Feed

NEW: The US Treasury sanctioned eight Canadian OTCs on Friday (Nov 6), including Nia Nations (NNCE) & Million Exchange (MillionEX), five months after I replied to them on X suggesting they sanction the Iranian OTC brokers in Canada being abused by illicit actors.

As I've stated before, Canada is a bottom-three jurisdiction globally with rampant abuse due to ineffective laws.

Update 2: Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets.

The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity.

Update: I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident.

A portion of the CEX withdrawals occurred after my initial disclosure.

My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up.

No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement.

Theft addresses:
0x5cf70edce65847ef989933c3072fb0e7f335abc1
0xe378cdccb369a64a0190577787ef61ca2eefa6b2
0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2
0x99d314e6970b8d3db0dbe6f6e041cc904143400f

Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor.

Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.

While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.

Theft addresses:
0xADd95cD98E0288ba69785E3151E1db86adF8Dd58
0x29e9D7715D935e0D0D4B0DD0efC952A97E551020
0x378B4f150707C283574DC89739608D29036D57d5
0x795a9d22F233024487161Fe6daFf73397c162621
0x730Bcb1296758c377149d7409f98f041cf723992
0x12D9012731eb0D54871A31Af5566Eb9ECCa351Db
0x5A154f77852ed274Fd6F4c324a1Ee27809052FF7
0xA1096A66f9ed58A9594A6A1ad67A5472C0907224
0x90F0b6D51ed2FE2348A45b2C49BC441E959bc557
0x8A97BC406180e28b11C5495fA099BF5119c6C6B0
0xd010cba790a6ab0048da18f2fbe8e3faf463a16a

BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.

Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5

Trsanction hash: 0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb6
0x410af166c81f9c0f26cc19b4d970c984f526225eeea2aea169179856fd615f70

Community Alert: Axis Robotics (AXIS) insiders received 76M+ AXIS ($12M+) from a Axis Team multisig and began market selling via DEX and transferring AXIS to Bitget causing the price to crash 40% over the past 24 hours.

The AXIS token went live on October 21, 2026.

A single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base:
0xcc279c2499bcf4bd0f169c2d3f333243473242f7
0x66612012c5ad9b2fed81d09a9ab429b5285b2c62
0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0
0x99cd3975c90b79ffdbe16425de033a605b814c49
0xbbed67fec9c7793218fa60c40fb9e6b059d86483
0xe69d8d6b9b7f9056eda455b76384e9748749f4d1
0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d

An institutional entity lost ~$2.3M (973K MORPHO) a few hours ago from two addresses and the funds were deposited to Tornado Cash:
0x4943b0c9959dcf58871a799dfb71bece0d97c9f4
0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4

On Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges stolen, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool:
0x24a9e00be5f169142c4f0797b41dacdf807d3e63

Both thefts from 0x4943 & 0x10bf involve EIP-7702 delegation transactions.

0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which reportedly lost eight figures due to a private key compromise in Sep 2023, after which the family office allegedly exited crypto.

An institutional entity is suspected to have lost ~$2.84M to DPRK-linked SquidSquad on October 8, 2026 on BSC.

Yesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses.

Tornado withdrawal addresses:
0xb8b25f535a6e51d0b18c48941d791c7e83559d2b
0x35c72e26f6888b4cba8668c6cfa4143599680bfe
0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848

From there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at:
TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU
TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux

Both consolidation addresses have exposure to previously attributed DPRK addresses.

Within minutes, the funds moved through intermediary addresses to Chinese OTCs, likely to evade any potential Tether freeze.

Victim address:
0x579be84d2a0f7bcfc34b4b3883153adec84ff153
Theft address:
0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80

A new centralized laundering service FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026. More than 87% of its inflow volume is tied directly to illicit activity.

A manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents, including:
• DCENT Wallet exploit (Sep 2026)
• Fetch[.]ai exploit (Sep 2026)
• Axelar exploit (Sep 2026)
• Unnamed ransomware payment (Sep 2026)
• Gamdom exploit (Oct 2026)

The admin sources XMR liquidity from KuCoin, with 3K+ deposits to KuCoin, and likely uses a swap model similar to Wagyu's.

The FXMR ticker was bought in an HL auction on July 27, 2026 for 518.28 HYPE ($28K).

HL Core has seen several centralized laundering services, such as b1exch, abuse the chain’s permissionless design and adoption.

A spreadsheet with source data has been shared with the HL team.

FXMR hot wallet
0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2
FXMR admin
0x1b7fb7709b146d74aad0b2b853bc741d8885bdb2
0x06ecb2a427c3d51a66c29d9b4fb1960107d10b19
0xecbb61b2aabd32da2082acd989218b0911b79406

Update: A few hours ago UAE law enforcement published a press release confirming legal action against multiple cybercriminals with $54M+ seized and 33 arrests.

Social engineering threat actors such as Danish Zulfiqar (Danny), Ibrahim Mustafa (Krust), & Cameron Cureton (CX) were all featured in the video posted.