{"items":[{"id":20654,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":377,"url":"https://t.me/investigations/377","date":"2026-11-08T11:05:26+00:00","edited_at":null,"text":"NEW: The US Treasury sanctioned eight Canadian OTCs on Friday (Nov 6), including Nia Nations (NNCE) & Million Exchange (MillionEX), five months after I replied to them on X suggesting they sanction the Iranian OTC brokers in Canada being abused by illicit actors.\n\nAs I've stated before, Canada is a bottom-three jurisdiction globally with rampant abuse due to ineffective laws.","html":"<strong>NEW: The US Treasury </strong><a href=\"https://home.treasury.gov/news/press-releases/sb0686/\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>sanctioned</strong></a><strong> eight Canadian OTCs on Friday (Nov 6), including Nia Nations (NNCE) &amp; Million Exchange (MillionEX), five months after I </strong><a href=\"https://x.com/zachxbt/status/2061976572031373709\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\"><strong>replied to them </strong></a><strong>on X suggesting they sanction the Iranian OTC brokers in Canada being abused by illicit actors.</strong><br><br>As I've stated before, Canada is a <a href=\"https://t.me/investigations/359\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">bottom-three jurisdiction</a> globally with rampant abuse due to ineffective laws.","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426434","deleted":false,"deleted_at":null,"views":3046,"forwards":43,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["home.treasury.gov","treasury.gov","x.com","t.me"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/p4g9rGwSIgFM","duration":null,"width":918,"height":1358,"preview":false}],"link_preview":null,"album":null,"topic":"news_general"},{"id":19789,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":375,"url":"https://t.me/investigations/375","date":"2026-11-04T02:24:37+00:00","edited_at":"2026-11-04T02:29:29+00:00","text":"Update 2: Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets.\n\nThe attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity.","html":"<strong>Update 2: Disclosing the EU financial institution exploited for $133M+ is allegedly Credit Mutuel Arkea, a French bank with $235B in assets.</strong><br><br>The attack on the bank occurred for multiple days. I suspect the amount stolen is larger when accounting for OTC activity.","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426230","deleted":false,"deleted_at":null,"views":4292,"forwards":114,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":19552,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":374,"url":"https://t.me/investigations/374","date":"2026-11-03T07:31:15+00:00","edited_at":"2026-11-03T07:32:26+00:00","text":"Update: I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident.\n\nA portion of the CEX withdrawals occurred after my initial disclosure.\n\nMy working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up.\n\nNo proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement.\n\nTheft addresses:\n0x5cf70edce65847ef989933c3072fb0e7f335abc1\n0xe378cdccb369a64a0190577787ef61ca2eefa6b2\n0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2\n0x99d314e6970b8d3db0dbe6f6e041cc904143400f","html":"Update: I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to <strong>$133M+ for the incident.</strong><br><br>A portion of the CEX withdrawals occurred after my initial disclosure.<br><br><strong>My working theory is a large financial institution in Western Europe was exploited and it’s currently being covered up.</strong><br><br>No proper incident disclosure has resulted in $30M+ being laundered away which could have been frozen by EU law enforcement.