Match Systems

🛡 Our Case. Episode 6 600K in One Transaction: How Deep Analytics Revealed a "Hidden" Block In one of our cases, a client lost over $3 million to theft. We immediately performed AML tagging so the assets would be flagged as stolen across exchange AML systems. One address stood out from the rest: approximately $600,000 in Bitcoin had been sitting in a separate wallet for an extended period — with no visible connection to any crypto service. No public links. A genuinely complex situation. We applied advanced investigative methods and additional checks, including clustering of related addresses. Eventually, we identified that this "invisible" address belonged to one of the major exchanges. The funds were blocked based on our AML tagging. We received confirmation of the block from the service and, together with the victim's law enforcement authorities, initiated the recovery process. Conclusion Basic analytics isn't always enough. Some blocks triggered by AML tagging remain hidden — and without deep analysis and specialized techniques, certain addresses simply cannot be attributed to an exchange at all.

🔐 Crypto Theft Schemes in 2026 — And How to Protect Your Assets Crypto scammers never sleep. While you're reading this, someone is losing funds to drainers, phishing attacks, SIM swaps, or a months-long "pig butchering" con. We broke down the most common attack schemes tracked by Match Systems analysts: 🪤 Crypto Drainers — you sign the permission yourself, thinking it's a routine action. The script handles the rest. 🎣 Phishing & Fake AML Checks — pixel-perfect clones of real services that ask you to "connect your wallet." Legitimate AML checks never require wallet access. Ever. 📋 Clipboard Hijacking — you copy a wallet address, but malware has already swapped it for the attacker's. The first and last characters often match — so you won't notice. 🐷 Pig Butchering — weeks of "friendship" or "romance," a too-good-to-be-true investment platform, then the withdrawal freezes and your new "friend" vanishes. 💸 Recovery Scammers — already been robbed? That's when "blockchain specialists" appear, promising to get your funds back — for an upfront fee. It's the second hit. Plus: OTC traps, dust attacks, fake ICOs, Ponzi schemes, and more. 3 rules that actually work: ✅ Slow down — urgency is a scammer's favorite weapon ✅ Separate your wallets by purpose — never use your main holdings wallet for day-to-day activity ✅ Keep your holdings private — in crypto, oversharing is an open invitation Full breakdown of every scheme, protection tips, and a step-by-step guide on what to do if you've been hacked — on our website: matchsystems.com/crypto-thef…

Stolen crypto? Report the incident and help flag the attacker’s wallet across the ecosystem. Our team has already helped recover $80M+ in stolen crypto. Report the case → matchsystems.com

🛡 Our Case. Episode 5 The Long-Term Effect of AML Tagging: Blocks Still in Place a Year After the Theft In 2024, a major Asian exchange became the victim of a high-profile hack that media outlets linked to the so-called North Korean “crypto army.” Hundreds of millions of dollars were stolen. At the initial stage, the exchange chose to conduct the investigation independently. We continued monitoring the case for research purposes. Throughout this period, we tagged newly related addresses and tracked further fund movements. Nearly a year later, the exchange returned to us for assistance. At that point, the key outcome became clear: the previously established AML tagging was still effective. Assets continued to be blocked across multiple exchanges, despite the time that had passed. Large platforms strictly follow their AML policies and maintain restrictions on assets when relevant tagging is present. As a result, even months later, a portion of the funds remained frozen and available for transfer back to the affected party. Conclusion This case shows that AML tagging is not only about speed in the first hours after an incident. It is about creating a durable trail that continues to work months later. #AML #CryptoRecovery #CryptoScam #Scam #ScamAlert #scammers

Why does one exchange allow a transaction with Medium risk, while another blocks it? Because a risk score is not the truth. It’s a reflection of the specific tool and the depth of data behind it. First, AML services build their databases in very different ways. If a tool simply doesn’t have information about certain addresses or connections, it may show Low or Medium risk. That doesn’t mean the address is “clean.” It means the data is incomplete. Second, what really matters is which AML tools are used by the compliance team of the crypto service that froze your funds. The same address can look acceptable in one system and trigger stop-flags in another — sanctions exposure, high-risk sources, or links to problematic clusters. And there’s another detail most people don’t talk about. There are AML services on the market (we won’t name names) that show different risk scores for the exact same address: — one version for a regular user who buys a $1–2 report — and a completely different view for compliance teams with full platform access The user sees Medium risk. The exchange sees a set of red flags. The outcome is a freeze. No “exchange mistake” involved. The takeaway is simple: a risk score without understanding the data source, labeling depth, and decision context is a very poor reference point. We explain how address labeling actually works — and why speed and data depth matter more than a number in a report — in detail here: matchsystems.com/blockchain-… So think about it: are you trusting the number — or the infrastructure behind it?

