Providing compliance and investigative tools for Regulators, LEs, and Web3 enterprises. Using AI +Big Data for accurate crypto risk and crime detection.
Hong Kong
Joined May 2022
- Tweets1.1K
- Following240
- Followers4K
- Likes305
Pinned Tweet
We have released the Crypto Crime Report for the first half of 2026.
You can visit our official website to download the full copy👇
bitrace.io/en/blog
Bitrace retweeted
TRX stolen from Binance was moved through Bitget Wallet’s bridge during the laundering process. We found that the destination address had previously been used by the Phemex hacker. web3.bitget.com/explorer/a40…
Binance Hacker: TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi -> TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRki -> TUoVsNvkSbCQFty1tLViCgvMjNRGGEK6eM -> TMfBqjTDEAd2HpeeSNtaAGzWixpQCAyQxY -> Bitget Wallet Swap Bridge -> 0xCd684D22E8C3600E6eE93B5a57923c3b517f3396
Phemex Hacker: 0x17bcc630b1409637d42dfb278f8e2ea9fc862631 -> 0x140dea3b704d724ddff41597b35a10ce0189661f -> 0xc4342a5abb4872a698d0c304874928e7efd5e593 -> 0x1dc345151f1cfec7f6333f2548392742b27de27f -> 0x606289766cb6a0f9b9f3cc6a842434e1470fcf89 -> 0xcd684d22e8c3600e6ee93b5a57923c3b517f3396
We have completed the first round of attacker address labeling. Going forward, we will continue to monitor various money laundering channels and provide real-time intelligence.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
The virtual asset trading markets within video games have become common venues for money laundering.
In this article, we use a well-known Chinese video game as a case study to introduce the currently popular methods of money laundering via game assets, as well as the company’s tough anti-money laundering stance.
blog.bitrace.io/organized-cr…
Invited by the Hong Kong Judicial Institute, Bitrace CEO Isabel Shi delivered specialized trainings on blockchain forensics and digital asset crime investigations for Hong Kong Judiciary judges and related regulatory and law enforcement personnel.
blog.bitrace.io/bitrace-ceo-…
The sanctions imposed on Xinbi Guarantee have disrupted the public-group merchant community.
Jointly written with attorney @JianzhiJin, we examine possible disposition pathways for its frozen funds under the legal frameworks of China and the US.
blog.bitrace.io/xinbi-guaran…
The attacks mainly occurred on three networks: Ethereum, Tron, and Ripple.
At present, compromised ERC tokens has already been swapped for over 60k $ETH and stockpiled across multiple addresses, while 20m $TRX and 103m $XRP are still awaiting laundering.
At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limited number of hot wallets.
Our security team immediately activated emergency response procedures and began a full investigation.
Based on our current assessment, approximately $351.6 million in assets were affected. Bitget’s cold wallets and the overwhelming majority of platform assets remain secure and unaffected.
Most importantly, user funds remain protected.
The incident falls within the coverage of Bitget’s User Protection Fund, which currently holds more than $464 million.
Customer account balances remain accurate, and deposits and trading continue to operate normally.
As a precaution, withdrawals have been temporarily suspended while our teams complete a comprehensive security review.
We have identified and flagged the relevant transfer addresses and have formally engaged law enforcement agencies and leading on-chain security partners.
We are working around the clock to restore withdrawal services as soon as it is safe to do so.
Bitget will provide further updates through our official channels.
We will not speculate on the attack vector while the investigation remains ongoing. Our focus is on protecting users, securing all systems, and delivering complete transparency throughout this process.
Our CEO @0xIsabelSHI was recently invited to the 2026 Financial Investigation Course (FIC), hosted by the Hong Kong Police Force’s Financial Intelligence and Investigation Bureau (FIIB).
She shared practical cryptocurrency crime investigation experience with law enforcement and regulatory officials from multiple jurisdictions.
blog.bitrace.io/bitrace-invi…
Following exposure by @Bitrace_team and @MistTrack_io , Fulilai Guarantee（福利来担保） rebranded as Falali Guarantee（法拉利担保）.
