So far, we have identified the following addresses associated with the @bitget exploiter that still hold funds. We will continue to update this list. @GracyBitget @xiejiayinBitget @Bitget_zh

🚨 SlowMist TI Alert: FomoPeek App v1.1–1.2 Asset Theft 🚨 We have recently received multiple reports of users having assets stolen. Our investigation found that the affected cases involved private key exposure, and some of the users had previously installed and used @FomoPeek App versions 1.1–1.2. A joint investigation by the @SlowMist_Team and @okx security teams confirmed that the app contains malicious code.⚠️ Besides its normal features, FomoPeek includes two modules that are unrelated to its stated business functions. One of them contains an #iOS# kernel exploitation framework with eight different exploit methods. The framework can automatically choose an attack method based on the device model and iOS version. ‼️Affected iOS versions: iOS 12.0–18.7 and iOS 26.0–26.1.‼️ If the exploit succeeds, the app may escape the iOS sandbox, access and decrypt Keychain data, and read files belonging to other apps on the device. 🔐 This means sensitive data stored on the device, including private keys, seed phrases, login credentials, chat history, and files, may be exposed. The app also connects to hidden servers that are unrelated to its public-facing services and can receive remote commands. Based on plaintext traffic captured during our analysis, the attack functionality is currently enabled and runs automatically at regular intervals. In general, devices running older iOS versions are at higher risk. If you have installed or used FomoPeek versions 1.1–1.2, we recommend that you take action immediately: 1️⃣ Check your accounts and assets for any unusual activity. 2️⃣ On a trusted device where FomoPeek has never been installed, create a new account and generate a new private key and seed phrase. 3️⃣ Move your assets to the new account as soon as possible. 4️⃣ Update your device to the latest available iOS version. 5️⃣ Do not continue using or reinstalling FomoPeek. 6️⃣ If you notice any suspicious asset activity, contact the official support team of the relevant platform and keep the affected device and related evidence for further investigation.

🚨 MistTrack Fund Tracking 🚨 Following the @likwid_fi incident reported by @SlowMist_Team, we tracked the on-chain movement of the stolen funds. 💸 Loss: 74.31 $BNB 📌 Attacker: 0x90bde1e0bb16b3deeb9d638acf8d01f19fd2f31e 🧭 Fund Flow: Attacker → Tornado Cash 🧩 Key Findings: • Multiple withdrawals by the attacker were traced to Tornado Cash, which also provided the initial funding. • 31.8 $BNB was transferred to the attacker from FixedFloat. 🔎 MistTrack has added the related addresses to its malicious address library.

🚀 MistTrack is now live on @WorkBuddy_AI ！ You can now ask WorkBuddy to run on-chain risk checks with MistTrack — risk scores, entity labels, transaction tracing, and counterparty analysis. Just bring your own MistTrack API Key.✨ Find the MistTrack expert in WorkBuddy and start tracing.

On Sept 9, OFAC and DOJ took joint action against Xinbi Guarantee and its supporting service network, restricting more than $52 million in crypto assets. Xinbi Guarantee is a Chinese-language online escrow marketplace connecting scam groups with merchants offering money laundering, scam-site development, and other illicit services. OFAC designated Xinbi Guarantee as a significant Transnational Criminal Organization (TCO), and also sanctioned supporting firms SafeW Technology and Anwen Technology. DOJ seized related Telegram channels and wallets, including ~$12M from 2 collection wallets. Treasury said the marketplace has processed over $24B in digital assets and fiat since around 2022. The case highlights the importance of tracking illicit fund flows across service networks. SlowMist @MistTrack_io will continue updating related risk labels to support on-chain monitoring and illicit fund analysis. Read more 👇

THE BLOCK: Tether earlier today froze about $39.3 million in USDT across 10 Tron addresses linked to Xinbi Guarantee, a source with direct knowledge of the matter told The Block. Xinbi is a Chinese-language guarantee marketplace that emerged on Telegram around 2022. TRM Labs has described it as one of Southeast Asia's largest illicit crypto marketplaces, saying it has processed about $24.2 billion in transactions. MistTrack, an onchain tracing platform developed by SlowMist, first reported the USDT freeze.

Hours ago, Tether froze approximately 39,273,713 USDT across 10 TRON addresses linked to Xinbi Guarantee新币担保. Following its freeze of 汇旺担保Huione-linked funds, this appears to mark another crackdown on illicit Telegram-based escrow platforms.

