Degen Protocol™@Degen__Protocol
🚨 PITEAS SYNDICATE INVESTIGATION 🚨
Last night, I was hit for $200 by a manual drainer wallet (0xEc361b8B61D865530fEe9B3866c9B07cbd2dF21d). I don't care about the 200 bucks. But tracing that wallet sent me down a rabbit hole analyzing PulseChain routing contracts.
What I found hiding inside Piteas is terrifying. 🧵👇
2/19 🛑 The Catalyst
While investigating the wallet that hit me, I stumbled onto a massive, systemic drain. Millions in $PLS & $pDAI have been siphoned from PulseChain users over the last year.
The Piteas team claims victims used 'cracked VPNs' or clicked 'phishing links'. So I brought in the AI.
3/19 🛑 The Incident Timeline
I ran the on-chain data of a specific victim (a friend) through 7 different AI models.
This user swapped for $pDAI and $BEAR last year via Piteas. The wallet sat untouched for months. On Jan 14, 2025, it was completely drained. The path pointed directly to Piteas.
4/19 🛑 The Developer Response
On Jan 17, I reached out to the Piteas devs to report the breach.
The response was immediate deflection: "They used PulseSwap, not Piteas. Unrelated to us. Their private keys must be compromised."
5/19 🛑The "Compromised Key " Theory vs. Reality
If a seed phrase is compromised, drainer bots instantly sweep all assets in a single block.
However, the attacker in this case executed the drains at a human cadence (~15 minutes per transaction). This indicates manual UI interaction, not a key leak.
6/19 🛑 The Friend's Attacker Wallet
The specific wallet responsible for manually draining my friend's funds on Jan 14:
lightbeam.xyz/address/0x598f…
The slow execution time directly contradicts the dev team's initial 'phished key' dismissal.
7/19 🛑 The Malicious Proxy
Forensic analysis reveals the stolen swaps were forcefully routed through a malicious proxy contract.
Proxy Address:
lightbeam.xyz/address/0x967c…
8/19 🛑 The Multi-Chain Syndicate
The wallet that deployed this proxy is a central hub.
Deployer:
lightbeam.xyz/address/0x8831…
Our AI analysis indicates suspected multi-chain activity from this Deployer on BSC, Arbitrum, Base, and Optimism, pending final cross-chain verification.
9/19 🛑 The Routing Vulnerability
How does a multi-chain malicious proxy intercept swaps on Piteas?
Piteas utilizes an unverified, closed-source `SwapManager` contract. Because it is a black box, users cannot verify the actual routing logic they are interacting with.
10/19 🛑 The Admin Privilege
Leaked developer Telegram logs reveal an admission from the Piteas team that their Router contains a `changeSwapManager` admin function.
This function allows an admin to arbitrarily swap the core routing logic without a timelock.
11/19 🛑 The Point of Failure
Using the `changeSwapManager` function, the protocol's routing logic was altered to point directly to the multi-chain syndicate's malicious proxy.
This is the mechanical cause of the drain.
12/19 🛑 The Sovereign Council Rating
I submitted this entire forensic dossier to the Sovereign Council AI. Their official rating on the likelihood of the Piteas team's direct complicity?
**6 / 10**
AI forensic analysis rated internal compromise likelihood at 6/10, pending cross-chain deployer confirmation.
13/19 🛑 Unanswered Questions
We are not making direct accusations of malice. However, the data proves this was not a simple "user clicked a phishing link" scenario.
Either the admin keys ARE compromised by external hackers, or there is gross negligence in protocol security.
14/19 🛑 Community Demands
The PulseChain community deserves transparency, not dismissal in the DMs.
We request:
1. Open-source the `SwapManager`.
2. Provide a full post-mortem on the `changeSwapManager` execution.
3. Secure the admin privileges.
15/19 🛑 AI Consensus
This conclusion wasn't reached lightly. 7 different LLMs independently reviewed the transaction hashes, contract states, and DM transcripts.
All on-chain data was queried directly from my own private, bare-metal Erigon RPC node (rpc.degenprotocol.io) to guarantee absolute data integrity.
All 7 models arrived at the exact same conclusion. Don't trust people. Trust the code.
16/19 🛑 Protect Yourself
I have been in crypto for 9 years using the exact same wallet without a single hack. The ONLY time my security was breached was when I clicked 'Approve' on Piteas. I only used them because I hadn't built my own aggregator yet.
Until transparency is provided, we advise the community to revoke all Piteas approvals immediately via revoke.cash.
Never blind-sign transactions on closed-source routing contracts.
17/19 🛑 Free Thinkers
Do your own research. Richard Heart taught us to be free thinkers. If you blindly trust unverified contracts, you're a sheep. I'm a blacksheep.
Even if I'm completely wrong, this research was fun to do and perfectly demonstrates the incredible possibilities of AI and Blockchain technology combined.
18/19 🛑 The Sovereign Response
If this is how closed-source projects are going to operate in our space, then Degen Protocol will just launch our own zero-fee aggregator (GOAT Swap) to show them how real security is achieved on an almost free protocol.
(We already built a free Pulsechain-to-Base bridge launching this month, so this is on our to-do list).
19/19 🛑 Final Warning
Trust the code. Not the people.
I usually stay in my own lane, but I'm done staying quiet while this community gets played. If I see bullshit, I'm calling it out.
Signed,
Crypto Blacksheep
*(Powered by Ghost A.I. / Degen Protocol Command Center)*
Sorry about the technical difficulties... 🤣