<br><br>Theft addresses:<br><code>0x5cf70edce65847ef989933c3072fb0e7f335abc1</code><br><code>0xe378cdccb369a64a0190577787ef61ca2eefa6b2</code><br><code>0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2</code><br><code>0x99d314e6970b8d3db0dbe6f6e041cc904143400f</code>","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426186","deleted":false,"deleted_at":null,"views":1797,"forwards":31,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0x5cf70edce65847ef989933c3072fb0e7f335abc1","0xe378cdccb369a64a0190577787ef61ca2eefa6b2","0x3e6c3d135ca8f8be793e5fe1715ce6c057d140f2","0x99d314e6970b8d3db0dbe6f6e041cc904143400f"],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":19390,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":372,"url":"https://t.me/investigations/372","date":"2026-11-02T12:28:49+00:00","edited_at":"2026-11-02T12:39:40+00:00","text":"Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor.\n\nOver the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.\n\nWhile the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators. \n\nTheft addresses:\n0xADd95cD98E0288ba69785E3151E1db86adF8Dd58\n0x29e9D7715D935e0D0D4B0DD0efC952A97E551020\n0x378B4f150707C283574DC89739608D29036D57d5\n0x795a9d22F233024487161Fe6daFf73397c162621\n0x730Bcb1296758c377149d7409f98f041cf723992\n0x12D9012731eb0D54871A31Af5566Eb9ECCa351Db\n0x5A154f77852ed274Fd6F4c324a1Ee27809052FF7\n0xA1096A66f9ed58A9594A6A1ad67A5472C0907224\n0x90F0b6D51ed2FE2348A45b2C49BC441E959bc557\n0x8A97BC406180e28b11C5495fA099BF5119c6C6B0\n0xd010cba790a6ab0048da18f2fbe8e3faf463a16a","html":"<strong>Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts</strong> <strong>yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC &amp; USDT by an illicit actor.</strong><br><br>Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.<br><br>While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators. <br><br>Theft addresses:<br><code>0xADd95cD98E0288ba69785E3151E1db86adF8Dd58<br>0x29e9D7715D935e0D0D4B0DD0efC952A97E551020<br>0x378B4f150707C283574DC89739608D29036D57d5<br>0x795a9d22F233024487161Fe6daFf73397c162621<br>0x730Bcb1296758c377149d7409f98f041cf723992<br>0x12D9012731eb0D54871A31Af5566Eb9ECCa351Db<br>0x5A154f77852ed274Fd6F4c324a1Ee27809052FF7<br>0xA1096A66f9ed58A9594A6A1ad67A5472C0907224<br>0x90F0b6D51ed2FE2348A45b2C49BC441E959bc557<br>0x8A97BC406180e28b11C5495fA099BF5119c6C6B0<br>0xd010cba790a6ab0048da18f2fbe8e3faf463a16a</code>","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/426145","deleted":false,"deleted_at":null,"views":13236,"forwards":297,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0xadd95cd98e0288ba69785e3151e1db86adf8dd58","0x29e9d7715d935e0d0d4b0dd0efc952a97e551020","0x378b4f150707c283574dc89739608d29036d57d5","0x795a9d22f233024487161fe6daff73397c162621","0x730bcb1296758c377149d7409f98f041cf723992","0x12d9012731eb0d54871a31af5566eb9ecca351db","0x5a154f77852ed274fd6f4c324a1ee27809052ff7","0xa1096a66f9ed58a9594a6a1ad67a5472c0907224","0x90f0b6d51ed2fe2348a45b2c49bc441e959bc557","0x8a97bc406180e28b11c5495fa099bf5119c6c6b0","0xd010cba790a6ab0048da18f2fbe8e3faf463a16a"],"domains":[],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pJRBrG0lTQFM","duration":null,"width":2552,"height":1328,"preview":false}],"link_preview":null,"album":null,"topic":"news_general"},{"id":18712,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":371,"url":"https://t.me/investigations/371","date":"2026-10-30T00:15:20+00:00","edited_at":"2026-10-30T00:26:00+00:00","text":"BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.  \n\nExploiter address \n0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5\n\nTrsanction hash: 0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb6\n0x410af166c81f9c0f26cc19b4d970c984f526225eeea2aea169179856fd615f70","html":"BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.  <br><br>Exploiter address <br><code>0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5</code><br><br>Trsanction hash: <code>0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb6</code><br><code>0x410af166c81f9c0f26cc19b4d970c984f526225eeea2aea169179856fd615f70</code>","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425986","deleted":false,"deleted_at":null,"views":7215,"forwards":131,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0x3e2bf1ac6bf0934bbba6456c341c2ecbced632d5"],"domains":[],"media":[],"link_preview":null,"album":null,"topic":"news_general"},{"id":18321,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":370,"url":"https://t.me/investigations/370","date":"2026-10-29T12:17:46+00:00","edited_at":"2026-10-29T12:48:06+00:00","text":"Community Alert: Axis Robotics (AXIS) insiders received 76M+ AXIS ($12M+) from a Axis Team multisig and began market selling via DEX and transferring AXIS to Bitget causing the price to crash 40% over the past 24 hours. \n\nThe AXIS token went live on October 21, 2026.