Deliberately approximating the names of well-known companies is a common tactic in the underground economy.
In Chinese usage, “法拉利” is ordinarily understood as a reference to the automobile manufacturer Ferrari (notably, the latter’s stock ticker is BIT:RACE😅).
Similar brand-adjacent naming has also been observed in Ouyi Guarantee, which mimics OKX (欧易), and Bian Guarantee, which mimics Binance (币安).
Both names share the abbreviation #FLL, a naming convention commonly used by illicit crypto entities in Southeast Asia and derived from Telegram-supported TON Name Service identifiers.
learn more about TNS👇
teapawt.org/Yuri_miao/status/20566…
如何正确翻译中文洗钱网络犯罪实体的英文名
起因是看到 @chainalysis 在报告中将「领航担保」翻译为「Pilot Guarantee」而不是「Linghang Guarantee」，毫无疑问这是出于文化差异而选择了不恰当的意译。
这里简单介绍一下担保平台的命名规则以及我的翻译方式
🧵
In this article, we introduced the money-laundering term “料” used in Chinese organized crime networks.
We believe it will be helpful to crypto crime investigators who are not native speakers.
blog.bitrace.io/crypto-crime…
Bitrace retweeted
🤡 在决定清退洗钱水房类型公群12小时后，福利来担保又后悔了，现在正在挽留公群老板。
这其实在意料之中，洗钱类型的公群高流水、高月租，是综合类型担保平台的重要收入来源，自己不做的话竞争对手就做大了。
Update
Another leading transaction guarantee platform, Fulilai Guarantee（福利来担保）, began last night to offboard all money-laundering-type public-group merchants.
The action covers illicit entities commonly described as “card-to-USDT（卡接回U）” and “cash car（现金车）” .
Fulilai Wallet（福利来钱包）, operated by the platform, is currently experiencing rapid capital outflows. Since OFAC formally announced the sanctions, recorded outflows have reached 9.3 million $USDT.
Further analysis of money-laundering merchant addresses with pledged deposits exceeding 15k $USDT indicates that HuanGuan has received more than 12.6 million $USDT from Xinbi-linked money-laundering merchants, accounting for 48% of the relevant inflows.
If transaction activity associated with other categories of illicit addresses is included in the statistics, this share is expected to rise further.
(2/3)
Update
Another leading transaction guarantee platform, Fulilai Guarantee（福利来担保）, began last night to offboard all money-laundering-type public-group merchants.
The action covers illicit entities commonly described as “card-to-USDT（卡接回U）” and “cash car（现金车）” .
Fulilai Wallet（福利来钱包）, operated by the platform, is currently experiencing rapid capital outflows. Since OFAC formally announced the sanctions, recorded outflows have reached 9.3 million $USDT.
Update
Affected by the sanctions imposed on Xinbi Guarantee, abnormal capital outflows have been observed on the sub-guarantee platform it had previously deployed in secret.
Our monitoring indicates that a large number of guarantee merchants are rapidly exiting this market in order to avoid potential fund losses.
Update
Affected by the sanctions imposed on Xinbi Guarantee, abnormal capital outflows have been observed on the sub-guarantee platform it had previously deployed in secret.
Our monitoring indicates that a large number of guarantee merchants are rapidly exiting this market in order to avoid potential fund losses.
A few hours ago, OFAC announced sanctions against Xinbi Guarantee and published a batch of addresses. These addresses had already been frozen earlier by Tether.
However, our intelligence indicates that not all of the addresses belong to Xinbi, some business addresses of third-party payment and OTC entities were also implicated because they conducted operations through Xinbi.
We recommend that VASP risk-control departments treat this funding threat with high priority and promptly investigate and isolate user funds associated with Xinbi.
ofac.treasury.gov/recent-act…
We have identified and cataloged the business addresses of more than 200 illegal transaction guarantee platforms on the market and established systematic intelligence monitoring of related communities.
You can visit our official website to obtain our #BitraceAML tool, quickly identify high-risk funds originating from black- and gray-market communities, and enjoy a professional compliance experience.
bitrace.io/en/product/aml