OJE

Two days ago, @HermetixWeb3 was a victim of a popular social engineering scam called pig butchering where victims are lured to share confidential information with the threat actor over a call after being sent funds prior to build trust. I spent the past few days digging on chain to trace where the funds went. Here’s what I found👇

@zinceth @phantom Could you share the addresses so I can have a look

breh I downloaded phantom on my phone and it opened with a fresh wallet already there so i thought it was all good to go send money to that shit and turns out its a wallet im watching not my wallet???? how the fuck bro rip my money fix ur shit @phantom

@LowHash I tried to ask yesterday, could you please share all the compromised addresses? I’d love to take a closer look

Original tweet & one other was deleted by scammers before I was able to reclaim control of my Twitter. I was scammed for over 500k yesterday, most of what I have. Malware & social engineering. Resharing for awareness, or for anyone that can help.

@MOONjob8 @jhaninvest hey mate, can I dm you?

@jhaninvest 伟大！伟大！

说个搞笑的事，那时候群里每个人都比我多筹码，我压根连前100名都买不进去。群里让大家晒自己的持币，不然谁信你来建设的，我感觉我太丢人了，还让大户朋友的地址借我用下。 感觉我每次建设一个项目，我都是最小的那个人。想起以前 raca 的时候，我是那个银河战队的队长，就是那个元兽战队，开到微信三个群的那个。 那时候我只有12只N元兽，别的大户都是几百只，还有R兽啥的，我得管理快3000只元兽，那时候都是散户组成的群，每周还得计划战略。 12只元兽当啥战队长啊？不过最后也搞的挺好，八周结束一个大户还给我打了几千u红包，感谢我的努力。我感觉我特别适合那种默默付出，不断坚持的岗位，虽然很累而且不赚钱。 看着 Asteroid 涨起来，变成全市场瞩目的代币，真的就像 P董说的，我的孩子长大了，但是孩子大了留不住，属于我和孩子的时间越来越少。 这个市值已经不是几个人可以撼动的了，现在 Asteroid 已经不再属于 CTO 不再属于任何人，每个人都是一颗小行星。 当初我们的想法也实现了，让所有人有机自动的讨论宣传，三五好友自己成群活动，开心且发自内心的推广 Asteroid 故事给每一个人。 每一个人都是组织者，就像买Asteroid 玩偶，每个地区都是这样，有人号召有人响应，同时有无数条进行中的建设，我们的社区就是这样做起来的。 P董是最关键的伟人，我觉得你们应该追踪他，记得好像还有个 charity 帐号，他专门做慈善叙事的时候，常常在上面聊 Asteroid 的叙事和想法。

@SpecterAnalyst Great work mate

I spent the entire day tracing the KelpDAO stolen funds by DPRK, specifically the TraderTraitor group. At 07:39 UTC, laundering began—just three hours after the Arbitrum Council froze 30.7 ETH (~$71M). The attacker split the remaining funds into three wallets: 0x62c72510016732333e68177d388a8111643FC64E - 25K ETH (~$57.6M) 0xD4B87bAB0ee142182f7F6DA030AeFe3E7f171530 - ~25.7K ETH (~$59.2M) 0xF9802c5EB6b972Ba686aFa7CA615910Ea8310b85 - 25K ETH (~$57.9M) The first two wallets are still holding funds, while the third began laundering immediately after receiving them and now holds ~3.8K ETH (~$8M). The funds were bridged to the Bitcoin network, with ~99% flowing through THORChain. THORChain’s swap volume today reached $211M, Over 10x its 30-day daily average, generating ~$189K in fees. During laundering, the funds were commingled with proceeds from other DPRK-linked incidents, including the BTC Turk (2025) and Bybit (2025) hacks: bc1qt3fxzwgqayqgukgr6ny5ns9vpdpcgt72f6wwfs 0xF585F57c93e4FB8ea97D9E8E6310354Bbc4DEfb9 Tracing the flows, a total of 442 BTC (~$33M) currently on the Bitcoin network across multiple wallets. This excludes funds still pending confirmations or withdrawals. Over 400 addresses have been used so far in the laundering process. I have 356, excluding several intermediary wallets not included. DPRK remains a major threat to the ecosystem. When actions like the Arbitrum Council’s intervention occur, they should be recognized for the difficult but necessary decisions they made. As for THORChain, we saw the same pattern during the Bybit hack, so nothing different should be expected. JP will likely use this moment to draw attention and appear in interviews discussing how the protocol was used to launder illicit funds. Stay smart

@LowHash Are there any other compromised wallets? I’d be happy to look into it for you

Both of these wallets were drained: Sol - RHgEJ3WAozxqjBsRkHxERv1t5z59tFFdSQG7sGXSvKb HyperEVM - 0xd3EE73F2b06af13D8aE43f58d9AC5330ee1ff51e Everything gone.

@aparjey @cobie @CoinbaseSupport How about on the Coinbase end? + would you want me to dig deeper into the txs?

