Between May and July, I was the first to flag 11+ major threat intelligence cases affecting protocols, including the Humanity Protocol hack. I have also provided incident response support and contributed to the freezing of $2M+ in stolen funds. I was able to do this with the help of $2,257 in donations, plus 1.825 ETH from the matching pool I received through the @Giveth × @thedaofund QF round, which allowed me to equip myself with the necessary tools and resources. I have also provided pro bono support to individual victims and assisted in the freezing of $400K+. Thank you to everyone who has supported me, including @wintermute_t and @PashovAuditGrp. Stay Smart

There appears to be an ongoing hack involving @hedera Network, with over $3.7M already bridged to Ethereum by the attacker. The stolen funds are currently being swapped from WBTC for ETH after being bridged from the Hedera network via Layerzero. Theft addresses: 0x9A4966152F6e10b33Cb7a37975e8619816d6a494 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e Stay smart.

@wei_crypto8888 @ismaritagorguis Sorry I do not support or promote meme coins. I have just donated $25K (entire amount I sold) to @GiveDirectly via @TheGivingBlock to support charity efforts for the recent Venezuela earthquakes. 0x687556d7011b0750f3daf9e3a9f800d04ba233c84362faf8c3851b40cd0f71ae

It's crazy that @titanbuilderxyz showed no conscience at all and had already deposited the funds into an exchange. This is the same Titan that netted $35M in March from a $50M swap. It's wild how little empathy exists in this space. Some people don't seem to care how the money is made. Refunding the victim and accepting a bounty would have been a reasonable outcome. Instead, taking everything under the justification of "it's not illegal" says a lot. I see why many CT has no pity for Jared....

It's crazy that @titanbuilderxyz showed no conscience at all and had already deposited the funds into an exchange. This is the same Titan that netted $35M in March from a $50M swap. It's wild how little empathy exists in this space. Some people don't seem to care how the money is made. Refunding the victim and accepting a bounty would have been a reasonable outcome. Instead, taking everything under the justification of "it's not illegal" says a lot. I see why many CT has no pity for Jared....

Sixteen hours ago, a wallet linked to Mining Express swapped 5,004 ETH for 8.8M DAI. Mining Express was a collapsed Ponzi scheme launched in 2019 in Ukraine by Brazilian founder Kaze Fuziyama. The scheme recruited investors through an MLM structure before eventually ceasing payouts and pivoting to cloud video rendering. In early 2022, Ukrainian law enforcement raided Mining Express's data center for several days, seizing cryptocurrency mining equipment as part of their investigation. On March 19, 2024, this wallet received 4,512 ETH from wallet linked to Mining Express. The funds were later staked through Lido and Etherfi. By April 2026, all of the ETH had been staked, before being fully unstaked on May 4, 2026. I first flagged this address on June 15, but didn't have the opportunity to investigate it further until now. Related addresses: 0x9D6c9E135f96e5317f58b7B5Bf49C0d5dB03F3c1 0x06B8C5883Ec71bC3f4B332081519f23834c8706E bc1qduw5sqvdc8dl4l7r84743xmang0ql2xghm407v Stay smart.

Sixteen hours ago, a wallet linked to Mining Express swapped 5,004 ETH for 8.8M DAI. Mining Express was a collapsed Ponzi scheme launched in 2019 in Ukraine by Brazilian founder Kaze Fuziyama. The scheme recruited investors through an MLM structure before eventually ceasing payouts and pivoting to cloud video rendering. In early 2022, Ukrainian law enforcement raided Mining Express's data center for several days, seizing cryptocurrency mining equipment as part of their investigation. On March 19, 2024, this wallet received 4,512 ETH from wallet linked to Mining Express. The funds were later staked through Lido and Etherfi. By April 2026, all of the ETH had been staked, before being fully unstaked on May 4, 2026. I first flagged this address on June 15, but didn't have the opportunity to investigate it further until now. Related addresses: 0x9D6c9E135f96e5317f58b7B5Bf49C0d5dB03F3c1 0x06B8C5883Ec71bC3f4B332081519f23834c8706E bc1qduw5sqvdc8dl4l7r84743xmang0ql2xghm407v Stay smart.

