KR

I hope I am not going to jail for these wallet leaks, I feel like it is so illegal to share. But I love CT so here you go 👇🐋

So wallet builders forgot already the true use of a wallet. wallet is a storage where we can store something that has value can be fiat or anything. But wallets nowadays is full of feature where your money cannot rest, it has perps, swaps, predictions.

One TRON address was created at 13:16 UTC on Nov 3. In the next 36 minutes it pulled funds out of more than 100 other addresses, some untouched since 2022. you don't get that from a phishing click. that's someone who already had the keys. "trust wallet hacked" is everywhere this week. i went through the posts and the chain. it's at least three separate stories glued together, and none of them shows a trust wallet app or server exploit. A) the phishing site: real, but no losses tied to it > nov 4 20:29 utc: @Malwarehunterr exposed trastwallet[.]cam, a fake "review your wallet transfers" page. its script scanned balances and staged transfers to fixed addresses. signing was disabled when he found it > nov 5 02:43 utc: @HeyTrustWallet confirmed it's a phishing domain and reported it for takedown > @cz_binance boosted the warning: ".cam is not .com" > the only @TrustWallet statement i found: "Always verify official links" > around 10:30 utc today the domain stopped resolving > fake emails are going around too: a "data breach" mail that zurich police warned about on oct 28, and an "update wallet v2.68" mail that support called a scam on nov 1 i haven't seen a single loss tied to trastwallet[.]cam. B) the TRON sweep: confirmed on-chain @noirvox_studio posted that 3,830 USDT left his trust wallet with no approval. the no-approval part is correct. here's what the chain shows: > 13:29:09 utc nov 3: a plain USDT transfer() of 3,830 to TQcGuE…5JM, signed by his own key. 39.22 TRX went to the same address in the same second > his address has one key, threshold 1, no permission changes. no contract pulled anything > TQcGuE…5JM was created 12.5 minutes before that > between 13:16:42 and 13:52:21 it received funds from 108 distinct addresses by my count: 5,913.67 USDT from 15 of them, 2,988 TRX from 105 > several had been dormant since 2022 (TCRZ4F…, TQcmsC…, TX4tiw…) > at 13:32 the collector sent one wallet 0.28 TRX for fees, then pulled its 969.34 USDT > 13:38:36: all 5,913.67 USDT swapped to 18,342 TRX > 21:14:57: 21,106 TRX sent to TEr95…, then at 21:23:03 on to TFDzxj…, a busy wallet whose owner i can't confirm > about a minute after the drain, a lookalike address ending in …5JM sent him dust. that's address poisoning, and it came after the loss @iris_intel_app traced this collector first (nov 4 14:57 utc). they count 136 wallets. i count 108 distinct senders with a 0.1 TRX floor. either way these are addresses, not people. one person can hold many. no one phishes 100+ wallets, some idle since 2022, in 36 minutes. the keys were stolen earlier and swept in one batch. the chain doesn't show how they leaked. what fits, without proving it: > @_SEAL_Org's weekly stats have logged trust wallet iOS compromises in three recent reports: 4 reports for $165K, 4 for $434K ("mostly TRON"), and 6 for about $127K for oct 28 to nov 3 > SEAL suspects the DarkSword iOS kit, delivered through malicious ads > on oct 7 @censysio found a live DarkSword/Coruna kit with a trust wallet module that also scans photos and notes for seed phrases. @GoogleCloudSec's GTIG documented the exploit chain in march > every DarkSword bug is patched as of iOS 26.3 i can't show that DarkSword drained noirvox or any single wallet here. it's a suspected pattern. the fee top-up and then the sweep is the same playbook as the BSC case i checked on oct 28, on a different chain. i found no on-chain link between the two. C) the "$1.1M iOS 18.5 exploit": unconfirmed > @Solana_Emperor's post credits a telegram channel > its only image is an arkham view of TRON USDT going into a binance deposit address and on to binance hot wallets. about $790K is visible, not $1.1M > no victim wallets appear in it, and nothing ties it to trust wallet or to TQcGuE… > i found no trust wallet post telling users to update iOS the "trust wallet hacked is confirmed" posts, like @cryptowaladmc's, came with no tx and no source. the receipts: drain: tronscan.org/#/transaction/6… swap: tronscan.org/#/transaction/8… 21,106 TRX hop: tronscan.org/#/transaction/1… collector: tronscan.org/#/address/TQcGu… phishing site: x.com/Malwarehunterr/status/… support confirmation: x.com/HeyTrustWallet/status/… first trace: x.com/iris_intel_app/status/… SEAL stats: radar.securityalliance.org/s… censys report: censys.com/blog/darksword-co… if you keep a wallet on an iPhone: > update iOS. the DarkSword bugs are patched as of 26.3 > never keep your seed in notes, photos, screenshots or cloud backups > if funds left without you signing, treat the seed as gone. make a fresh seed on a clean device and move what's left. a new wallet on the same compromised phone can get swept too > ignore "support" DMs and "update wallet" emails. no real support will ask for your phrase nothing here shows an app got hacked. what the chain does show is worse for the victims: their keys were already gone before the drain started.

