TraceHound

I sniff out dev wallets, insider clusters and hidden flows

[TraceHound @tracehoundpro]

introducing the tracehound wanted board.

got scammed? post it. put a reward on it.

> drop the scammer's addresses
> say what you lost
> offer a reward for information
> anyone who knows something sends you a tip. only you see it
> every address on the board is one click from a full trace

rugged, drained, phished, hacked. 9 chains.

no names, no doxxing. addresses, transactions and what happened.
the reward is between you and whoever helps. we hold no money and take no cut.

and if someone asks you to pay upfront to "recover" your funds, that's a scam too.

the chain never forgets. now neither do we.

[TraceHound @tracehoundpro]

TRACEHOUND IS OPEN SOURCE.

the tool behind every hack we've traced is public:
https://t.co/bEpVLX0LwF

what's inside:
> the tracer: one address or exploit tx in, the whole money trail out
> ethereum, solana, tron, bitcoin + bridges and thorchain crossings
> funding trails: who paid the hacker's gas
> token check: dev history, bundles, snipers, sold %
> pump ring detection across early buyers

every finding links to a transaction you can open yourself.
no black box. no "trust us, it's lazarus".

run it locally with your own keys, or paste an address on tracehoundpro

we chase hackers for a living. hiding our code would be a weird look.

something's coming for the people who use it. today. 👀

[TraceHound @tracehoundpro]

https://t.co/GiNPlRNj5H

[TraceHound @tracehoundpro]

THE COINDCX HACKER SENT 1,039,700 USDT TO A GATE DEPOSIT ADDRESS. 3 HOURS 40 MINUTES BEFORE THE CEO CALLED IT A "FALSE ALARM".

that deposit address is the one place this money could still be frozen.
most victims never find it. the ones who do don't know what to send.

so we built the letter.

new on tracehound: freeze request kit

> open any case, hit the Freeze tab
> every exchange deposit the stolen money reached, freshest first
> a ready request for that exchange's compliance team
> every tx hash, exact amounts to the cent, times in UTC
> the path from the thief's wallet, hop by hop
> copy it, or save it as .md, CSV, PDF
> your name, police report and wallet stay in your browser. we never see them

the coindcx case:
42 wallets traced in 226 seconds
$14.13M followed out of the attacker's wallets
1 gate deposit address. 1,039,700 USDT. 3 transactions. one letter.

hackers don't fear chain analysis.
they fear the exchange desk that reads it.

free. on every case.

got drained? paste the address. the letter writes itself.

[TraceHound @tracehoundpro]

@leanxbt TraceHound Community in Telegram:
https://t.co/GiNPlRNQVf

[TraceHound @tracehoundpro]

@hochulambo TraceHound Community in Telegram:
https://t.co/GiNPlRNQVf

[TraceHound @tracehoundpro]

@agentslopzone TraceHound Community in Telegram:
https://t.co/GiNPlRNj5H

[TraceHound @tracehoundpro]

it's not climbing, that one's on us. we said 41 first, recounted, it was always 47 in the 51s window. 48 victim wallets on-chain total, Bloom says 49.

and yeah, that's the scary part. a bot that signs for you is only as safe as everything it runs.

honestly I don't think most people leave. speed is the whole point of a bot, and memory is short. what I'd expect:
• bot wallets get treated as hot, only today's trading size in them
• profits swept to a wallet you made yourself, daily
• people start asking bots what's in the stack and how signing is isolated

the ones who move fully off will be the bigger wallets. 1,636 SOL in a bot is a lesson you only need once

[TraceHound @tracehoundpro]

HE STOLE $947,000 IN 51 SECONDS.
4 MINUTES AFTER HIS WALLET WENT PUBLIC, HE MOVED EVERYTHING.
THEN HE FROZE. AND NOW OTHER SCAMMERS ARE HUNTING HIM.

this is the Bloom drain, rebuilt from 73 on-chain transactions. timestamps are UTC, and every one of them is public.

> CHAPTER 1: THE KNOCK (00:59)
first move: 1 lamport out of the biggest victim wallet. that's $0.0000001.
he isn't stealing yet. he's checking whether the door is open.

> CHAPTER 2: THE ROLL CALL (01:02)
ten more wallets each send 0.001 SOL to the same address, about one every 2 seconds.
a person doesn't do that. a script is checking which wallets it controls.

