Investigations & Case Studies

A collection of 29 posts

Investigations & Case Studies

Breaking Down the Binance Hack: Timeline, Laundering Routes, and How Polytrop Helps Businesses Spot Stolen Funds

On October 29, 2026, attackers drained between $6.3 billion and $6.43 billion from Binance hot wallets, by various estimates, in roughly 20 minutes. It is the largest crypto theft on record. Five days later, AMLBot is tracking up to $1.7 billion of it across thousands of wallets

Investigations & Case Studies

Crypto Investigations Report 2026: Key Findings, Losses and Crime Trends

Intro Between January 1 and October 13, 2026, AMLBot investigated more than 250 crypto crime cases. Reported losses in those cases total $291.6 million: $227.5 million in cases opened from January to September and $64.1 million in the first 13 days of October (preliminary). Note: Unlike industry

Investigations & Case Studies

Crypto Investigation Case: How AMLBot Recovered $270K Stolen from a Ledger Using OSINT

One day the client’s balance was there, the next it wasn’t. No suspicious emails they could point to, no unusual activity they’d noticed, no clear moment where something had gone wrong. Just 270,000 USDT missing from a Ledger hardware wallet. What happened next showcases how OSINT

Investigations & Case Studies

A Fake Zoom Call Nearly Cost This Company Hundreds of Thousands in ETH

Working in the crypto industry can cause you to believe that you’re prone to scammers. The hard truth is that anyone’s susceptible to fraud no matter the position, especially when AI tools producing hyperrealistic deepfakes are growing more advanced by the minute. Our case from early 2026 proves

Investigations & Case Studies

$650,000 USDT Stolen While The Owner Was Traveling – Tether Froze It All

In late December 2025, a crypto holder was moving between countries. While they were traveling, someone gained access to the holder’s wallet and transferred 650,000 USDT – held on the Tron (TRC-20) network – to an address they controlled. The theft was discovered within hours of the victim regaining

Investigations & Case Studies Featured

Report: Stablecoin Flows Through Crypto Privacy Tools: $4.2B Exposed

Intro On April 18, 2026, attackers drained $292 million from Kelp DAO's rsETH bridge in what became the largest DeFi exploit of the year. Within days, stolen funds began flowing through privacy protocols — THORChain, Umbra, Chainflip — prompting Umbra to shut down its own frontend to curb further laundering.

Investigations & Case Studies

Circle Froze 16 Business Hot Wallets — Including a Blockchain Bridge Smart Contract

Last updated: March 26, 2026. This post will be updated as the situation develops. On the evening of March 23, 2026, Circle Internet Financial executed a mass USDC blacklist action against 16 wallet addresses simultaneously. The wallets belonged to operating crypto businesses — casinos, forex brokers, and payment processors — processing thousands

Investigations & Case Studies Featured

Crypto Crime Report 2025-2026: Insights from 2,500+ Real Investigations

Intro This report is based on the analysis of 2,500+ real crypto crime investigations conducted by AMLBot across 2025-2026, covering fraud, theft, hacks, and post-incident tracing cases across multiple blockchains and services. Rather than focusing on isolated incidents or public breach disclosures, the study examines how crypto

Investigations & Case Studies

$13.5M Lost in Aperture Finance & SwapNet Exploit: Full On-Chain Breakdown

Date: February 3, 2026 Incident Type: Smart-Contract Exploit (Unlimited Approval) Total Losses: ~$13,500,000+ In late January 2026, the DeFi ecosystem was rocked by a series of linked exploits targeting Aperture Finance and 0xswapnet. Despite serving different niches, both protocols fell victim to the same critical architectural flaw:

Free Business trial

Try AMLBot in your own workflow

Tell us what your business needs, and we’ll set up a free trial with the AML tools that are most relevant to you.

Build my free trial (opens in a new tab)

Takes a few quick questions

Your Business trial

Example setup

• KYT: Screening, Transaction & Address Monitoring
• KYC / KYB
• AI Tracer
• Travel Rule

Full access to Business mode, set up around your answers

Investigations & Case Studies

Trust Wallet Browser Extension Compromise: $7.3M Lost in a Supply-Chain Attack

TL;DR: A second wave of the SHA1-Hulud worm compromised Trust Wallet’s browser extension, leading to the theft of mnemonic phrases and over $7.3 million in crypto losses. The attackers exploited infected NPM Packages, deployed a malicious extension update, and laundered funds through cross-chain bridges, swap

Reports Featured

Stablecoin Freezes 2023–2025: A Data-Backed Analysis of USDT vs USDC by AMLBot

Summary:  A new data analysis of stablecoin freezing activity from 2023 to 2025 reveals major differences in scale and approach between the two leading issuers, Tether (USDT) and Circle (USDC).  In this new report, AMLBot analyzes stablecoin freezes across Ethereum and TRON to map how USDT and USDC have been

Investigations & Case Studies

🚨 Joint Intel Strike — DeepCode × AMLBot Trace “1688shuju,” a Darknet Seller of Verified Exchange Numbers