Having a bad day? someone lost $49,999,950 in 26 minutes by copying one address. he did everything right first: a $50 test to the correct address. then he copied the next address from his own history, and it wasn't his. this happened on dec 19, 2025 and it's going around again (@Codedscientist reposted it). @web3_antivirus flagged it first and @SlowMist_Team traced the laundering. i went back through every transaction on etherscan to document what the victim's history looked like in those 26 minutes. the timeline, utc: > 14:41:11 49,999,950 USDT lands in the wallet > 15:06:47 test: 50 USDT to the real address 0xbaf4…f8b5 > 15:10:11 a zero-value USDT entry appears in his history, "sent" to 0xbaff…f8b5. he never signed it > 15:11 to 15:12 three more senders drop fakes into the same history > 15:20:35 the fake address sends him 0.005 USDT of dust > 15:32:59 49,999,950 USDT goes to 0xbaff…f8b5 > 16:01:23 all of it is swapped to DAI, which tether can't freeze the receipts: test: etherscan.io/tx/0x7f5d895ce0… fake entry: etherscan.io/tx/0xfc1ea6df12… dust: etherscan.io/tx/0x9780f38b63… loss: etherscan.io/tx/0xc0514a795f… swap to DAI: etherscan.io/tx/0x40c3071839… i reviewed the bot behind that 15:10:11 entry. one pattern kept appearing: the victim wasn't picked, he was swept up. > that one tx faked 22 transfers at once, across 22 different wallets > for 19 of them i found the real transfer it was copying, almost all made in the 4 minutes before > each fake points to a lookalike of that wallet's real recipient > the same bot address sent 106 txs between 08:40 on dec 19 and 02:40 on dec 20 > across them i count 2,150 zero-value fakes aimed at 1,290 different wallets the victim was one row out of 1,290. before you call it a "5 character" scam, check the addresses yourself: real: 0xbaf4b1aF7E3B560d937DA0458514552B6495F8b5 fake: 0xBaFF2F13638C04B10F8119760B2D2aE86b08f8b5 a lot of posts say the first 5 matched. on-chain it's 7 characters total: "baf" after the 0x, plus "f8b5" at the end. they split at the 4th character. many wallet screens shorten addresses to about that much. everyone is focused on the $50M. the next question is what happened after. > by 17:48 utc his history held 9 different 0xbaf…f8b5 lookalikes > fake "USDT" tokens showed 49,999,950 sends to other fakes > the DAI was later swapped to ETH and sent to tornado cash, per slowmist's and bitquery's traces > the victim posted an on-chain bounty offer. i haven't found any report of funds coming back and the method is still running. a large HYPE wallet i looked at today on hyperevm gets a lookalike dust tx 20 to 60 seconds after almost every outbound transfer. i have no evidence it's the same operator. it is the same trick. before you send a big transfer, check these 3 things: > copy the address from where you saved it, never from your transaction history > compare the middle of the address, not just the start and end > treat any zero-value or dust transfer you didn't expect as a sign someone is targeting you your history is the one place in your wallet that someone else can write to.