> CHAPTER 3: THE 51 SECONDS (01:03:50 → 01:04:41)
41 wallets emptied in 51 seconds.
1,636 SOL, then 1,039, then 1,021, then 765.
every drain was signed by the victim's own wallet, which paid its own fee.
no brute force. no phishing link. the wallets simply said yes.

> CHAPTER 4: HE CAME BACK FOR MORE (01:28)
24 minutes later he sends 0.02 SOL back into one drained wallet.
why give money back? that wallet still held ~$49k in USDC, and it had no SOL left to pay fees.
he tests it with 0.000001 USDC transfers.
the $49k never reaches him.

> CHAPTER 5: SPOTTED (04:26 → 04:30)
04:26:10: Onchain Lens posts his address.
04:30:56: all 9,408.21 SOL leaves in one transaction to a brand-new wallet.
4 minutes 46 seconds. he was watching X too.

> CHAPTER 6: THE FREEZE
since then that wallet hasn't moved. no bridge, no swap, no exchange.
almost $1M, parked in plain sight for 10 hours and counting.

> CHAPTER 7: THE SCAVENGERS
this is the part nobody's talking about.
lookalike wallets start showing up, copying the first and last characters of real addresses, and they send dust to the drainer so a fake shows up in his history.
then they go after the hacker's new wallet with copies of his own address, hoping he pastes the wrong one when he cashes out.
scammers trying to scam the scammer.

> BLOOM'S SIDE
Bloom: a third-party module had a remote code execution bug. no private keys leaked. 9 users, 49 wallets, 100% refund.
on-chain: every drain was signed by the victims' own wallets.
both can be true. if you can run code on the machine that signs, you never need the key. you just ask it to sign.
by 12:41 Bloom was publicly offering to negotiate.

so let's recap:
• 1 lamport to knock
• 10 test transfers
• 41 wallets in 51 seconds
• 4m46s from exposure to exit
• 10+ hours frozen
• a crowd of scammers waiting for him to make one copy-paste mistake

he doesn't have to outsmart anyone. he just has to outwait you.
we don't get bored. we're watching 6nYy…moe9.

[TraceHound @tracehoundpro]

TraceHound community in Telegram:
https://t.co/GiNPlRNQVf

[TraceHound @tracehoundpro]

47 actually, we recounted lol

and no sketchy approval: on Solana you can't "approve" native SOL. every drain is a plain transfer, signed by each wallet's own key.

so it's either the keys or whatever signs with them. Bloom says RCE in a third-party module, no keys accessed. both fit: run code where the bot signs and you never need the key, it just says yes.

that 1 lamport knock actually failed btw. the signature still worked, and that's all he was checking

[TraceHound @tracehoundpro]

@h100envy ty, big luv

[TraceHound @tracehoundpro]

SCAMMERS CAN NOW BE WATCHED. EVERY WALLET ON OUR WANTED BOARD IS CHECKED EVERY 6 HOURS. THE MOMENT THE MONEY MOVES, YOU SEE WHERE IT WENT.

here's the problem every victim knows.

you post the scammer's address. people retweet it. a week later everyone forgot.
and the scammer just waits. then moves the money when nobody is looking.

not anymore.

> you post the scam on the wanted board: the addresses, what you lost, a reward
> tracehound checks those wallets every 6 hours
> money leaves the wallet -> it shows up on the board
> where it landed: a fresh wallet, a bridge, a mixer, or an exchange
> if the next wallet forwards to an exchange, we flag it as that exchange's deposit address
> you get a telegram message
> every move links to its transaction

why the exchange part matters:

an exchange deposit is the one place stolen money can still be frozen.
but only if someone asks fast. with the tx, the address, the amount and the time.

that's what this gives you.

we ran it on the bybit hacker's wallets.
4 addresses. 57 moves. every one on chain, every one with its tx.
the video is that.

the scammer stopped being anonymous the moment they touched the chain.
now they can't move quietly either.

got scammed? put it on the wanted board.

[TraceHound @tracehoundpro]

Thanks for flagging this. It's a false positive from Safari's fraud filter: Google Safe Browsing shows https://t.co/CU4YI3vZEb as clean. The site never asks you to connect a wallet, sign anything or enter keys or card details; it only reads public blockchain data. We've asked for a review. Could you tap "Afficher les détails" and send me a screenshot? It shows who flagged it and the exact link.

[TraceHound @tracehoundpro]

TRACEHOUND ROADMAP: WE'RE HIRING ON-CHAIN ANALYSTS AND BUILDING 14 NEW WAYS TO HUNT SCAMMERS

our DMs are full.

hacked wallets. drained savings. rug pulls. fake exchanges. "investment managers" who vanished.
every message ends the same way: "can you find them?"

we read every one of them.
and we can't answer them fast enough.
so we're hiring.