🛡 Our Case. Episode 4 How AML Tagging Stopped a $200,000 Withdrawal In one of our cases, a crypto exchange in the CIS region lost approximately $200,000 USDT. The theft occurred during an exchange transaction and was carried out using a man-in-the-middle scheme, commonly referred to as a “triangle” attack. The affected service responded immediately and contacted us right after the incident. We performed AML tagging of the involved addresses and added them to analytical databases. A few days later, the attacker attempted to withdraw and exchange the stolen funds through another exchange. However, that platform was already running an AML system that recognized our tagging. As a result, the transaction was halted. With legal support, the funds were returned to their rightful owner. Conclusion This case clearly shows that exchanges operating within a shared anti-fraud framework reinforce each other and reduce risk across the entire ecosystem. This outcome was possible only because the second exchange was already connected to our AML service. Connect to the Match Systems AML infrastructure to stop suspicious transactions before funds are withdrawn. matchsystems.com/aml

Trust Wallet Card Scam Instagram ads have started appearing with the wording “official Trust Wallet card with no KYC.” Even at this stage, the offer should raise questions, but the flow becomes more interesting further on. The ad does not lead to an official domain, but to a landing page at trustalpha.plus, styled to resemble Trust Wallet. The key detail is that when the button is clicked from a mobile device, the user is not taken to a regular browser. The page opens inside Trust Wallet, in the wallet’s built-in browser. For an unprepared user, this looks like a native part of the application. Next, another site loads, trustwallet.guide, where the user is invited to “activate the card.” To do so, they are asked to enter their seed phrase. From a social engineering perspective, the flow is well constructed: ad → pseudo-official domain → built-in wallet browser → sense of legitimacy → theft of funds. The seamless transition inside the wallet is what makes this scheme particularly dangerous. Visually, it does not feel like a redirect to a third-party resource. The main weak point of the scheme is the direct request for the seed phrase. If a contract drainer had been used instead, user losses could have been significantly higher. A reminder: any “wallet products without KYC” have no relation to official services. The fact that a page opens inside a wallet does not make it official. A seed phrase is never used for activations, cards, or confirmations. Stay safe. #ScamAlert #scam #TrustWallet #TrustWalletscam #cryptoscam #CryptoScams #CryptoScamAlert

🛡 Our Case. Episode 3 Theft via Aptos: Even Obscure Blockchains Won’t Help Criminals Hide In one of our cases, a well-known crypto influencer was compromised. Under the pretext of attending a conference, the attackers convinced him to install malicious software, which gave them access to local wallets and allowed them to start draining funds. The assets were withdrawn across multiple networks, including BTC, ETH and Solana, as well as less common blockchains such as Aptos, in significant volumes. The assumption was clear: these networks are analyzed less frequently. We promptly tagged the attacker’s addresses across all analytical systems available to us and placed them under continuous monitoring. As a result, more than $100,000 was frozen on exchanges across different jurisdictions. Notably, a substantial portion of the funds was intercepted specifically on the Aptos network. Conclusion: Using a less popular blockchain is not a guarantee of safety for attackers. AML tagging across analytical tools combined with continuous monitoring works there as well.

🎄 Happy New Year! The year coming to an end was a challenging one for the market and for everyone working in the crypto industry. It demanded focus, responsibility, and well-considered decisions. For our team, it was a year of intensive and truly meaningful work. ❤️ Thank you to all our clients and partners who stood with us throughout the year. New challenges lie ahead, and we are ready for them. We wish you resilience in difficult moments, clarity of focus, and steady progress toward your goals. We will continue doing our part so that you and your assets remain secure.

