PublicAML

We trace stolen crypto in real time: where the funds sit, who got paid, what's still recoverable. Free AML check for any wallet →

[PublicAML @PublicAML]

🚀 Introducing PublicAML – The People’s AML Firewall

A free, open tool to protect wallets, OTC desks, DeFi & NFTs from scams, hacks, and DPRK laundering.

🛡️ Free forever
⚡ Real-time checks
📊 Court-ready compliance

🔗 Learn more: https://t.co/IJ0zKbH6Zr

[PublicAML @PublicAML]

The Aztec Connect hacker's wallet sat on 909 ETH + 270k DAI + 168 wstETH for 127 days.

On 19 Oct it sold everything for ETH and sent 1,255.8 ETH (~$3M) to Tornado Cash in 30 deposits, in 23 minutes. 0.036 ETH left.

Trace: https://t.co/xO43o2WEeP

[PublicAML @PublicAML]

@rajkaria_ @foramenden Thanks for running this, Raj and @foramenden. One tip for viewers: a real AML check only needs the address pasted as text. If a "checker" asks you to connect a wallet or sign anything, it's a drainer. Free, no account: https://t.co/YfT1BTYXVN

[Raj Karia @rajkaria_]

🔴 LIVE TODAY: Is your wallet frozen?

@foramenden and I are checking crypto addresses live with PublicAML. Drop yours and we’ll run it on stream.

🕟 4:30 PM UTC · 12:30 PM ET · 10:00 PM IST
📺 Here on X + YouTube

What we’ll cover:
→ Why wallets get frozen, and how innocent users get caught up
→ Live checks against OFAC/EU sanctions lists and scam databases
→ How to screen an address before you send funds
→ Using the PublicAML site, API & Telegram bot
→ Your questions, live

Reply with an address you want checked

[PublicAML @PublicAML]

@shivamtas No freeze was used. Each Safe had a single owner key (1-of-1), so that key could have switched the module off at any time. But the drain itself was one transaction with a flash loan, so there was no window for a pause to act. A pause helps when an attack takes several steps.

[PublicAML @PublicAML]

The "Aave v3 Loop Safe Module" exploit (1 Oct), read on chain:

• Gas came from Railgun; all 114 ETH went back into Railgun 98 minutes after the attack
• The owners' 10% bounty offer arrived 4h17m after that
• Both drained Safes run on one key, and the adapter's deployer relays for the same owners. Of 24,998 Safe module activations since July, only these two ever enabled it

https://t.co/m5A6gJEK5l

[PublicAML @PublicAML]

The Houthis' 8 OFAC-listed Tron wallets moved $915M in USDT, $823M of it through one wallet.

Tether froze $750k on two of them in Dec 2024, four months before the sanctions. On sanctions day the other six held 24 cents.

https://t.co/GgXC5x4jof

[PublicAML @PublicAML]

UNCX exploit update:

- $1.49M lost on 4 chains, not $86k. BNB Chain took $969k
- Its attacker (Tornado-funded) parked ~$1.08M (789,502 USDT, 2.41 BTCB, 127.5 BNB) on a wallet that never sent a tx
- UNCX offered it a 10% bounty on-chain, deadline 17 Oct

https://t.co/VYoqdqM7Uw

[PublicAML @PublicAML]

Gamdom hack, traced on chain:

- $2.2M still parked: 2,005,863 DAI + 86.94 ETH on 3 wallets. All USDT/USDC was swapped to DAI, which can't be frozen
- Hyperliquid got $500k, not $250k; $363k of it bought FXMR, a Monero token
- 1.5 BTC went into a coinjoin

https://t.co/I3w1DxTjXE

[PublicAML @PublicAML]

Moonwell MAMO exploit (Base, 27 Aug), read on chain 7 weeks later:

• Funded with ~800 ETH from Tornado Cash, not 0.1 ETH. The "99 ETH from bridges" was its own Tornado ETH sent round a bridge loop.
• 1.95M USDC bridged in, 8.73M out → attacker's own gain ≈ $6.78M.
• 8,728,319 DAI still sit untouched on 0xD71d…C384.

https://t.co/oNvdpLQdrs

[PublicAML @PublicAML]

Ledger/CryptoBilis thief, 15 Oct update:

Fifth wave this morning: 140 ETH from 0xfa4E…b0e2 to one fresh wallet, 130 ETH of it into Tornado Cash.