> ON-CHAIN ANALYSTS WANTED
tools find the trail. people close the case.

we're building a team that takes every request from our DMs and the wanted board and traces it end to end:
- every request read by a human, not a bot
- hop by hop: swaps, splits, bridges, all the way to the exchange, the tx and the deposit address
- a report the victim can actually hand to the exchange and the police
- public case files when the victim agrees

trace wallets for fun or for work? DM us. show us a trail you followed.

> ALREADY LIVE
- hack trace on 9 chains: ethereum, base, arbitrum, bsc, polygon, optimism, solana, tron, bitcoin
- crosses bridges: thorchain, cctp, across, wormhole, stargate, debridge, mayan
- exchange deposits found and labeled
- token check, rug radar, wanted board, exit liquidity score, telegram bot, public API

> NEXT. FROM THE COOLEST DOWN
02 "scammer moved": wanted wallets under watch. the second the money moves, we post it
03 check before you send: paste an address before sending. tied to a scam? you know first
04 freeze request kit: tx, deposit address, amounts, times. one click, formatted for exchange compliance
05 case desk: submit a case, track it like a parcel. received -> tracing -> exchange found -> report ready
06 operator files: different scams, different chains, same person. one file per operator
07 was I drained?: which drainer, which approval, what to revoke right now
08 address poisoning alarm: looks like your contact. isn't. flagged before you copy it

> LATER
09 hunter leaderboard: tips that found the exchange, ranked in public
10 drainer & phishing database, open to everyone
11 scams of the week: fresh scams, traced and explained
12 AI case report: the whole trace told as a story
13 new chains: TON, hyperliquid, sui, XRP
14 telegram mini app
15 sharper verdicts: every red flag with its real hit rate

> THE GOAL
right now a victim hears "sorry, crypto is untraceable."
it isn't. it never was.

every scam should end with a file:
the trail. the exit. the name.

got scammed? DM us or post it on the wanted board.
want to hunt with us? DM us too.

the blockchain never forgets.

[TraceHound @tracehoundpro]

@h100envy @zostaff @crawlhivexyz hmm, something cool is going to happen soon...

[TraceHound @tracehoundpro]

@Lurk_Moar_Sperg thanks!

[TraceHound @tracehoundpro]

introducing the tracehound wanted board.

got scammed? post it. put a reward on it.

> drop the scammer's addresses
> say what you lost
> offer a reward for information
> anyone who knows something sends you a tip. only you see it
> every address on the board is one click from a full trace

rugged, drained, phished, hacked. 9 chains.

no names, no doxxing. addresses, transactions and what happened.
the reward is between you and whoever helps. we hold no money and take no cut.

and if someone asks you to pay upfront to "recover" your funds, that's a scam too.

the chain never forgets. now neither do we.

[TraceHound @tracehoundpro]

@brightball thanks!

[TraceHound @tracehoundpro]

TRACEHOUND ROADMAP: WE'RE HIRING ON-CHAIN ANALYSTS AND BUILDING 14 NEW WAYS TO HUNT SCAMMERS

our DMs are full.

hacked wallets. drained savings. rug pulls. fake exchanges. "investment managers" who vanished.
every message ends the same way: "can you find them?"

we read every one of them.
and we can't answer them fast enough.
so we're hiring.

> ON-CHAIN ANALYSTS WANTED
tools find the trail. people close the case.

we're building a team that takes every request from our DMs and the wanted board and traces it end to end:
- every request read by a human, not a bot
- hop by hop: swaps, splits, bridges, all the way to the exchange, the tx and the deposit address
- a report the victim can actually hand to the exchange and the police
- public case files when the victim agrees

trace wallets for fun or for work? DM us. show us a trail you followed.