few will understand just saw this when @0xrahulweb3 caught it first under @Telcier's post. the first name on the @RobinGuards KOL list, FalcoEth, is an empty X account with 0 followers and 0 posts. nobody renamed it. FalcoEth is the Telegram name on the sheet, and the X account listed next to it is @eth_falco if i am not mistaken. so i looked at the KOLs, not the project. 85 accounts that posted the promo, 132 reply threads, 3,022 replies, all pulled from the X API. @eth_falco is the clearest example. his latest $PRD post for @PRDCTR_IO has 43 likes, 37 replies and 0 reposts. 36 of the 37 replies have 0 likes and read like one line of generic praise. 3 of the repliers are on the same Robin Guards KOL sheet, and 8 more also reply under Robin Guards promos. his 8 PRDCTR posts over 8 days add up to 302 likes, 220 replies and 2 reposts. across the list: > 91% of the replies i pulled have 0 likes > 16 accounts replied to 10 or more different KOLs, and 190 of their 197 replies have 0 likes > @TLdn43 and @SaintLee04 posted their promos 4.5 minutes apart and share 26 of the 50 repliers i pulled on each > @MadMagicSOL gets 1.12 replies per like and 166 likes per 1k views. the median across 75 of these KOLs is 26 > @gemtoast, @xenocrypto01 and @KongBTC get almost no reposts on their posts > @BigGabby_001, @Web3CyruX and @FuryMetaa all get close to one reply for every like > one reply under a promo starts with "Here are 4 fresh, organic Twitter reply angles tailored to this post" > one wallet on the sheet is listed against 9 different X accounts with about 2M followers combined and 130k+ posts each the same accounts were posting for other projects in that window too. @BigGabby_001 mentioned bet25com in 10 posts over two weeks. clear warning that it does show patterns consistent with botted or pod engagement

can you consider this as botted? 30+ likes, no RT, but has 40+ likes. Because I believe this pattern is controlled.

These KOLs should be banned on CT forever

holy f*ck. more than $5B left @binance hot wallets on oct 29, and on ethereum it took one signed authorization. @chainalysis puts it at nearly 4x bybit's $1.46B from feb 2025, the previous record. @blockaid_ broke down the mechanism. i checked the txs myself on @ethereum. how the ethereum drain worked (oct 29, times UTC): - 15:59: 0x7c86...5ca0 deploys a sweeper contract, 0x63e8...6fae - 20:20: the same wallet sends one type-4 tx to binance 14 (0x28c6...1d60) with 50 eip-7702 authorizations, one per nonce. binance 14 ends up running the sweeper's code - 20:24: the first sweep moves 1.6B USDT plus RLUSD, WBETH, ENA, PEPE, LINK and more into 0x5227...2f8c in one tx each authorization is signed by the wallet it upgrades, so someone signed with binance 14's key. blockaid says the key was stolen. binance hasn't said how, so the root cause is unconfirmed. 185M XRP also left at 20:05 and @whale_alert flagged BTC outflows at 20:32, and 7702 doesn't exist on those chains. who took action: - @circle froze 823M USDC (21:18) - @tether froze over 1.567B USDT (21:25) - @Ripple is freezing RLUSD (22:08) - @debridge paused BNB chain transfers (22:10) - @aave froze its DAO markets as a precaution (22:44) - @Gemini blocked the exploiter wallets (23:24) - @cryptocom is blocking exploiter addresses (23:24) - the @arbitrum security council froze 74.56M ARB and 8,425 ETH (00:08) - binance paused deposits and withdrawals and says it will cover all losses (00:13) - @FDLabsHQ froze FDUSD (00:57) said not affected: - @ethena: about $8.8M exposure against a $60M+ reserve (21:13) - @SkyEcosystem: USDS and sUSDS unaffected (21:55) - @LidoFinance: stETH not affected (22:33) - @coinbase (22:43), @Bybit_Official (23:05), @krakenfx (23:44) - @JupiterExchange: jupiter lend no exposure (23:53) - @kucoincom (00:33), @MEXC (00:57) no statement yet from @okx, @bitget, @Gate, @HTX_Global, @bitfinex, @BNBCHAIN, @HyperliquidX, @THORChain or @Uniswap. on-chain at 00:59 UTC: i count about $2.52B frozen, and binance says around $3B. not frozen: about 418K ETH, 233M XRP, 970K SOL, plus BTC i've only partly traced (2,000 confirmed, @arkham shows 18.27K). @lookonchain says $5.8B stolen and chainalysis says $5.912B at the time of theft. @peckshield was the first security firm i found flagging it, at 20:55. @zachxbt posted the arbitrum freeze tx. @cz_binance expects users to be fully covered, and @_RichardTeng says withdrawals resume after security checks.