\n\nA single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base:\n0xcc279c2499bcf4bd0f169c2d3f333243473242f7\n0x66612012c5ad9b2fed81d09a9ab429b5285b2c62\n0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0\n0x99cd3975c90b79ffdbe16425de033a605b814c49\n0xbbed67fec9c7793218fa60c40fb9e6b059d86483\n0xe69d8d6b9b7f9056eda455b76384e9748749f4d1\n0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d","html":"<strong>Community Alert: Axis Robotics (AXIS) insiders received 76M+ AXIS ($12M+) from a Axis Team multisig and began market selling via DEX and transferring AXIS to Bitget causing the price to crash 40% over the past 24 hours. </strong><br><br><strong>The AXIS token went live on October 21, 2026.</strong><br><br>A single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base:<br><code>0xcc279c2499bcf4bd0f169c2d3f333243473242f7<br>0x66612012c5ad9b2fed81d09a9ab429b5285b2c62<br>0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0<br>0x99cd3975c90b79ffdbe16425de033a605b814c49<br>0xbbed67fec9c7793218fa60c40fb9e6b059d86483<br>0xe69d8d6b9b7f9056eda455b76384e9748749f4d1<br>0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d</code>","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425908","deleted":false,"deleted_at":null,"views":9157,"forwards":204,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0xcc279c2499bcf4bd0f169c2d3f333243473242f7","0x66612012c5ad9b2fed81d09a9ab429b5285b2c62","0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0","0x99cd3975c90b79ffdbe16425de033a605b814c49","0xbbed67fec9c7793218fa60c40fb9e6b059d86483","0xe69d8d6b9b7f9056eda455b76384e9748749f4d1","0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d"],"domains":[],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pkw5rG4yQIFM","duration":null,"width":1750,"height":1446,"preview":false}],"link_preview":null,"album":null,"topic":"news_projects"},{"id":16667,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":369,"url":"https://t.me/investigations/369","date":"2026-10-21T07:26:39+00:00","edited_at":"2026-10-21T07:27:27+00:00","text":"An institutional entity lost ~$2.3M (973K MORPHO) a few hours ago from two addresses and the funds were deposited to Tornado Cash:\n0x4943b0c9959dcf58871a799dfb71bece0d97c9f4\n0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4\n\nOn Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges stolen, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool:\n0x24a9e00be5f169142c4f0797b41dacdf807d3e63\n\nBoth thefts from 0x4943 & 0x10bf involve EIP-7702 delegation transactions. \n\n0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which reportedly lost eight figures due to a private key compromise in Sep 2023, after which the family office allegedly exited crypto.","html":"An institutional entity lost ~$2.3M (973K MORPHO) a few hours ago from two addresses and the funds were deposited to Tornado Cash:<br><code>0x4943b0c9959dcf58871a799dfb71bece0d97c9f4<br>0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4</code><br><br>On Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges <a href=\"https://x.com/Phalcon_xyz/status/2108764415692771530\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">stolen</a>, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool:<br><code>0x24a9e00be5f169142c4f0797b41dacdf807d3e63</code><br><br>Both thefts from 0x4943 &amp; 0x10bf involve EIP-7702 delegation transactions. <br><br>0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which <a href=\"https://blockworks.com/news/synapse-nima-capital-liquidity-provider-unusual\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">reportedly lost eight figures</a> due to a private key compromise in Sep 2023, after which the family