Sixteen hours ago, a wallet linked to Mining Express swapped 5,004 ETH for 8.8M DAI. Mining Express was a collapsed Ponzi scheme launched in 2019 in Ukraine by Brazilian founder Kaze Fuziyama. The scheme recruited investors through an MLM structure before eventually ceasing payouts and pivoting to cloud video rendering. In early 2022, Ukrainian law enforcement raided Mining Express's data center for several days, seizing cryptocurrency mining equipment as part of their investigation. On March 19, 2024, this wallet received 4,512 ETH from wallet linked to Mining Express. The funds were later staked through Lido and Etherfi. By April 2026, all of the ETH had been staked, before being fully unstaked on May 4, 2026. I first flagged this address on June 15, but didn't have the opportunity to investigate it further until now. Related addresses: 0x9D6c9E135f96e5317f58b7B5Bf49C0d5dB03F3c1 0x06B8C5883Ec71bC3f4B332081519f23834c8706E bc1qduw5sqvdc8dl4l7r84743xmang0ql2xghm407v Stay smart.

An interesting day... The Step Finance attacker is actively depositing stolen funds into Tornado Cash. At 18:18 UTC, the attacker bridged $5.8M in stolen funds to Ethereum, receiving 3,874 ETH. A few minutes ago, they bridged another $21.4M, receiving 12,124 ETH. So far, the attacker has deposited $10.8M into Tornado Cash. In the last five hours alone, two attackers have deposited over $21M into Tornado Cash. The Step Finance attacker still holds $16M and is actively laundering the remaining funds. Attacker addresses: 0xDf3786773645fd737ff5764C06536e8908f5d1b7 0x535dC505c9f8Adb4cb70D3E5f44cC5c9Caa6C2b6 Stay smart.

The UXLINK attacker has now deposited the remaining $10.5M of the stolen funds into Tornado Cash. The attacker swapped $10.5M DAI for approximately 6,000 ETH before depositing the funds into Tornado Cash. In September, the attacker compromised the UXLINK multisig, drained it and, minted billions of UXLINK tokens, and ultimately walked away with about $40M. Since then, the attacker has been laundering the stolen funds through Tornado Cash. With today's deposits, virtually all of the stolen funds have now been laundered. Stay smart.

Arthur Hayes Exit Liquidity – June Report Arthur Hayes started shilling what he called his "Holy Trinity" coins: $HYPE $ZEC $NEAR He predicted $150 for $HYPE and even published a Substack post promoting it. A few days later, Arthur sold all three "Holy Trinity" coins. He then shilled $WLD, posting: "This shitcoin is going to moon." Three days later, Arthur announced: "I'm out." Next came $CARDS. He predicted a $4 price target, saying: "The price will be pamping." Just one day later, a wallet linked deposited 1.9M $CARDS to an exchange. This isn't new. In 2024, Arthur heavily promoted $ENA. About an hour later, he deposited $8.4M $ENA to a CEX Arthur's BitMine, has also been accused of operating an insider trading desk, price manipulation, and insider trading. He is now actively promoting $SYN, which will probably make it into next month's report. 😂 Arthur Hayes continues to use his followers as exit liquidity under the guise of simply sharing his "market views." With a following of his size, he should be far more careful about what he promotes but that doesn't seem to be the case. The difference between Arthur Hayes and James Wynn is simply how they package their exit liquidity strategy. Stay smart.