Still on the thief's wallets: ~11,690 ETH (~$27.7M), down from 15,075 on 10 Oct. 203.8 BTC untouched.

https://t.co/k7rVEutwSi

[PublicAML @PublicAML]

UNCX vesting exploit (14 Oct), read on chain:

• Reported loss ~$86k is paper value. Sold into thin pools, the 5 tokens (EDGEN, ZC, PEPECOIN, LO0P, PAAL) produced 14.93 ETH (~$36k)
• 9.06M ZC are stuck on the attacker's own exploit contract
• Gas came from a wallet funded by Tornado Cash in Nov 2025, repaid exactly 3.5 ETH an hour after the attack
• 13.72 ETH still on 0x78C9…f5B3

https://t.co/zAb4trzuhl

[PublicAML @PublicAML]

Autheo $THEO exploit on Base, read on chain:

• Two unbacked mints, not one: 19M THEO at 17:06 UTC, then 100M more at 17:45
• Sales produced 291.7 ETH (~$730k), not 700.8 ETH: ~400 ETH was already on the wallet a week before the attack
• 93.5M unsold THEO sent to an older wallet topped up from Binance and MEXC
• 686 ETH still sits on 0x3048b4…E0AD

https://t.co/Tf9dSDC4lW

[PublicAML @PublicAML]

We asked ChatGPT in Russian where to get a free AML check for a USDT wallet.

Its second recommendation was amlsecurity[.]financial, a site that serves a wallet-drainer script. We documented it on 8 Oct; it is still online today.

A real AML check never asks you to connect a wallet.
https://t.co/NAPaEXODqQ

[PublicAML @PublicAML]

@Bitquery_io Built on your mapping: after your 07:00 UTC snapshot the thief ran two more Tornado waves (900 ETH, then 440 ETH) and moved all 2.1M USDC to one service address, the last half this morning. ~15,075 ETH and 203.8 BTC still unmoved. Credited you on our page: https://t.co/k7rVEutwSi

[PublicAML @PublicAML]

@YFarmX @Ledger @circle Update on the USDC: the last 1.06M left 0xe2fc35e8 this morning, 07:15 UTC, through a fresh wallet into 0x08eC0883…31a7, the same busy service address that took the first half yesterday. That service is now the place to ask. ~15,075 ETH and 203.8 BTC are still unmoved.

[PublicAML @PublicAML]

@Ledger_Support On-chain status for affected users: the thief still holds ~15,075 ETH and 203.8 BTC on named wallets. All 2.1M USDC is gone: the last 1.06M left this morning to the same service address as the first half. 1,340 ETH went into Tornado on 10 Oct. Addresses: https://t.co/k7rVEutwSi

[PublicAML @PublicAML]

@DefiantNews @Ledger It didn't stop at 464. On 10 Oct the CryptoBilis thief put 1,340 ETH into Tornado in two more waves, through eight and then four fresh wallets. ~15,075 ETH still sits on named addresses. Timeline: https://t.co/k7rVEutwSi

[PublicAML @PublicAML]

@girl42671345 The XRP leg, read to the swap: 103M XRP went through 60 fresh accounts into THORChain in 1,132 swaps. The memos name the bitcoin payout: 28 addresses that received 1,924.8 BTC in total. All 28 are empty now. Details: https://t.co/VUUBQ1Mvno

[PublicAML @PublicAML]

Where the stolen crypto still sits, re-read 10 Oct:

• 15,957 BTC next to Chen Zhi's sanctioned addresses
• 1,038.85 BTC Coldcard, 598.5 BTC Liquid
• 3,191 ETH across Aztec, Duelbits, Neutron, Nostra, Limit Break

Moved: NuNet attacker sent 432.5 ETH into Chainflip and THORChain on 8–10 Oct. Payy's 90,202 USDC is still not frozen.
https://t.co/ZXjGjK9UOn

[PublicAML @PublicAML]

Bitget hack, the XRP leg read to the swap:

103M XRP → 5 wallets → 60 fresh accounts → 73.4M XRP into THORChain in 1,132 swaps. Every memo names the bitcoin address: 28 of them.

Those 28 addresses received 1,924.8 BTC in total — all empty now. We labelled all 28.
https://t.co/wsTQdXOX3k