Investigations & Case Studies

Last updated: March 26, 2026. This post will be updated as the situation develops. On the evening of March 23, 2026, Circle Internet Financial executed a mass USDC blacklist action against 16 wallet addresses simultaneously. The wallets belonged to operating crypto businesses — casinos, forex brokers, and payment processors — processing thousands

Date: February 3, 2026 Incident Type: Smart-Contract Exploit (Unlimited Approval) Total Losses: ~$13,500,000+ In late January 2026, the DeFi ecosystem was rocked by a series of linked exploits targeting Aperture Finance and 0xswapnet. Despite serving different niches, both protocols fell victim to the same critical architectural flaw: the

TL;DR: A second wave of the SHA1-Hulud worm compromised Trust Wallet’s browser extension, leading to the theft of mnemonic phrases and over $7.3 million in crypto losses. The attackers exploited infected NPM Packages, deployed a malicious extension update, and laundered funds through cross-chain bridges, swap services, and

On 22 August 2025, the DeepCode intelligence team identified a darknet marketplace listing by the actor “1688shuju” on darkforums[.]st offering large batches of verified phone numbers tied to major cryptocurrency exchanges (Binance, OKX, Coinbase, KuCoin, HTX). During an undercover engagement, DeepCode obtained a payment endpoint used to purchase the

A Hyperliquid whale lost $20M+ after a private-key compromise. Using AMLBot’s Tracer, we mapped the visible on-chain flow: ~$17M moved from the trader’s wallet to Arbitrum, was bridged (incl. via deBridge) and converted to DAI. Another ~$3.1M in MSYRUPUSDP was taken from the Plasma Syrup Vault to

The hacker got hacked. But was it real? Dive into our on-chain breakdown of the UXLINK exploit and its tangled money trail.

The cryptocurrency adoption has brought opportunities alongside risks. As digital asset markets mature, criminals have developed complex attack vectors to steal funds from unsuspecting victims. In this environment, crypto recovery service providers like AMLBot have emerged as critical allies for victims seeking to recover their stolen assets through professional blockchain

Download the Full Report Tether’s USDT stablecoin is usually perceived as a compliance-friendly instrument in the crypto industry, with the company using its ability to freeze suspicious wallets as per law enforcement requests.  However, AMLBot’s Forensics Team finds a critical vulnerability: a significant lag between the initiation of

What Happened?  Earlier this year, a Czech company fell victim to an address poisoning scam scheme, resulting in the loss of $50,000+ in USDT. The scam exploited the company's operational routine, targeting its treasury wallet and leveraging address similarities to divert funds to a malicious actor'

"Finally, I've got the job…No, you just got scammed :("  For many, receiving an offer is a moment of excitement. It's the recognition of skills, the chance for new prospects, and even the start of a dream career. But what happens when that dream

Pig butchering scams are a cunning blend of romance fraud and approval phishing, designed to “fatten” victims financially and emotionally before draining them dry. These scams begin with casual chats and result in significant financial losses, leaving victims isolated and embarrassed. What makes pig butchering scams so effective is the

Launched in September 2021, LetsExchange is one of the fastest-growing crypto-exchange platforms in the European Union. It supports over 4,000 digital currencies—more than any other exchange on the market. LetsExchange is designed to deliver a seamless, secure, and fast user experience by offering deep liquidity, cross-chain swaps, and

Executive Summary The report is focused on comparing the two most popular stablecoins by market share - USDT issued by Tether Limited Inc. and USDC issued by Circle Internet Financial, LLC - in terms of the magnitude of illicit activity associated with both stablecoins. This is done utilizing blockchain analytics

In 2023, the AMLBot investigation team detected that individuals failed to comprehend the potential consequences of disregarding basic safety guidelines. Unexpected sanctions exposure challenges can arise, as was the case when a client approached us with concerns about a frozen account linked to suspected sanctions. The Case A client contacted