Slava Demchuk

One day the client’s balance was there, the next it wasn’t. No suspicious emails they could point to, no unusual activity they’d noticed, no clear moment where something had gone wrong. Just 270,000 USDT missing from a Ledger hardware wallet. What happened next showcases how OSINT

Working in the crypto industry can cause you to believe that you’re prone to scammers. The hard truth is that anyone’s susceptible to fraud no matter the position, especially when AI tools producing hyperrealistic deepfakes are growing more advanced by the minute. Our case from early 2026 proves

In late December 2025, a crypto holder was moving between countries. While they were traveling, someone gained access to the holder’s wallet and transferred 650,000 USDT – held on the Tron (TRC-20) network – to an address they controlled. The theft was discovered within hours of the victim regaining

Last updated: March 26, 2026. This post will be updated as the situation develops. On the evening of March 23, 2026, Circle Internet Financial executed a mass USDC blacklist action against 16 wallet addresses simultaneously. The wallets belonged to operating crypto businesses — casinos, forex brokers, and payment processors — processing thousands

Date: February 3, 2026 Incident Type: Smart-Contract Exploit (Unlimited Approval) Total Losses: ~$13,500,000+ In late January 2026, the DeFi ecosystem was rocked by a series of linked exploits targeting Aperture Finance and 0xswapnet. Despite serving different niches, both protocols fell victim to the same critical architectural flaw:

TL;DR: A second wave of the SHA1-Hulud worm compromised Trust Wallet’s browser extension, leading to the theft of mnemonic phrases and over $7.3 million in crypto losses. The attackers exploited infected NPM Packages, deployed a malicious extension update, and laundered funds through cross-chain bridges, swap

On 22 August 2025, the DeepCode intelligence team identified a darknet marketplace listing by the actor “1688shuju” on darkforums[.]st offering large batches of verified phone numbers tied to major cryptocurrency exchanges (Binance, OKX, Coinbase, KuCoin, HTX). During an undercover engagement, DeepCode obtained a payment endpoint used to purchase the

A Hyperliquid whale lost $20M+ after a private-key compromise. Using AMLBot’s Tracer, we mapped the visible on-chain flow: ~$17M moved from the trader’s wallet to Arbitrum, was bridged (incl. via deBridge) and converted to DAI. Another ~$3.1M in MSYRUPUSDP was taken from the Plasma Syrup

The hacker got hacked. But was it real? Dive into our on-chain breakdown of the UXLINK exploit and its tangled money trail.

The cryptocurrency adoption has brought opportunities alongside risks. As digital asset markets mature, criminals have developed complex attack vectors to steal funds from unsuspecting victims. In this environment, crypto recovery service providers like AMLBot have emerged as critical allies for victims seeking to recover their stolen assets through professional blockchain

Traditional AML tools struggle to keep pace with the scale and speed of illicit activity in crypto. In this exploratory study, the AMLBot Team investigates whether behavior-based machine learning can spot suspicious entities before they appear on blacklists and how explainability tools like SHAP make this process transparent. We

Download the Full Report Tether’s USDT stablecoin is usually perceived as a compliance-friendly instrument in the crypto industry, with the company using its ability to freeze suspicious wallets as per law enforcement requests.  However, AMLBot’s Forensics Team finds a critical vulnerability: a significant lag between the initiation

What Happened?  Earlier this year, a Czech company fell victim to an address poisoning scam scheme, resulting in the loss of $50,000+ in USDT. The scam exploited the company's operational routine, targeting its treasury wallet and leveraging address similarities to divert funds to a malicious actor'