Arthur Hayes Exit Liquidity – June Report Arthur Hayes started shilling what he called his "Holy Trinity" coins: $HYPE $ZEC $NEAR He predicted $150 for $HYPE and even published a Substack post promoting it. A few days later, Arthur sold all three "Holy Trinity" coins. He then shilled $WLD, posting: "This shitcoin is going to moon." Three days later, Arthur announced: "I'm out." Next came $CARDS. He predicted a $4 price target, saying: "The price will be pamping." Just one day later, a wallet linked deposited 1.9M $CARDS to an exchange. This isn't new. In 2024, Arthur heavily promoted $ENA. About an hour later, he deposited $8.4M $ENA to a CEX Arthur's BitMine, has also been accused of operating an insider trading desk, price manipulation, and insider trading. He is now actively promoting $SYN, which will probably make it into next month's report. 😂 Arthur Hayes continues to use his followers as exit liquidity under the guise of simply sharing his "market views." With a following of his size, he should be far more careful about what he promotes but that doesn't seem to be the case. The difference between Arthur Hayes and James Wynn is simply how they package their exit liquidity strategy. Stay smart.

While it's true that some money launderers use gambling and prediction platforms to move illicit funds, this particular trader may not fit that profile. The account was created in November 2024 but became active in November Most of the positions are on outcomes with relatively high probabilities, for example: A Democrat will win the New Mexico presidential election. The U.S. will not strike Iran by February 1, 2026. Bitcoin will reach $130,000 in November 2026. The average position size is around $100,000, with most of the larger bets initially focused on the "U.S. strikes Iran" market before shifting to World Cup markets. Despite primarily trading higher-probability outcomes, the trader is currently down about $58,190 in PnL. All deposits into Polymarket appear to originate from Nexo, a KYC lending platform, and withdrawals also return to Nexo. A money launderer typically wouldn't operate that way. Tracing back the trader's 4years old Nexo deposit address further links it to other wallets, showing activity dating back at least 8 years. The wallet also appears to have been a user of Celsius Network, another lending protocol that went bankrupt in 2022. I also links the trader to several KYC exchanges, including Binance and Bybit. While on-chain analysis can never provide complete certainty, it would be unusual for someone laundering funds to maintain this level of long-term, identifiable exposure. Just as some gamblers chase massive returns, others are willing to accept smaller profits in exchange for lower risk. Based on the available on-chain evidence, this trader doesn't appear to be who many people think they are. Stay smart.

While it's true that some money launderers use gambling and prediction platforms to move illicit funds, this particular trader may not fit that profile. The account was created in November 2024 but became active in November Most of the positions are on outcomes with relatively high probabilities, for example: A Democrat will win the New Mexico presidential election. The U.S. will not strike Iran by February 1, 2026. Bitcoin will reach $130,000 in November 2026. The average position size is around $100,000, with most of the larger bets initially focused on the "U.S. strikes Iran" market before shifting to World Cup markets. Despite primarily trading higher-probability outcomes, the trader is currently down about $58,190 in PnL. All deposits into Polymarket appear to originate from Nexo, a KYC lending platform, and withdrawals also return to Nexo. A money launderer typically wouldn't operate that way. Tracing back the trader's 4years old Nexo deposit address further links it to other wallets, showing activity dating back at least 8 years. The wallet also appears to have been a user of Celsius Network, another lending protocol that went bankrupt in 2022. I also links the trader to several KYC exchanges, including Binance and Bybit. While on-chain analysis can never provide complete certainty, it would be unusual for someone laundering funds to maintain this level of long-term, identifiable exposure. Just as some gamblers chase massive returns, others are willing to accept smaller profits in exchange for lower risk. Based on the available on-chain evidence, this trader doesn't appear to be who many people think they are. Stay smart.

The attacker has finally begun laundering the stolen funds after more than three years of inactivity. In January 2023, the attacker swapped the stolen GMX for 2,819 ETH, worth $3.4M at the time. Due to ETH's price appreciation, those funds are now worth $4.4M. The assets remained dormant until a few minutes ago, when the attacker deposited the stolen ETH into Tornado Cash in 28 of 100 ETH each. Stay smart.