhlN4IIb
#PhalconNetwork
🚨 OKX Hot Wallet @wallet has just triggered multiple urgent alerts in a span of 60 minutes
In just 60 minutes, Phalcon detected 6 separate illicit transactions—each one with escalating risk, totaling over $200k:
1️⃣ Blocked Transfer: $59,935.81 from a suspicious source
2️⃣ Laundering & Sanctioned: $19,294.00 flagged for human trafficking links
3️⃣ Laundering & Sanctioned: $69,925.11 connected to a sanctioned entity
4️⃣ Laundering & Sanctioned: $20,006.95 with dark web ties
5️⃣ Blocked Transfer: $75,382.26 from another suspicious source
6️⃣ Laundering & Sanctioned: $14,561.40 with sanctions and laundering activity
These funds are connected to multiple high-risk sources, including #Huione Group.
🟧 Alerted in #PhalconNetwork, Verified in #PhalconCompliance.
🌐Introducing Phalcon Network:
A public intelligence network that tracks illicit funds across blockchains and alerts your platform BEFORE they're withdrawn.
Real-time detection. Instant alerts. Verifiable evidence.
Join Phalcon Network in 3 steps 👇https://t.co/rqyiEpYF0r
U.S. prosecutors in EDVA charged #Venezuelan national #JorgeFigueira in an alleged ~$1B money-laundering scheme involving crypto wallets, shell companies, and liquidity providers to convert crypto to dollars.
🟧 Verified in #PhalconCompliance.
Relay Bridge parsing expanded beyond EVM
Now supports TRON, Bitcoin & Solana!
See it in action: 500 USDT on TRON → Relay Bridge → 497.53 USDC on Solana👇
https://t.co/1JCPDyJRBA
Cross-chain tracking upgraded!
MetaSleuth now supports Relay Bridge parsing 😎 @RelayProtocol
Funds withdrawn from Binance → bridged to another chain? Track the full flow in one view 🔍
Example 👉 https://t.co/qpjK0tWBZL
Cross-chain tracking upgraded!
MetaSleuth now supports Relay Bridge parsing 😎 @RelayProtocol
Funds withdrawn from Binance → bridged to another chain? Track the full flow in one view 🔍
Example 👉 https://t.co/qpjK0tWBZL
@Andrey_10gwei@beincrypto@Polymarket Great investigation! We mapped the flows from your work into a labelled flow graph. Sharing here: https://t.co/LbnF2Yrafx
Coinbase→#Polymarket→Coinbase loop behind a suspected insider bettor.
252 SOL timing overlaps with a wallet reportedly linked to a WLFI cofounder. ~$400k gains, then funds route back toward the original wallet (incl. Fartcoin).
Worth scrutiny. DYOR. Flow👇
Coinbase→#Polymarket→Coinbase loop behind a suspected insider bettor.
252 SOL timing overlaps with a wallet reportedly linked to a WLFI cofounder. ~$400k gains, then funds route back toward the original wallet (incl. Fartcoin).
Worth scrutiny. DYOR. Flow👇
Insider who made $400,000 on Maduro's capture at Polymarket – could turn out to be someone connected to Steven Charles Witkoff (WLFI Co-Founder)
The entire CT was talking yesterday about an insider who placed around $32k just a few hours before the well–known events in Venezuela, earning a total of $400,000.
Insider's account:
https://t.co/WAG6JeRZ3X
The market where he won the $400k:
https://t.co/s70PNUejJA
I decided to dig into the chain in search of any clues.
Found 2 wallets that were funding the @Polymarket account:
- 0x9c7fca7d24162f0dd09d853e999c3f954ed0f8d1 (https://t.co/CujwkcSqEN)
- 2i7HJJTs8Ht25H8fSjJJSsgGp2HE3umxMrcEa1Cq6hV3 (https://t.co/C7lT419DKz)
Both accounts have no transactions other than funding from the Coinbase exchange and the subsequent deposit to Polymarket.
I noticed that the second wallet (2i7HJJ) was funded from Coinbase with 252.39 SOL on January 1st at 11:53 PM UTC.
I decided to check all deposits to Coinbase within a day before the insider's wallet withdrawal and found one match with 99% accuracy.
BCcTrxcowNeUqhr4yPtAMy5PhhQ5eD8hsjHYmMS8FaV8 (STVLU.SOL) – from this wallet there was a deposit to Coinbase through a deposit address of 252.91 SOL on January 1st at 00:48 AM UTC, meaning approximately 23 hours before the withdrawal to the insider's wallet.
I noticed that this wallet had several registered ENS domains: STVLU.SOL and StCharles.SOL
And the first funder – ES6SiK66UZcsPevTgfVtKtay4o1vWUepeVvb5kfWnJXF with ENS Solhundred.sol
Moving to the latter, we see transactions of $11 million with someone with ENS Stevencharles.sol (22Tqm7fBbrGb5XmT9UkcZhSPjT1Q1DMBatacpmsJGkUz)
Steven Charles – or Steven Charles Witkoff(?), one of the co–founders of World Liberty Finance (WLFI), meaning a person who potentially had access to insider information.
All 3 wallets (STVLU.sol, Solhundred.sol, StevenCharles.sol) – are connected by the same deposit addresses on the Coinbase exchange.
From the insider account on Polymarket, the winnings of approximately $440k were withdrawn to Coinbase 18 hours ago.
14 hours ago, Fartcoin tokens worth $170k were withdrawn from Coinbase to the STVLU.sol (stcharles.sol) wallet.
Another coincidence? Or was part of the profits from insider trading on Polymarket used to buy Fartcoin?
In total, we have several interesting coincidences:
- The amount of the deposit to Coinbase and the amount withdrawn to the insider's wallet for the deposit to Polymarket match with 99% accuracy with a 23–hour difference.
- The ENS(SNS) StevenCharles.sol and StCharles.sol on these wallets match with Steven Charles Witkoff. (Together with the first point, such a coincidence looks strange, doesn't it?)
- The time interval between the withdrawal of winnings from Polymarket to Coinbase and the receipt of Fartcoin to the stvlu.sol wallet is 3–4 hours.
Your take?
Are these just coincidences, or is it really someone connected to Steven Witkoff using insider information to trade on Polymarket?