On 22 August 2025, the DeepCode intelligence team identified a darknet marketplace listing by the actor “1688shuju” on darkforums[.]st offering large batches of verified phone numbers tied to major cryptocurrency exchanges (Binance, OKX, Coinbase, KuCoin, HTX). During an undercover engagement, DeepCode obtained a payment endpoint used to purchase the

Investigations & Case Studies

Private-Key Compromise After $16M Hyperliquid Trade — Full On-Chain Breakdown

A Hyperliquid whale lost $20M+ after a private-key compromise. Using AMLBot’s Tracer, we mapped the visible on-chain flow: ~$17M moved from the trader’s wallet to Arbitrum, was bridged (incl. via deBridge) and converted to DAI. Another ~$3.1M in MSYRUPUSDP was taken from the Plasma Syrup

Investigations & Case Studies

UXLINK Hack Explained: AMLBot On-Chain Analysis Reveals a Possible Staged Phishing Twist

The hacker got hacked. But was it real? Dive into our on-chain breakdown of the UXLINK exploit and its tangled money trail.

Investigations & Case Studies

How AMLBot's Crypto Recovery Service Helps Victims Get Back Stolen Crypto Assets

The cryptocurrency adoption has brought opportunities alongside risks. As digital asset markets mature, criminals have developed complex attack vectors to steal funds from unsuspecting victims. In this environment, crypto recovery service providers like AMLBot have emerged as critical allies for victims seeking to recover their stolen assets through professional blockchain

Investigations & Case Studies Featured

Breaking Down the Nobitex Hack: Timeline, Impact, and Key Takeaways

Nobitex’s Role in Iran’s Crypto Ecosystem Founded in 2017 by CEO Amirhosein Rad, Nobitex has grown into Iran’s largest cryptocurrency exchange. It serves as a critical hub for Iranian crypto users, handling the majority of the country’s digital asset trading activity. Nobitex claimed to process 70%

Investigations & Case Studies

Can Machine Learning Catch Criminals Before the Blockchain Does? – Report

Traditional AML tools struggle to keep pace with the scale and speed of illicit activity in crypto. In this exploratory study, the AMLBot Team investigates whether behavior-based machine learning can spot suspicious entities before they appear on blacklists and how explainability tools like SHAP make this process transparent. We

Investigations & Case Studies

Tether Freeze Gap Becomes Laundering Loophole for Criminals An Analytical Report

Download the Full Report Tether’s USDT stablecoin is usually perceived as a compliance-friendly instrument in the crypto industry, with the company using its ability to freeze suspicious wallets as per law enforcement requests.  However, AMLBot’s Forensics Team finds a critical vulnerability: a significant lag between the initiation

Reports

Crypto Drainers: How They Operate and a Case Study of Medusa and Its Broader Ecosystem

Click the Link Below To Get the Full Report and Learn How To Stay One Step Ahead: Download the Full Report Drainers have become one of the most dangerous tools used by crypto scammers. With just one wrong click, users can unknowingly approve malicious transactions — giving full access to their

Investigations & Case Studies

Honey Trap: How Address Poisoning Scammed $50K — and How It Was Recovered

What Happened?  Earlier this year, a Czech company fell victim to an address poisoning scam scheme, resulting in the loss of $50,000+ in USDT. The scam exploited the company's operational routine, targeting its treasury wallet and leveraging address similarities to divert funds to a malicious actor'

Reports

Comprehensive Analysis of Stablecoin Transfers, Compliance, and Ecosystem Dynamics

For more insights into stablecoin market dynamics, you may also be interested in our previous report analyzing illicit activity patterns in USDT and USDC transactions. Download Full Report 1.Abstract 2.Scope of Research In this report the following three top stable coins are analyzed: USDT, USDC and BUSD. In

Investigations & Case Studies

Hacked by a Dream Job: A Case Study on Web3 Job Scams

"Finally, I've got the job…No, you just got scammed :("  For many, receiving an offer is a moment of excitement. It's the recognition of skills, the chance for new prospects, and even the start of a dream career. But what happens when that dream

Investigations & Case Studies

Pig Butchering Crypto Scam: Real Case, Red Flags, and Recovery Steps

In November 2025, the U.S. Department of Justice established a dedicated Scam Center Strike Force — an interagency task force specifically targeting Southeast Asian scam operations. By the time of its announcement, the Strike Force had already seized over $401 million in cryptocurrency and was pursuing an additional $80 million

Investigations & Case Studies

How LetsExchange Achieved a 10X Boost in Compliance Efficiency with AMLBot?

Launched in September 2021, LetsExchange is one of the fastest-growing crypto-exchange platforms in the European Union. It supports over 4,000 digital currencies—more than any other exchange on the market. LetsExchange is designed to deliver a seamless, secure, and fast user experience by offering deep liquidity, cross-

Investigations & Case Studies

Tracing WazirX Hack with AMLBot Tracer

The $235 million hack on Indian cryptocurrency exchange WazirX on July 18 has intensified scrutiny over the security of digital asset platforms and sparked a comprehensive investigation.  The hacker moved approximately $234.9 million worth of funds to a new address, using assets funded through the cryptocurrency mixer Tornado Cash.