office allegedly exited crypto.","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425502","deleted":false,"deleted_at":null,"views":4379,"forwards":55,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0x4943b0c9959dcf58871a799dfb71bece0d97c9f4","0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4","0x24a9e00be5f169142c4f0797b41dacdf807d3e63"],"domains":["app.blocksec.com","blocksec.com","stuckfunds.eth","x.com","blockworks.com"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/pxg9rGykswFI","duration":null,"width":2482,"height":1094,"preview":false}],"link_preview":null,"album":null,"topic":"news_general"},{"id":16651,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":368,"url":"https://t.me/investigations/368","date":"2026-10-21T05:45:27+00:00","edited_at":"2026-10-21T05:45:54+00:00","text":"An institutional entity is suspected to have lost ~$2.84M to DPRK-linked SquidSquad on October 8, 2026 on BSC.\n\nYesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses.\n\nTornado withdrawal addresses:\n0xb8b25f535a6e51d0b18c48941d791c7e83559d2b\n0x35c72e26f6888b4cba8668c6cfa4143599680bfe\n0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848\n\nFrom there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at:\nTEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU\nTVxzjnx3GPDTciiuagXPaUbU5f5y13Voux\n\nBoth consolidation addresses have exposure to previously attributed DPRK addresses.\n\nWithin minutes, the funds moved through intermediary addresses to Chinese OTCs, likely to evade any potential Tether freeze.\n\nVictim address:\n0x579be84d2a0f7bcfc34b4b3883153adec84ff153\nTheft address:\n0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80","html":"<strong>An institutional entity is suspected to have lost ~$2.84M to DPRK-linked SquidSquad on October 8, 2026 on BSC.</strong><br><br>Yesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses.<br><br>Tornado withdrawal addresses:<br><code>0xb8b25f535a6e51d0b18c48941d791c7e83559d2b<br>0x35c72e26f6888b4cba8668c6cfa4143599680bfe<br>0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848</code><br><br>From there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at:<br><code>TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU<br>TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux</code><br><br>Both consolidation addresses have exposure to previously attributed DPRK addresses.<br><br>Within minutes, the funds moved through intermediary addresses to Chinese OTCs, likely to evade any potential Tether freeze.<br><br>Victim address:<br><code>0x579be84d2a0f7bcfc34b4b3883153adec84ff153</code><br>Theft address:<br><code>0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80</code>","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425496","deleted":false,"deleted_at":null,"views":6399,"forwards":49,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0xb8b25f535a6e51d0b18c48941d791c7e83559d2b","0x35c72e26f6888b4cba8668c6cfa4143599680bfe","0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848","0x579be84d2a0f7bcfc34b4b3883153adec84ff153","0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80","TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU","TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux"],"domains":[],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/prw9rGykswFI","duration":null,"width":2560,"height":432,"preview":false}],"link_preview":null,"album":null,"topic":"news_general"},{"id":16474,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":367,"url":"https://t.me/investigations/367","date":"2026-10-20T12:05:05+00:00","edited_at":"2026-10-20T12:05:19+00:00","text":"A new centralized laundering service FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026. More than 87% of its inflow volume is tied directly to illicit activity.\n\nA manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents, including:\n• DCENT Wallet exploit (Sep 2026)\n• Fetch[.]ai exploit (Sep 2026)\n• Axelar exploit (Sep 2026)\n• Unnamed ransomware payment (Sep 2026)\n• Gamdom exploit (Oct 2026)\n\nThe admin sources XMR liquidity from KuCoin, with 3K+ deposits to KuCoin, and likely uses a swap model similar to Wagyu's.