3/🔷 SlowMist KYT Partner Program SlowMist CPO & Partner Keywolf shared insights into on-chain compliance practices and officially introduced the MistTrack Partner Program @MistTrack_io, connecting with more ecosystem partners and bringing on-chain risk control capabilities to a broader range of payment and business scenarios. Chris (@chriseyin), Jerry Li (@JerryLJ2), Lucy (@LucyLLucky), and other guests also joined the Open Mic session, sharing firsthand experiences and industry perspectives. 🙏 A big thank you to our co-host ME Group @MetaEraCN, all our speakers and partners, and everyone who joined us in Hong Kong. See you next time in Hong Kong! 🇭🇰

🔍 OneKey’s “Incoming Transaction Risk Monitoring” feature is powered by the MistTrack API. Once an incoming transaction is confirmed on-chain, @OneKeyCN can screen the source of funds for potential risks, including sanctions, mixers, scams, stolen funds, and more. MistTrack currently serves 500+ institutional clients worldwide, providing crypto risk intelligence and AML/KYT solutions to help businesses identify and manage on-chain risks. Glad to see MistTrack’s #KYT# capabilities helping bring safer on-chain transaction monitoring to more users. 🛡️ 👉

🚨 MistTrack Alert 🚨 An address linked to Wave 4 of the Coldcard incident has mixed 64.90373764 $BTC via Wasabi Wallet. ⏰ Time: 2026-08-05 04:42:48 UTC 📤 Fund path: bc1q0rvn88w08j75k4h48lf9fvhan7unjp7vjf5q6m → bc1pynd6vswmxkghw6k5463xwcj7el7u4tpl2t2pnh0s8llmc2wgzfqsdu7h92 (Wasabi Wallet) 🔗 Transaction: We are continuously monitoring the activity.

MistTrack is committed to helping virtual asset businesses strengthen their on-chain risk identification and analysis capabilities, translating the risk assessment and risk mitigation requirements emphasized in FATF Recommendation 15 (R.15) into more practical and actionable on-chain analytical capabilities.

Every stolen asset leaves an on-chain trail—but reconstructing that trail across multiple wallets, blockchains, bridges, and mixers isn't easy. That's why we built TrackAgent — an AI-powered On-Chain Intelligence Agent purpose-built to trace stolen crypto assets. It is now integrated into our Free Stolen Asset Assessment Service.🚀 Instead of simply retrieving blockchain data, TrackAgent continuously traces stolen funds, reconstructs complex fund flows, correlates attacker addresses, and combines on-chain intelligence with security threat intelligence to support real-world investigations. 🔍 Key capabilities: 🌐 Supports 31 blockchains 🌉 Cross-chain & laundering path analysis 🔗 Multi-address correlation 🛡️ Threat intelligence-powered investigation 📊 Over 12,000+ stolen asset cases have been submitted to SlowMist over the past four years. By bringing AI into our investigation workflow, we're making preliminary analysis faster while enabling our analysts to focus on the cases that need deeper investigation. 🤝 We're excited to bring AI-powered on-chain investigation to more victims and the broader Web3 community. ❓Need help after a crypto theft? Submit your case through our Free Stolen Asset Assessment Service to receive a TrackAgent-powered on-chain assessment and support from the SlowMist security team. 👉 📖 Read more：

🚀MistTrack Crypto AML x402 API is now live! To make address analysis more convenient, we have launched the MistTrack Crypto AML x402 API, supporting blockchain address labeling and risk detection. 🌟A boon for AI Agents and developers: No registration required, no API Key needed. Simply call the API on-demand through the x402 payment protocol — flexible and efficient! 💰Address labels start at just $0.10 per call 🛡️Full suite of features including Risk Scoring, Transaction Investigation, and more ⚡Perfectly suited for AI Agent automation workflows Try it now👇

🚨 MistTrack Illicit Fund Analysis — Taiko Exploit 🕵️ On June 22, 2026, the Taiko protocol was exploited. Stolen funds were distributed across multiple attacker-controlled addresses. The main attacker EOA 0x7506DeA0c38ca0B55364B22424374c5A1ae1B76a received various ERC-20 tokens (USDC, USDT, crvUSD, CRV, WBTC, wEETH, TAIKO, iZi) and quickly swapped most non-native assets for ETH via DEXs, accumulating ~615 ETH. Separately, 277.97 ETH was bridged out directly. Total stolen: ≈ $1.74M (at incident-time prices). ✅ 777.977 ETH (~$1.35M) moved to: 0xa98035081fb739ebe9c8f80904668fb11438a846 ✅ 1.99M TAIKO (~$194K) deposited to MEXC via: 0x5FBc60A12Bc6635E7d587d8DaC52e4b1388b4990 ⚠️ Attacker EOA still holds: 117 ETH + 2.14M iZi + 0.531 wEETH Key address to monitor: 0xa98035081fb739ebe9c8f80904668fb11438a846 We have blacklisted the related addresses and are actively monitoring them.