Match Systems | Trust Wallet (Chrome Extension) — Incident Analysis Over the past 24 hours, we have observed a surge of reports about unauthorized withdrawals affecting users of the Trust Wallet Browser Extension for Chrome. The Trust Wallet team has officially stated that the issue affects only extension version v2.68 and has recommended disabling it and updating to v2.69. According to their statement, mobile users and other extension versions are not impacted. Based on our assessment, the incident most closely resembles a supply-chain compromise — specifically, a compromised update or component of the extension. In such cases, an attacker typically aims to gain access to critical wallet data (primarily the seed/mnemonic) or the signing process itself, after which fund theft becomes a matter of automation and time. Our initial review shows that victims’ funds are drained quickly, then dispersed across multiple chains and partially routed through exchange services. This is important because these points sometimes allow for intervention — AML responses, outreach to platforms, and in certain scenarios, freezes involving issuers and/or law enforcement requests. The total damage and number of affected users are still being clarified, but public estimates exceed $7 million. Our analytics also indicate the presence of large victims in this case: one with losses exceeding $3 million, and another with losses over $700,000. The highest risk applies to users who ran Chrome extension v2.68 (especially if they imported or entered a seed during that period). Even if you “did not sign anything,” a compromised extension can be sufficient for subsequent fund theft. If you had v2.68 installed, disable the extension and update to v2.69 from the official source. If your seed may have been compromised, act as you would after a leak: create a new wallet with a new seed and transfer assets, preserve evidence (extension version, timestamps, addresses, txids). If you were affected, save all transactions, addresses, and timestamps, prepare a brief incident timeline, and initiate the process by filing a police report — this is what enables official requests to platforms and potential freeze/recovery actions. We are continuing to collect artifacts and conduct on-chain monitoring of related flows. @TrustWallet has officially announced its readiness to compensate all affected users of the Chrome extension impacted by this incident. This involves hundreds of affected wallets. The Trust Wallet team has confirmed that they will work directly with each affected user for individual case review and to arrange reimbursements. It is important to retain all evidence and contact support through the project’s official channels. #trustwallethuck #trustwalletscam #TrustWallet

🛡 Our Case. Episode 2 How the attacker tried to evade tagging 7 times A mining client, a compromised seed phrase, and a $250,000 theft . At first, the case looked fairly standard.But it quickly turned into a race between the attacker and our investigator. We immediately tagged the attacker’s addresses as stolen funds, sending a clear signal to exchanges and services across the ecosystem. In response, the attacker began routing the funds through multiple centralized and decentralized (DEX) services, trying to break the tracking trail and wash out the tagging. Each time the funds surfaced on a new address, we tagged it again, restoring full visibility of the stolen assets. Within 48 hours, this happened seven times: seven escape attempts and seven counter-actions. As a result, a significant portion of the funds was blocked, and the recovery process was initiated. Conclusion: even when an attacker actively tries to evade control, real-time tagging allows stolen funds to be tracked in motion and stopped before they disappear.

Crypto Address Labeling — how to stop stolen crypto from moving The most common scenario after a crypto theft is simple: the victim contacts the exchange or wallet support and waits. While responses and checks are in progress, the attacker is already splitting the funds and moving them further along the chain. The problem is that, for services used to cash out stolen crypto, these addresses look “normal” by default. Until an address is labeled as hack / phishing / scam, the infrastructure does not treat it as a risk — and the funds continue to move freely. That’s why the first critical step after a theft is to quickly collect incident details and initiate labeling of the attacker’s addresses. This is a signal recognized by exchanges, swap services, and analytics platforms: it triggers checks and helps stop the outflow and freeze the funds. Only after that does the longer recovery process begin — involving law enforcement and issuers. In the article, we explain: • how crypto address labeling works • who uses it and how it’s applied in practice • why speed of signal propagation is critical • how crypto security infrastructure is evolving 📖 Read the full article: matchsystems.com/blockchain-…

The theft of 3M USDT and a Tether freeze within 48 hours: the power of rapid tagging ⏳ In one of our recent cases, a client from the CIS had the seed phrase of their wallet compromised. Nearly 3 million USDT were stored on that wallet. The attacker immediately moved the funds to two newly created addresses. In situations like this, time usually works against the victim — but in this case, everything changed thanks to a fast response from both the client and our team. We quickly initiated AML tagging across key analytics systems so the attacker’s addresses would be marked as stolen assets. At the same time, we prepared a documentation package for law enforcement, and the official request to Tether was sent the very same day. Both factors — tagging and legal grounds — turned out to be decisive. In less than 48 hours, Tether froze both addresses at the smart-contract level. The funds are now in the process of being reissued to the rightful owner. What this case shows Rapid tagging is not a formality or a secondary step. For issuers and services, it’s a clear signal that the assets are stolen. Combined with a fast legal request, it creates a window in which a freeze is still possible. The main takeaway is simple: the speed of response and the visibility of stolen assets in analytics are critical factors that make it possible to stop the movement of funds before the attacker has time to “wash them away.”

