Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents. The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO. Commingling address: 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 Bitget exploit context:

BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit. Thanks to all other signers involved. Exploiter address 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6

Please explain to the community why an entity received ~42M AXIS from the Axis team multisig to six addresses and sold it for ~5.04M USDC via DEX over the past 24 hours which has caused the AXIS price to crash 40%? You only TGE’d one week ago…. 0xcc279c2499bcf4bd0f169c2d3f333243473242f7 0x66612012c5ad9b2fed81d09a9ab429b5285b2c62 0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0 0x99cd3975c90b79ffdbe16425de033a605b814c49 0xbbed67fec9c7793218fa60c40fb9e6b059d86483 0xe69d8d6b9b7f9056eda455b76384e9748749f4d1 0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d

11/ Throughout our conversations, Jimmy and I had a lot of small talk in between discussing laundering for DPRK. He talked about playing mahjong, hunting wild rabbits, food, his fat reducing meal, family life, and vacations at Disney. (His awkward grammar can be explained by the use of a translator)

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.

Allegedly my account is not eligible. Each one of my original investigations published to X exclusively receives 1M+ impressions and I have 132K verified followers. Meanwhile verified news orgs repost my content and earn monetization…. Becoming clear none of the X team uses the platform beyond a surface level and over time it’ll become evident it’s no better than Jack / Twitter times.

BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use. Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year. I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks. Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi. Alias 1 - Cc Discord: cc02006 Discord ID: 1351486674386948148 Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363 Alias 2 - jack Discord: jack_34808 Discord ID: 1553705721768714377 Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69 Alias 3 - Melon Discord: under0346 Discord ID: 1394240539108573215 Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B Alias 4 - lolo / Marin TG: pvpcz TGID: 6223514198 Discord: losern Discord ID: 1024415186527985704 Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15 Alias 5 - HELP ME Discord: helpme031897 Discord ID: 1554035533817188384 Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379

1/ Meet M1llionz (RichMilly666), a French cybercriminal allegedly laundering assets from two violent home invasion robberies in France in April 2026 that netted $667K total, with a history of openly posting about bank and retail fraud on social media. My work has led to a $93K Tether freeze directly tied to these attacks so far.

@sheldonbitmart @BitMart_zh @BitMartExchange If you actually have the liquidity then simply return the funds to everyone instead of posting vague statements? Your actions have caused real people to lose access to funds with little transparency….

7/ In late January 2026, I exposed John Daghita (Lick) for stealing $46M in seized crypto from the US government. Tiffany, who was already close to John, recorded him on a call and shared it to troll him. In retaliation, John posted her name in his public Telegram channel.

2/ Tiffany operates as a 'caller' the person who phones victims posing as exchange or wallet support and talks them into handing over access to their funds. In the clip below, you can hear what one of her calls sounds like.

1/ Meet Tiffany Milanovich, a US based threat actor tied to at least $5M in thefts from hardware wallet and centralized exchange support impersonation scams. She's recorded herself taunting victims on calls after draining their funds. Tiffany openly flaunts luxury purchases, stolen funds, and casino gambling on social media.

Also have multiple examples of where I get scammed by people when I help them. @roshii (Zatoshi) was scammed for $600K in June 2026 and they said they would “pay whatever my fee is” Spent 5+ hours tracing and froze $96K total He refused to file a police report in Denmark since he didn’t pay taxes. Asked for $5K and they’ve been ghosting me for weeks since.

Also have multiple examples of where I get scammed by people when I help them. @roshii (Zatoshi) was scammed for $600K in June 2026 and they said they would “pay whatever my fee is” Spent 5+ hours tracing and froze $96K total He refused to file a police report in Denmark since he didn’t pay taxes. Asked for $5K and they’ve been ghosting me for weeks since.

Sorry I have no current have no plans to monitor or trace the ColdCard incident. My time is focused on ecosystems who value my work whereas Bitcoin maxis are not donors or supporters so I have less obligation to help. Not really interested in spending time on complex cases for a “good job” anymore.

Update 3: Over the past 48 hours an entity initially funded by the LAB team deposited 18.4M LAB ($18.3M) to Aster and began selling LAB spot on the DEX which has caused the LAB price to drop another -54% from $1.2 to $0.55. From July 10 to 11 the entity began transferring LAB to three Aster deposit addresses and currently still holds another 81.5M LAB: 0xaad30cab22f772c1658b7845b5837d35bf3a467a 0x76ccfde9819500204985580d235dd8326fa0b241 0x628dd74f428a81cd34ece11331a7f1593f76047a The entity received 196M+ LAB from the LAB team in April 2026, transferred LAB to four Bitget deposit addresses, withdrew to ten addresses from May 11 to 12, and still holds 81.5M LAB.

@wei_crypto8888 @ismaritagorguis Sorry I do not support or promote meme coins. I have just donated $25K (entire amount I sold) to @GiveDirectly via @TheGivingBlock to support charity efforts for the recent Venezuela earthquakes. 0x687556d7011b0750f3daf9e3a9f800d04ba233c84362faf8c3851b40cd0f71ae

A short story about Indian scammers who called the cops on themselves: Earlier this week a follower DM'd me from his personal account complaining that 5.73 BTC ($475K) of his was 'unjustly' frozen at Changelly in Mar 2025. So I went and plotted the Bitcoin transaction in my compliance tools. The inflows trace back to illicit sources via social engineering thefts targeting Americans through US exchanges and Bitcoin ATMs. The broader cluster of high confidence thefts has taken $1M+ from victims since 2025, with several of them elderly. His story kept changing. It was a loan. No, his boss sent it. No, his boss invested in Bitcoin "during 2014 and 2015" through a friend in the US. The best part? In Dec 2025 he claims to have filed a police report in India over these frozen funds (3207-P/2025). In our DMs he shared email screenshots which I queried to surface more data points and map his group out. I suspect AmanKesar11 is a mule for his boss 'Mr Parveen,' as the 'proof' he sent included bank statements under a different name / location. While you can message me for help and I'll respect your privacy, at least use common sense and don't contact me with stolen funds. 5.73 BTC frozen order: fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3 AmanKesar11 BTC address: bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2 AmanKesar11 Tron address: TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm

Recent UK crypto sanctions seem to be a bit of an overreach. Wonder if it will ever get to the point where it’s ignored because HTX address tainting onchain has been catastrophic. In the past sanctions were done and those crypto businesses typically had a high % of illicit activity (Huione, Blender, Hydra, etc). While Justin Sun may be a controversial name HTX has a decent number of Asia retail users. Basically now I’ve had to ignore the sanctions category when tracing cases by exposure since “risk” itself has become meaningless. Also compliance tools are a bit flawed and do not differentiate pre & post sanctions activity well. Meanwhile I have a legit $1.25B laundering case by an illicit actor the UK completely failed to detect. Given UK incompetence historically in crypto cases it’s not surprising to see them sanction HTX and miss the actual violations…..