AMLBot Team

TL;DR: A second wave of the SHA1-Hulud worm compromised Trust Wallet’s browser extension, leading to the theft of mnemonic phrases and over $7.3 million in crypto losses. The attackers exploited infected NPM Packages, deployed a malicious extension update, and laundered funds through cross-chain bridges, swap services, and

On 22 August 2025, the DeepCode intelligence team identified a darknet marketplace listing by the actor “1688shuju” on darkforums[.]st offering large batches of verified phone numbers tied to major cryptocurrency exchanges (Binance, OKX, Coinbase, KuCoin, HTX). During an undercover engagement, DeepCode obtained a payment endpoint used to purchase the

A Hyperliquid whale lost $20M+ after a private-key compromise. Using AMLBot’s Tracer, we mapped the visible on-chain flow: ~$17M moved from the trader’s wallet to Arbitrum, was bridged (incl. via deBridge) and converted to DAI. Another ~$3.1M in MSYRUPUSDP was taken from the Plasma Syrup Vault to

The hacker got hacked. But was it real? Dive into our on-chain breakdown of the UXLINK exploit and its tangled money trail.

The cryptocurrency adoption has brought opportunities alongside risks. As digital asset markets mature, criminals have developed complex attack vectors to steal funds from unsuspecting victims. In this environment, crypto recovery service providers like AMLBot have emerged as critical allies for victims seeking to recover their stolen assets through professional blockchain