Bitquery.io ( Bloxy )

Investigate Crypto without learning any tools mcp.bitquery.io/

For about three hours on 10 November, across. to, the website of the Across Protocol bridge, led to a copy that emptied wallets. Someone had taken control of the address at its registrar. We traced $348,000 taken from 9 wallets on five chains between 19:02 and 21:53 UTC. One Aave depositor lost $305K of it. Each drain paid 80% to the thief and 20% to the seller of the drainer kit. The widely shared $294K matches that seller's fee wallet, and most of its balance predates the hijack. Within an hour of gathering the ETH in one wallet, the thief had sent it off Ethereum, into a Monero token, an online casino and Bitcoin. bitquery.io/investigations/a…

Sahil Arora, who launched celebrity memecoins in 2024, says he paid the trader Ansem to promote them. His main proof is a 129.5 SOL transfer to a Binance deposit address. Sahil's own wallets supplied 99% of all the SOL that address ever received, and on 8 June 2024 it took 663 SOL from his IGGY presale, a sale of tokens that buyers never got. No transfer in any token links Sahil's wallets to the wallets he says are Ansem's. A payment between two Binance accounts would leave no trace on the chain, so only Binance can close the question. bitquery.io/investigations/s…

On 6 and 7 November, an attacker emptied Keplr wallets opened through social login. Web3Auth, the service behind that login, reported a security issue as the drain began. At least 44,041 wallets on seven Cosmos chains and 7,603 on Injective sent their funds to two addresses, which now hold $6.01M. After Keplr warned its users, 86% of the wallets were emptied. The attacker moved 1.96M staked ATOM without the 21-day unbonding wait. Neither address has sent a single transaction, and the Cosmos Hub drain was still running at 15:38 UTC on 7 November. bitquery.io/investigations/k…

On 6 November 2026 OFAC, the US sanctions office, listed eight Canadian money exchanges that it says turn Iranian rials into crypto, and published six of their wallets on TRON. Those six had taken in $228.3M in USDT since 2022. But none had sent any USDT for at least 163 days, and together they held 70 USDT. One of the eight, Amin Exchange, had moved on. We found 28 wallets OFAC did not list, and shared gas payments, customers and exchange accounts tie them to Amin. They took in $72.7M from January to November 2026, and the newest were still taking payments on the day of the listing. Three of the firms also traded with wallets tagged to Iran's Revolutionary Guard. bitquery.io/investigations/o…

Binance hacker laundered $333 million in a week, $208 million of it in the first two and a half days. On TRON, it moved faster than the thieves who robbed Bybit bitquery.io/investigations/b…

Hours after a Prince Group arrest, X Wallet stopped paying users

X Wallet is a Telegram app for USDT that Jinbo Guarantee lists as one of its own accounts. A report by Odaily, republished by 36Kr, says Prince Group's Chen Zhi co-founded Jinbo under its old name, Jinbei. On 5 November, hours after Singapore police announced the arrest of a Prince Group associate, X Wallet stopped paying users. Its busiest payout address paid its last user 42 minutes before the app posted that every deposit address would change, and a new address was already sweeping deposits. The old sweep wallet, which had taken in $520M in USDT since July 2025, took its last deposit 14 minutes after the notice. Money sent to old addresses still reached X Wallet's new wallets, and none of its wallets has been frozen. X Wallet paid $19.6M into Jinbo's bond address, and money flows both ways between it and a far larger hub, most likely run by Fully Light. bitquery.io/investigations/x…

iPhone drains on TRON: 43 collectors, one fee wallet, $4.06M in USDT bitquery.io/investigations/i…

Trust Wallet amount is larger - around $4M, we're going to release an investigation within 30 minutes, keep an eye

Further investigation puts Bitmart's loss at $424k

Binance's bStocks were the largest group of tokenized stocks on 31 October 2026, worth $1.31 billion, 41% of the market, five months after the first one was created. bitquery.io/investigations/t… @cz_binance

We reviewed the controls of seven tokenized stock issuers across six chains on 4 November. One of them, PreStocks, sells tokens of private companies before they list. Four of the seven hold keys that can burn or move tokens out of any holder's wallet within minutes, without a code change or waiting period. They are Robinhood on its own chain, xStocks on Solana, PreStocks, and Coinbase. The tokens those keys can reach were worth $750M at the 30 October close. Two of the four have used that power. On 5 October 2026, Coinbase took 0.0129 DraftKings tokens, worth 25 cents, out of two wallets and burned them. In September 2025, PreStocks moved tokens out of 32 accounts it does not own, three of them ordinary wallets whose tokens went into its own vault. Freezes are more common than takes. 593 wallets on Binance's sanctions list hold $30,945 of bStocks they cannot move. bitquery.io/investigations/t…

BREAKING: The Mercado Bitcoin hacker also drained wallets tied to BitMart. It started on them 53 minutes before the $48.6M Mercado Bitcoin attack, on Base, Arbitrum, and Optimism. 19 hours later, it came back for more. $391k taken. BitMart has not confirmed. bitquery.io/investigations/m…

Tokenized stock prices show no clear edge on Monday's open bitquery.io/investigations/t…

On 2 November, a Solana arbitrage bot called King lost $856K. The first reports said $786K because they missed the USDT. Five plain transfers, signed with the bot's own key, emptied its main wallet in 146 seconds, just after the bot stopped trading. The address that collects the bot's withdrawals offered the attacker a 20% bounty on-chain and got no reply. The attacker swapped everything to SOL and bridged it to Ethereum. Mayan and Relay blocked part of it, so about a third is frozen. The other two-thirds sit in one Ethereum address that has not moved. bitquery.io/investigations/k…

On 2 November, Mercado Bitcoin's hot wallets on 10 blockchains paid a hacker $48.5M. The hacker can also sign for the exchange's customer deposit addresses. On Ethereum, it emptied 35,853 of them and kept going for more than two hours after the exchange said the attack was contained. Tether and Paxos froze $7.3M. Circle froze nothing, and most of the money still sits in the hacker's wallets. bitquery.io/investigations/m…

On 1 and 2 November, $108.80M in USDC left accounts at Kraken, Crypto-com, and OKX for 15 wallets. Eleven of them had been paid by the same exchanges before, so the thief likely held their keys as well as the logins. Within hours, most of the money was swapped into ETH. At 13:47 UTC on 2 November, $78.27M still sat on Ethereum in addresses tied to the thief. Only 3.74M USDC of it can still be frozen by its issuer. bitquery.io/investigations/e…

Between 30 October and 2 November, a thief emptied BTCPay Server hot wallets on servers that had not been updated since July. BTCPay named the two addresses that collected the money. We traced $1,628,450 to them: 18.38 BTC and 3,405 LTC, taken in 682 separate sweeps. 87% of it moved in one wave on the afternoon and evening of 1 November, and sweeps kept arriving after BTCPay's alert. At 06:00 UTC on 2 November, more than 99% of the money still sat in addresses first used in the theft, and none had reached a known exchange. bitquery.io/investigations/b…