@oneOJE @cobie @CoinbaseSupport nah, looks like they used services to monero it out

I believe I just fell for a coinbase phising scam and they took 300k from my coinbase account @cobie @CoinbaseSupport CAN SOMEONE PLEASE HELP ME MAN

@0xQingWu 0x7a8b82fdee11e9786d8e5274d42e076417dc9038

970 Wallets Added . Biggest retail airdrop . Max airdrop cap ? not sure Will add more wallets for the next 24 Hours

@aparjey @cobie @CoinbaseSupport any luck with this mate? @aparjey

Summary of the funds movement so far. Hope this helps Bridged to sol and transferred to HTX(~30k): EeSsaZfA8wAbbVDSigVuseW6Auo1VZ6LbLJ3KqLK1oVs 9PgErS8AJenpq6sLraiygYby34nM1gMaRWsP71GJXPTS G18Q5Ep4DC4SvZ32RVDh5sJAgzJRqDVfRq1iegMYjrY2 $130k sitting here: 0x7dfe8a574AA63A54842324BAFBc13e092E97f24E ~$90k cashed out through the following binance deposit addresses: 0x4722a4cDAD7D133d7a25f519FcD9Ba23B2dF0115 0x5A3A3A80ebC0B3102fd0de047AD4942485Fa41ca 0x10Af437Eb75b22109E4f5784F521E0d2f5eFBfD8 0xec8fc575eb1AB72E6f06254439E71010CFBbE9D6 $5k sitting here: 0x59Ef3fA3ce8993acfAAE032feD9F03F2568668E8

@0xwt_ Dream

logging off (trading) to go enjoy life hit an incredibly lucky sequence of trades on asteroid I only identify as a buyer for 2027 at these levels (ok I started typing this as I bid but the price has changed) going to check out norway, germany, france, hungary, greece and neighbouring mayb

@fibonacki @lemz100x Use this brodie. Should make it easier/cheaper

@lemz100x yea I'll just multisend but it's still alot of gas fees

so yeah 3.2k addresses 1.35 million unc tokens this tweet is going to cost me over $11,000 + around 10 SOL in fees let's rock (once I find a way to filter addresses)

Tbh, it didn’t really end with that wallet as at final review, but the research spanned a few days, and as at the time of covering that, the funds still sat in that wallet. The graph has the updated version of the movement. The NFT wallet transferred funds to the same ETH address as the first Fixedfloat wallets on Solana.

@oneOJE @zachxbt Great... The Ethereum shouldn't end... He sold the nft, you can continue tracing the funds that were paid for the nft Keep growing... Weldone

While numbers are just figures, this milestone represents something deeper; consistency, commitment, and the real impact of exposing crime in the space. Congratulations @zachxbt on hitting 1M followers. Thank you for everything you’ve done for the community and for individuals like me who have learned a lot from your work.

@zachxbt @krakenfx @Payward Kraken also at the crime scene in the research I conducted few days ago x.com/oneoje/status/…

Why did Kraken list $M (Memecore) on July 3, 2025 for spot and how did it pass due diligence? $7.9M in suspicious Kraken withdrawals to 18 newly created addresses with 11.7 $M sitting total (valued at $39.8M now). Insiders have manipulated the price to $6B market cap ($18B FDV) and Kraken is one of the few venues that supports $M spot. In recent posts the only achievement the team has shared is $66M total volume on a launchpad and thousands of “users” from its incentivized InfoFi campaigns. Suspected Memecore team address 0x6f1f0a1ccc76d2d292249b19c19e401f0e843ba9 (received 200M M at TGE) sent 5.3M $M to Kraken deposit addresses on July 3, 2025 0xaa1f9fa46177aca98f5f433d88fe6d21d029c4a6 & 0x0ca854724259770a62dd623b6e9bce0151c79fa7 Kraken withdrawal addresses 0x4207e505c0dbab1e0d80a76a9ed42ef7b12bea17 0xba64b15f8afb9316b656ebdc19463786f33792d2 0x71dc4397b40055432be9f0e904681b151bec6eb0 0xacd7ec923efc5ff10ba1ddbe521b1a5536a1d70a 0x75ac45467d7df5bff47139af3887e408005ef637 0xfe28d786f007a5d5abd46e447e5758a20916a7d6 0x81475797b4b5d930a115ecd85a2c36cbc956a4f0 0x79d4411bba21289bb728f35221478e1b4eda1c96 0xdb0b0ab84b7e688db809379e8e8e70c020f7d0b2 0x94044c87aee7433725c13798816ab751ef6db9d7 0x7ca8c28c5e4e61c54ecf2631a43e37f88c589d61 0x067c40852576438c81b3649d8fec3d8d7ab27208 0xe2ef6d412a60a91af4e4f37db3efb6971099d98b 0x2c0365ef67c20cc9177e004b43a2d51ace28b5cb 0xaeee0e6b84e24431c1cf1424322e318debc67974 0x45039d2c98a3c7c1e2593dda1e77360e335c5aca 0x0b38bb1558f63c2b36382edd2385674b07697c59 0xff4cd9c291379a72e9efa3ee0f8e10ab51601575