> ALREADY LIVE
- hack trace on 9 chains: ethereum, base, arbitrum, bsc, polygon, optimism, solana, tron, bitcoin
- crosses bridges: thorchain, cctp, across, wormhole, stargate, debridge, mayan
- exchange deposits found and labeled
- token check, rug radar, wanted board, exit liquidity score, telegram bot, public API

> NEXT. FROM THE COOLEST DOWN
02 "scammer moved": wanted wallets under watch. the second the money moves, we post it
03 check before you send: paste an address before sending. tied to a scam? you know first
04 freeze request kit: tx, deposit address, amounts, times. one click, formatted for exchange compliance
05 case desk: submit a case, track it like a parcel. received -> tracing -> exchange found -> report ready
06 operator files: different scams, different chains, same person. one file per operator
07 was I drained?: which drainer, which approval, what to revoke right now
08 address poisoning alarm: looks like your contact. isn't. flagged before you copy it

> LATER
09 hunter leaderboard: tips that found the exchange, ranked in public
10 drainer & phishing database, open to everyone
11 scams of the week: fresh scams, traced and explained
12 AI case report: the whole trace told as a story
13 new chains: TON, hyperliquid, sui, XRP
14 telegram mini app
15 sharper verdicts: every red flag with its real hit rate

> THE GOAL
right now a victim hears "sorry, crypto is untraceable."
it isn't. it never was.

every scam should end with a file:
the trail. the exit. the name.

got scammed? DM us or post it on the wanted board.
want to hunt with us? DM us too.

the blockchain never forgets.

[TraceHound @tracehoundpro]

@keepontruckin78 @zostaff money mule recruitment. their stolen money, your name on the account. if you have their wallet addresses, post them on the wanted board

[TraceHound @tracehoundpro]

RADIANT CAPITAL LOST ~$50M TO NORTH KOREA. THE LAUNDERING WAS COMPETENT. IT STILL FAILED, FOR A REASON MOST PEOPLE MISS.

laundering doesn't destroy information. it can't. every swap, bridge and split is a public state change. all laundering can do is add noise and hope nobody separates it from the signal.

which creates a brutal asymmetry:
the launderer has to break every path between the theft and the cash-out.
the tracer only needs one path to survive.

I ran the Radiant exploiter through tracehound to see which paths survived.
2 chains. 33 wallets. 89 flows. 11 findings. 169 seconds.

the tricks weren't the problem. the habits were

> 1. THE SWAP THAT POINTS TO ITS OWN EXIT
the exploiter routed swaps through aggregators and had the output paid to a fresh wallet instead of back to itself. on an explorer, the funds appear to vanish into a contract.

but a swap is a single atomic transaction. input and recipient live in the same tx. you can't swap into a stranger without writing the stranger's address on-chain.

CCTP burns on the source chain and mints on the destination. the two events are cryptographically paired, by design. Across works the same way: every deposit carries an index that resolves to its fill.

bridges are built to be verifiable, because users need to prove their funds arrived. that same property makes them traceable. you can't have one without the other.

> 3. THE MISTAKE THAT ACTUALLY MATTERED: ONE KEY, TWO CHAINS
here's the part most people miss. an EVM address is derived from a private key, and that key works on every EVM chain. same key, same address, everywhere.

so when the same addresses show up on arbitrum AND ethereum, that's not a coincidence. that's the same key holder:
- 0x3904…7ebc received swap outputs on both chains
- 0x5703…dba6 received direct transfers on both chains, plus all three bridge exits
- 0x97a0…e4e8 and 0x8b75…0887 got 12.13k ETH each on arbitrum, and are labeled Radiant Capital Exploiter 2 and 3 on ethereum

hopping chains doesn't give you a new identity if you bring your keys with you.

> 4. SYMMETRY IS A SIGNATURE
on ethereum, exploiter wallets 2, 3 and 4 each received exactly 707.05 ETH.
on arbitrum, two of the same wallets each received exactly 12.13k ETH.
humans don't split money into identical parts across multiple chains. scripts do. and scripts are reproducible, which is the opposite of what you want when hiding.

> 5. SILENCE IS DATA TOO, WEAKLY
across 79 transactions, the main wallet never moved between 09:00 and 17:00 UTC.
that's a hint, not evidence. tracehound marks it low confidence, and so should you. the honest way to trace is to separate what the chain proves from what it suggests.

> THE GENERAL PRINCIPLE
every obfuscation technique attacks one type of link:
- swaps attack the token link
- bridges attack the chain link
- fresh wallets attack the address link
- time delays attack the timing link

but attribution doesn't rest on one link type. it rests on redundancy. cut the token link and the address link remains. change addresses and the amounts still rhyme. jump chains and the key comes with you.

to disappear, you have to break all of them, on every hop, every time. Radiant's launderers broke some of them, on some hops, some of the time.

and the trail is still live: the funds on these addresses were still moving in 2026.

that's what tracehound is built for. not the hop you can see on an explorer, but the links between hops that survive every trick.

which hack should I break down next?