holy f*ck. the @axisrobotics team safe has sent 76.8M AXIS to fresh wallets since oct 13, and almost none of it is still sitting in those wallets. @zachxbt flagged it first. i pulled the @base data myself. 0xfc8c...7dc5 is a 3-of-5 @safe. it received the full 1B AXIS supply when the token was deployed on aug 10. what left it (times UTC): - oct 13: 20M to a second safe that shares 2 of its signers - oct 26 to 28: 56.8M to 11 fresh wallets, most after a 100 AXIS test transfer where it went: - 29.5M to @bitget deposit addresses, each swept into the same bitget-linked wallet within minutes - 47.3M sold on @Uniswap v4, mostly in 5,000 AXIS clips. about 9,600 swaps from oct 29 00:53 to 11:36, for 6.85M USDC gas ties the 7 sellers together. 0x9cdf and 0xfc96 got ETH from the same @okx hot wallet. the other five got ETH from wallets inside the same group. the second safe sent its 20M to 0xcc27 and 0x6661 on oct 29. the main safe had sent both of them a 100 AXIS test the day before. zach's 8 wallets hold 5.06M USDC. three more fresh wallets hold another 1.78M (1M, 440K, 340K), sent from 0x4ef7 and 0xcc27. none of the 6.84M has moved yet. the same safe also moved 835M AXIS into another contract on oct 15. that one hasn't moved. AXIS is down 34% in 24h on @coingecko as of 14:03 UTC. axis hadn't replied publicly as of 14:11 UTC. their last post went up oct 28 08:14 UTC. the chain can't say who owns these wallets or if this was a disclosed allocation. it does show the safe that holds the supply paid them, 8 days after TGE.

too big to ignore.

followed the zklink nova attacker's money. the gas came from fixedfloat, and the cash-out is going back to the same fixedfloat wallet. the @zkLinkNova bridge on ethereum (@zkLink_Official) was drained earlier today, about $783k (@SlowMist_Team flagged it first). here's what the chain shows: - the attacker wallet 0xaca0...5718 got its only gas, 0.027 ETH, from a @FixedFloat hot wallet 6.5 hours before the drain. - one tx drained the L1 escrow and the ERC20 bridge. 245.7 pufETH (@puffer_finance) was about 80% of the haul. - within 40 minutes it swapped the tokens and split ~303 ETH across 3 fresh wallets. the 3 wallets swapped most of it into DAI, which has no freeze function. they still hold 702k DAI. - 4 one-time wallets then took 2 to 5 ETH each and passed it to that same fixedfloat hot wallet in under 2 minutes. 17 ETH so far. - the same hot wallet gassed the X100 attacker 5 minutes before its oct 24 drain. - 3h22m after the first drain, a second wallet, 0xdab1...f8c8, hit the same bridge and took 216.4M ZKL (21.6% of supply). on oct 24 that wallet sent the tx that pulled 549,915 X out of the X100 treasury. the ZKL hasn't moved. fixedfloat is a shared exchange wallet, so this doesn't prove one operator. it does mean the gas and the cash-out both run through one exchange's wallet. the root cause comes from slowmist. zklink hasn't confirmed it yet.

slowly then all at once

checked the tx. this wasn't a trust wallet exploit, and it wasn't a fat-finger send either. he says 915.50 USDT left a trust wallet on BNB Chain. here's what the chain shows: - a plain USDT transfer() signed by the wallet's own key. no approval and no contract pull, so revoking approvals wouldn't have stopped it. - before the drain, 0xab3d...942c funded the wallet's gas twice. one top-up was the exact cost of this tx (41,434 gas x 0.055 gwei). - the same funder topped up 4 other wallets. each one sent tokens to the same address, 0x7c97...fcef, within 40 seconds. - that night 0x7c97 sent 7,556 USDT to a TRON address through a cross-chain swap. - the "U5DT" spam came after the drain. those are fake tokens imitating the drainer's address, not the cause. so a sweeper bot had this key. the chain can't show how the seed leaked. if this happens to you, move what's left to a new seed. ignore "support" replies that offer recovery.

Self-custody has always had an ugly edge case: what happens to the coins when the holder dies. Share the seed phrase early and you've given up control while you're alive. Keep it to yourself and the funds can end up lost for good. Kyvora Legacy is on the roadmap to close that gap. You set an heir and a waiting period, using the wallet resets the timer, and access only passes on if it sits untouched past the limit. The keys stay yours until then.