Protecting clients isn't just a regulatory obligation. It's how we operate. @Payward supported Operation Atlantic — a coordinated global effort that identified $45M+ in suspected criminal proceeds and 20,000+ potential victims 👇blog.kraken.com/product/securi…

@krakensupport do have a look

Analysing the 0x98...1780 wallet even further paints a pretty grim picture, 1.8m dollars in withdrawals from Kraken since December 22nd, 2025. A bulk of that is most likely stolen funds from other victims. The threat actor has established a multi 7 figure social engineering empire. Everyday that wallet stays active, someone else loses money. Hopefully this gets resolved as soon as possible.

Two days ago, @HermetixWeb3 was a victim of a popular social engineering scam called pig butchering where victims are lured to share confidential information with the threat actor over a call after being sent funds prior to build trust. I spent the past few days digging on chain to trace where the funds went. Here’s what I found👇

@PhatFookSzn @HermetixWeb3 Appreciate you bro

@oneOJE @HermetixWeb3 Dope workz bro! Mad respect

@zachxbt Hey Zach, spent a bit working on this, do have a look and let me know what you think. Any feedback is highly appreciated x.com/oneOJE/status/…

A summary of the RAVE -95% price fluctuation from $26 to $1 over the past 24 hours. RAVE Timeline: April 18, 2026 7:26 am UTC: I posted a call to action for Binance, Bitget, & Gate to investigate RAVE market manipulation and offered a $10K bounty. 10:56 am UTC: I posted an update increasing the bounty to $25K. 11:18 am UTC: Bitget publicly acknowledged the call to action. 2:08 pm UTC: Binance publicly acknowledged the call to action. 3:06 pm UTC: RaveDAO posted claiming they have no involvement. 4:19 pm UTC: Gate publicly acknowledged the call to action. In the days leading up, on April 13 & 14, I confronted RaveDAO co-founder Yemu Xu (wildwoomoo) but have yet to receive an answer. RAVE launched in Dec 2025 on Binance Alpha with a 1B total supply. The addresses below, linked to the initial distribution, control ~95% of the RAVE supply (h/t Mlm): 0x9831156F1a6E506Fca41503590b42F07c2e80f54 0x8Ed6245C3276307E1A9D9Dc872E98A0E770070fd 0x6020656d1EF182173E45D4Fc375BDD5a48c674B0 0x2664cB80a5ee7D8EC05fe7C752dD62E078056E6d 0x2D81F8AeBf3e58A5e638006c9fd8F38C5220ecab 0x31694d761A8e851cFFbCd286aC54D01e5Ce5aFe6 0x0A1F07993a51CcEb4f52CA67765AECeADDA790d7 0xEB74Df8588cFC1C179Df4bd96C0bB8B227B9bE92 0x53d7d52301366DC14E1916b14eFeC1aDD8F3487b I found suspicious CEX activity in April 2026 tied to RaveDAO team addresses onchain, which potentially contradicts their recent statement: Bitget 0x2dc20f2180582172f5450c5d71e23fa438a7031b 0xa3a02aeb97fc1737c66f50d07d024799c137891d 0x2d95eb42525e6087e0cb7869f98da6838ed2e743 Gate 0x31711246b05d71e9eda5e38a3abb654020ee3353 Given the supply concentration, the team at minimum knows who is responsible for this price action. A simple litmus test: $6B in market cap was wiped out on just $52M of 24hr liquidations (h/t CoinGlass). That ratio points to a manipulated and unsustainable valuation. RAVE is not the only token with manipulation we have seen on major centralized exchanges. It's just the most blatant, reaching a top 15 market cap within 10 days before dropping 95% in hours. Other projects with highly questionable price action recently include: SIREN, MYX, COAI, M, PIPPIN, RIVER. Exchanges need faster intervention on manipulation. Detection at scale isn't easy, but each day of delay means retail traders absorb losses while platforms collect fees on the volume. The outcome is the same regardless of intent. While it's good the exchanges responded, I find it unlikely this activity wasn't spotted internally before I raised it publicly. I recognize how much this behavior takes from retail traders, and I plan to investigate similar movements in hopes of identifying the responsible parties. I want to reiterate that I did not take a position. If I had, I would have been liquidated myself. I also could not anticipate if or when the exchanges would comment publicly. My $25K bounty will remain active since the only DMs received were unverified claims rather than non-public information with supporting evidence as requested.

@aparjey @cobie @CoinbaseSupport Just to clarify, the 259k out of the Coinbase 10 is your money that got stolen right? + provide the other on chain addresses still it makes the search easier

@oneOJE @cobie @CoinbaseSupport #tokentxns" target="_blank" rel="nofollow noopener">etherscan.io/address/0xFCC2… this is the big one. there are more but those value are around 50k and onchain wallets vs this 260k from coinbase