🤝 Announcing a new partnership with BestChange! Risk assessment for crypto wallets is now available on BestChange — powered by the Match Systems database. A user enters an address and receives a risk score with category breakdowns, helping to understand the overall risk level before a transaction. For the BestChange audience, it’s a convenient tool that helps assess risks in advance, understand the origin of funds, and reduce the likelihood of account freezes. For Match Systems, it’s an important step in expanding the crypto-security infrastructure.

🔍 How crypto is laundered in 2025 — and why classic investigation methods no longer work While regulators are still focused on mixers, criminal groups have already moved on. Cross-chain bridges, DEX aggregators, and “black-box” services like DefiWay or Bitget Bridge can blur transaction trails in minutes — splitting funds into hundreds of micro-transfers and hiding them inside DeFi liquidity. Solana is rapidly turning into a gray zone: ultra-low fees, massive throughput, and almost no public service labels. Meanwhile, platforms like Exolix use multi-layer internal routing, making external tracing nearly useless. In our breakdown, we cover: • why suspicious cross-chain flows are already in the hundreds of billions, • how bridges and aggregators break traditional analysis, • the new techniques criminals rely on, • and why the first hours of an investigation matter more than ever. 📖 Full article: matchsystems.com/cross-chain…

🐖 Pig Butchering Scam is a multi-stage scheme where the victim gets deceived not once, but several times. It all begins with casual communication — flirting, friendly chats, social media, or dating apps. Once trust is established, the scammer introduces a “friend who invests successfully” and invites the victim to try a “reliable platform.” The pattern is always the same: a small deposit, fake “profits,” and sometimes even a small withdrawal to build confidence and push for larger investments. But once the amount becomes significant, withdrawals stop, the “friend” disappears, and the money is gone. And that’s only the first stage. Soon after, the victim is contacted by “lawyers,” “intermediaries,” or “fund-recovery companies.” They promise help, ask for upfront fees for “verification” or to “start the process” — and then vanish. Then comes the third layer: fake “regulators” and “government agencies.” They send emails with official-looking logos, forged domains, and messages like “your funds have been located — pay a tax or penalty to release them.” After payment, new requirements appear, leading to more losses. We prepared a short guide explaining: — how all three stages of the scheme work, — the red flags, — how repeat attacks happen, — and what to do if you’re already in phase one. If you hold crypto, read this beforehand. A mistake in the first stage is expensive — in the second and third, it’s even worse. 📖 Full article: matchsystems.com/pig-butcher…

Yesterday we spoke at a webinar hosted by the Ministry of Internal Affairs of Kazakhstan, focused on identifying illicit crypto assets and tracking their transactions. Our presentation covered what truly determines the success of an investigation: the speed and accuracy of address labeling. We showed how timely labeling helps stop the movement of stolen funds, reveal chains across bridges and mixers, and why every minute after a theft matters. We discussed real cases and the tools that help law enforcement quickly identify high-risk addresses and make informed decisions in the first hours. A productive discussion, a strong audience, and a shared commitment to making the crypto ecosystem safer.

Crypto stolen? Most people lose not only their money, but also their chance to recover it. The first hour is critical, while hackers quickly move funds through wallets, bridges and mixers. We made a short guide on real steps that help, common mistakes and what to do in the first minutes. If you hold crypto, read this before you ever need it. Full article: matchsystems.com/stolen-cryp… #CryptoScam #Scam #ScamAlert #scammers

Today, Ais Dorzhinov spoke at the Annual Internal Audit Conference in Yerevan, sharing insights on crypto-related crimes. Not in theory, but through real cases — how blockchain analytics helps trace fraudsters, how artificial intelligence enhances investigations, and why speed of response is critical today. It’s encouraging to see audit and crypto security becoming part of the same professional language. Equally important was the strong interest from auditors — in how to learn about digital assets, where to access reliable information, and how to build competence in this rapidly evolving field.