TraceFast

Trace-level Ethereum & EVM forensics for security auditors, MEV researchers & on-chain investigators. Deep execution traces, evidence-based address labeling.

[TraceFast @tracefast_xyz]

0/ The $17.7K drain everyone is quoting is the small one.

81 blocks later the same bug paid out again — 12 more LP positions, a second victim contract nobody has named yet, and neither is in the forked replay.

Here's what the indexed chain shows 🧵

1/
Great teardown — an opcode replay is the right tool for the mechanism. One thing a forked snapshot of a single tx can't show is what happened next. On the indexed chain this wasn't one transaction, and Unistreets wasn't the only victim.
https://t.co/pYwQg7krll
2/
The factory held 15 v4 LP positions, not 7. Tx #1 burned 7. Then 81 blocks later (~16 min) a different EOA — 0xfc3facd6…e92f — ran the same play: the remaining 8, plus 4 from a second custodian, 0xd5799fd8…7ad8.
19 positions, 2 victims, 2 wallets.
https://t.co/bBzCnPVju2
3/
Same mechanism, confirmed frame by frame: 2× multicall → 2× self-delegatecall carrying setApprovalForAll → 12× modifyLiquidities. That second tx doubled the payload — one grant per custodian, in one shot.
https://t.co/DN3XGsFMDh

4/
Exact flows, no rounding. Tx #1 paid out 17,743.907229 USDC in two legs (17,685.8181 + 58.089129) and 0.007209570881911319 WETH. The decoy launch even has a ticker: CPOC — minted to the factory, forwarded to the EOA alongside seven other people's tokens.
https://t.co/xgpUxJBYoz
5/
Custody window: the factory's first LP position arrived at block 25,668,757, its last at 25,690,730. The honeypot took ~3.3 days to fill and 16 minutes to empty. Both custodians hold zero positions today.
https://t.co/XMiaZipb5g
6/
Your checklist item #1 — "does one contract custody assets for many users?" — is a query when the whole chain is indexed, not a manual review. Across all 366,992 Uniswap v4 positions ever minted, the largest single custodian holds 65,666; the next 13,182; then 1,607. Custody isn't vulnerability — but that's the shortlist you audit first.
7/
Different tools, same goal. You replay one tx down to the opcode; we keep every tx with its call tree, storage effects and token flows. Yours answers "how exactly"; ours answers "who else, and what happened afterwards". No ZIP, no fork state — the links above are live.

[TraceFast @tracefast_xyz]

0/ 🚨 Everyone reposted the wrong half of this hack.

The famous tx took 7 LP positions. The one nobody indexed took 12 — 16 minutes later, a different wallet, two different custodians, same confused deputy.

Full chain-level teardown, every claim deep-linked and live 🧵👇

1/
Great teardown — an opcode replay is the right tool for the mechanism. One thing a forked snapshot of a single tx can't show is what happened next. On the indexed chain this wasn't one transaction, and Unistreets wasn't the only victim.
https://t.co/pYwQg7krll
2/
The factory held 15 v4 LP positions, not 7. Tx #1 burned 7. Then 81 blocks later (~16 min) a different EOA — 0xfc3facd6…e92f — ran the same play: the remaining 8, plus 4 from a second custodian, 0xd5799fd8…7ad8.
19 positions, 2 victims, 2 wallets.
https://t.co/bBzCnPVju2
3/
Same mechanism, confirmed frame by frame: 2× multicall → 2× self-delegatecall carrying setApprovalForAll → 12× modifyLiquidities. That second tx doubled the payload — one grant per custodian, in one shot.
https://t.co/DN3XGsFMDh
4/ Exact flows, no rounding. Tx #1 paid out 17,743.907229 USDC in two legs (17,685.8181 + 58.089129) and 0.007209570881911319 WETH. The decoy launch even has a ticker: CPOC — minted to the factory, forwarded to the EOA alongside seven other people's tokens. https://t.co/xgpUxJBYoz
5/ Custody window: the factory's first LP position arrived at block 25,668,757, its last at 25,690,730. The honeypot took ~3.3 days to fill and 16 minutes to empty. Both custodians hold zero positions today. https://t.co/XMiaZipb5g
6/ Your checklist item #1 — "does one contract custody assets for many users?" — is a query when the whole chain is indexed, not a manual review. Across all 366,992 Uniswap v4 positions ever minted, the largest single custodian holds 65,666; the next 13,182; then 1,607. Custody isn't vulnerability — but that's the shortlist you audit first.
7/ Different tools, same goal. You replay one tx down to the opcode; we keep every tx with its call tree, storage effects and token flows. Yours answers "how exactly"; ours answers "who else, and what happened afterwards". No ZIP, no fork state — the links above are live.

[TraceFast @tracefast_xyz]

Even the pros get hit. While the KelpDAO thief laundered $292M, poisoning bots sprayed their wallet too — with a fake "Тoken" .
On a public ledger, everyone's a target.
Full breakdown + reproduce it yourself 👇
https://t.co/AgrovM1nkn

[TraceFast @tracefast_xyz]

An ERC-20 "Transfer" event isn't proof that money moved. It's a log line the contract chose to write — and a malicious contract can put YOUR address in the "from" field.
That's address poisoning. We took apart a fresh one on-chain 🧵

[TraceFast @tracefast_xyz]

Want the scale? One fake "USD Coin" contract in this campaign lists 542 "holders" — top balance 126,000,000 USDC.
None of it is real. The token is a counterfeit; those balances aren't wealth, they're a map of every address it has spammed.

[TraceFast @tracefast_xyz]

One figure we deliberately didn't reclaim: the ~75,700 ETH consolidation @RektHQ reported within 27 min. We couldn't fully rebuild it from mainnet receipts, so we defer to their trace — and say so in the piece.
Full breakdown: https://t.co/o2srgk8d2R

[TraceFast @tracefast_xyz]

1/
Our KelpDAO $292M trace owes a lot to @chainalysis, @RektHQ and @QuillAudits — they mapped it fast while it was live.
We rebuilt it from on-chain receipts to push the record further, and found a few refinements 🧵
https://t.co/o2srgk8d2R

[TraceFast @tracefast_xyz]

4/
And a twist none of the write-ups caught: while the thief was laundering, someone tried to rob them — address-poisoning the wallet with a fake "Тoken" (that's a Cyrillic Т, U+0422) mirroring the exact payout amounts.
Even Lazarus gets poisoned.

[TraceFast @tracefast_xyz]

@arkham Every hash, address and figure in the post is verifiable — all links open the raw on-chain data, so you can walk the same path yourself. Read the full anatomy: https://t.co/K7jrfVUevw

[TraceFast @tracefast_xyz]

4/ Every hash, address and figure in the post is verifiable — all links open the raw on-chain data, so you can walk the same path yourself.
Read the full anatomy: https://t.co/K7jrfVUevw

[TraceFast @tracefast_xyz]

1/ Even the Ethereum Foundation gets sandwiched.
Block 18,311,676: EF sells 1,700 ETH → an MEV bot wraps the trade at positions 0 and 2 and extracts $9,100.
We rebuilt the whole attack tx-by-tx. What we found 🧵

[TraceFast @tracefast_xyz]

3/ The wildest number: the bot's gross profit was 5.6159 WETH — and 3.0944 ETH of it (exactly 55.1%) went straight to the block builder.
The real auction for blockspace isn't in gas prices anymore. It's in coinbase transfers.