VAL

doing onchain investigations better than your local law firm

[VAL @osint_based]

$913,000 in XMR disputed between a swap service and its user, and nobody can prove what happened

User says he sent 1,438 XMR to Pablo Cash OTC to swap these funds in two transactions, 700 XMR and 738 XMR

And got nothing back

Right after deposits the swap service went down for maintenance and blamed a PHP vulnerability

Pablo Cash says funds never arrived and cannot find the order IDs or the deposit address in its records

It also points at the screenshots, 700 $XMR transfer shows an earlier block with fewer confirmations than the 738 one, while both phone screens show the same time

The dispute is now in arbitration on a forum

[VAL @osint_based]

‼️ $50,019 lost due to an address poisoning attack

Victim was making a series of transfers to the intended address, and right after the first one a poisoning bot sent dust from a lookalike address

The next transfer, 50019 USDC, went straight to the fake one, while the two after that went to the correct address again

Attacker already swapped everything to 24.76 ETH and left it on the wallet

Fake address: 0x8B1Fdda74283D4d86E4a4F213eD5B6cbc2B73200
Real address: 0x8B1f5FF294702Da5B6f04cB1F964dA3446b73200

[VAL @osint_based]

‼️ Pando Rings attacker sent 3,540 ETH to Tornado Cash, four years after the attack

For two of those four years the stolen funds were sitting in Aave and earned him an extra $1.86M in yield

On 2 November he sent another 4,000 ETH to the same mixer

In total 9.14k ETH went to Tornado Cash since June, in 98 transfers

That was the last of the stolen funds, only 8.28 ETH left on the wallet

0x303d0a175ceec14dd7b3d4f60cabe6cec06a3d9f

[VAL @osint_based]

‼️ More than $9M extracted by a threat actor running address poisoning attacks for almost two years

On 25 October they started moving funds from every wallet they had been collecting on, which is what made it possible to identify all of their attacks

Some of those wallets held one successful poisoning attack of mid to high six figures, others were where proceeds from smaller attacks had been consolidated over time

Everything went to one wallet

4,300 ETH in total

Over the last weeks all of it was sent to Tornado Cash in 47 transfers

Graph shows only part of the key inflows, a huge number of victims is behind these funds

Consolidation wallet:
0x1aca6e852d225bf25bb0eec3fc125dae9d838c8a

[VAL @osint_based]

Data from Polytrop by @AMLBotHQ

It maps and updates every wallet touched by the stolen funds

https://t.co/zi5cSQANUs

[VAL @osint_based]

‼️ 7,541 wallets already under watch from the Binance $6.3B hack

3,692 wallets are involved in the funds flow and 3,849 are currently holding at least some funds, according to Polytrop

Attackers are still in an active phase, funds are being spread across wallets

And bridges are used to move them into assets they consider safer

There were also attempts to use centralized services and

Most of the funds are in ETH and BTC right now

[VAL @osint_based]

@mm156487 100%

[VAL @osint_based]

‼️ Binance SAFU fund holds 15,000 BTC

That is around $1.18B at current prices

Outflows from today's incident are estimated at more than $5B

Binance of course has more reserves than that

And more than $1.8B from this hack has already been frozen by Tether and Circle

Public SAFU address:
1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD

[VAL @osint_based]

@MayaStone420 Swap service with no aml and kyc

[VAL @osint_based]

$913,000 in XMR disputed between a swap service and its user, and nobody can prove what happened

User says he sent 1,438 XMR to Pablo Cash OTC to swap these funds in two transactions, 700 XMR and 738 XMR

And got nothing back

Right after deposits the swap service went down for maintenance and blamed a PHP vulnerability

Pablo Cash says funds never arrived and cannot find the order IDs or the deposit address in its records

It also points at the screenshots, 700 $XMR transfer shows an earlier block with fewer confirmations than the 738 one, while both phone screens show the same time

The dispute is now in arbitration on a forum

[VAL @osint_based]

@DontTraceMeBruh At least wait for the first swap to finish

[VAL @osint_based]

@bombaklat5tttf @XMRVoid why?

[VAL @osint_based]

@XMRVoid From what I understand they hold guarantee deposits on several services like OrangeFren

[VAL @osint_based]

Pablo Cash statement:

"After receiving the necessary data we checked the claimant's information. The order IDs he provided are not in our database. The Monero address he provided was not generated by our backend and is not among the payment details issued by the service. We also found no incoming transfers matching the claimed swaps.
At the same time, the claimant still has not provided a single PGP signed email from our service, which is issued to the client when an exchange is created."

And user says he simply forgot to save the PGP

[VAL @osint_based]

‼️ $750,000 lost due to an exploit

5 days ago the Cysic cross-chain bridge was exploited, attacker minted 10,000,000 CYS without authorization

All funds were swapped to ETH and 309 ETH is sitting on the wallet now

Cysic Foundation already sent an onchain message asking to return 90% of the ETH within a 72 hour window

0x1106De394da07e90b02161465EA0421B74DB4691

[VAL @osint_based]

‼️ Drift exploiter sent $39M to Tornado Cash in the last few hours

After 3 months of inactivity the transfers started again, 16,600 $ETH already moved to the mixer

Still more than $200M of stolen funds on the exploiter wallets, almost all of it in $ETH

0xAa843eD65C1f061F111B5289169731351c5e57C1

[VAL @osint_based]

Peak laundering patience! 4,932 ETH was withdrawn from the mixer back in 2022, and over the next four and a half years all of it was deposited back in

In June 2022 this wallet withdrew 4,932 ETH from Tornado Cash

After that all of this ETH went back to Tornado Cash, from July 2022 to this week, the longest gap between transfers 15 months

All of this is probably done to complicate demixing and make it harder to identify who is behind the funds

0xFFD837984668002AA8AaE4A8839782293c91187e

[VAL @osint_based]

CryptoBilis Ledger drainer continues sending funds to Tornado Cash

1 hour ago more than $1.1M in ETH was distributed to 4 wallets, and from those wallets all funds went to the mixer

Looks like many more millions will go the same way

Around $7.5M in ETH is sitting here right now, $2M has already gone to Tornado from this wallet in two rounds

0xfa4EaBB840A33C156E600311433AE261CBfCb0e2

[VAL @osint_based]

‼️ Attacker returned $11M to 79thVault in less than 24 hours after the exploit

Yesterday 16,249 BNB was exploited from 79thVault infrastructure

After a round of onchain negotiations the exploiter sent 15,000 BNB back today

1,249 BNB stayed with him as a bounty, 7.7% of the exploited amount

Return address: 0x2BFcF0475e7B40cd68E91A7178Cf5E43262EB7b2

[VAL @osint_based]

@PierreL94460800 More than we could imagine

[VAL @osint_based]

Scammer who extracted over $300M from Coinbase users continues laundering funds through Tornado Cash

$1.11M was moved from one of the consolidation wallets, swapped to ETH and sent to the mixer 3 days ago

8.3 ETH were sent to another wallet and bridged to Hyperliquid, where spot XMR1 was bought for that amount

Still holding $16M on this consolidation wallet, untouched for a year

0xC84C35f57CaEeB5Da8E31D1144c293Ae5851Ab84