\n\nThe FXMR ticker was bought in an HL auction on July 27, 2026 for 518.28 HYPE ($28K).\n\nHL Core has seen several centralized laundering services, such as b1exch, abuse the chain’s permissionless design and adoption.\n\nA spreadsheet with source data has been shared with the HL team.\n\nFXMR hot wallet\n0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2\nFXMR admin\n0x1b7fb7709b146d74aad0b2b853bc741d8885bdb2\n0x06ecb2a427c3d51a66c29d9b4fb1960107d10b19\n0xecbb61b2aabd32da2082acd989218b0911b79406","html":"A new centralized laundering service FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026. <strong>More than 87% of its inflow volume is tied directly to illicit activity.</strong><br><br>A manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents, including:<br>• DCENT Wallet exploit (Sep 2026)<br>• Fetch[.]ai exploit (Sep 2026)<br>• Axelar exploit (Sep 2026)<br>• Unnamed ransomware payment (Sep 2026)<br>• Gamdom exploit (Oct 2026)<br><br>The admin sources XMR liquidity from KuCoin, with 3K+ deposits to KuCoin, and likely uses a swap model similar to Wagyu's.<br><br>The FXMR ticker was <a href=\"https://hypurrscan.io/tx/0xfd78058387f7e753fef10440d9547002017f006922fb0626a140b0d646fbc13e\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">bought</a> in an HL auction on July 27, 2026 for 518.28 HYPE ($28K).<br><br>HL Core has seen several centralized laundering services, such as b1exch, abuse the chain’s permissionless design and adoption.<br><br>A spreadsheet with source data has been shared with the HL team.<br><br>FXMR hot wallet<br><code>0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2</code><br>FXMR admin<br><code>0x1b7fb7709b146d74aad0b2b853bc741d8885bdb2<br>0x06ecb2a427c3d51a66c29d9b4fb1960107d10b19<br>0xecbb61b2aabd32da2082acd989218b0911b79406</code>","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425446","deleted":false,"deleted_at":null,"views":8063,"forwards":135,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":["0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2","0x1b7fb7709b146d74aad0b2b853bc741d8885bdb2","0x06ecb2a427c3d51a66c29d9b4fb1960107d10b19","0xecbb61b2aabd32da2082acd989218b0911b79406"],"domains":["hypurrscan.io"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/psRBrGyksuFI","duration":null,"width":2560,"height":1032,"preview":false}],"link_preview":null,"album":null,"topic":"news_general"},{"id":15761,"channel":{"id":112,"username":"investigations","title":"Investigations by ZachXBT","kind":"channel","private":false},"message_id":366,"url":"https://t.me/investigations/366","date":"2026-10-15T18:07:15+00:00","edited_at":null,"text":"Update: A few hours ago UAE law enforcement published a press release confirming legal action against multiple cybercriminals with $54M+ seized and 33 arrests. \n\nSocial engineering threat actors such as Danish Zulfiqar (Danny), Ibrahim Mustafa (Krust), & Cameron Cureton (CX) were all featured in the video posted.","html":"Update: A few hours ago <a href=\"https://x.com/shjpolice/status/2110655954417258752\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">UAE law enforcement published</a> a press release confirming legal action against multiple cybercriminals with $54M+ seized and 33 arrests. <br><br>Social engineering threat actors such as <a href=\"https://x.com/zachxbt/status/1998267579136455090\" target=\"_blank\" rel=\"noopener noreferrer nofollow ugc\">Danish Zulfiqar</a> (Danny), Ibrahim Mustafa (Krust), &amp; Cameron Cureton (CX) were all featured in the video posted.","language":"en","class":"approved","duplicate_of":null,"secondary_of":null,"in_aggregator":true,"aggregator_url":"https://t.me/WEB3_AGGREGATOR/425260","deleted":false,"deleted_at":null,"views":9446,"forwards":295,"sender_id":null,"cashtags":[],"hashtags":[],"addresses":[],"domains":["x.com"],"media":[{"type":"photo","url":"https://media.web3aggregator.io/files/p5Q5rGzQciFI","duration":null,"width":880,"height":1280,"preview":false}],"link_preview":null,"album":null,"topic":"news_general"}],"next_cursor":null}