Cross-chain investigations engine and daily security intel. Fund tracing and attribution for investigators, LEOs, and exchange security teams.
EU
Joined June 2026
- Tweets449
- Following46
- Followers556
- Likes592
Pinned Tweet
1/
Did we just crack Tornado Cash?
Several weeks ago we shared that Noxos Intelligence started developing a new algorithm targeting funds routed through one of the most famous crypto mixers - Tornado Cash.
The results so far? 👇
Noxos Intelligence retweeted
1/
Today there was a very deep conversation within our team. The topic was "Asset recovery" for regular users, and especially the success rate.
The conversation ran into two topics:
1. What is needed to increase the success rate of asset recovery procedures?
2. Should the users use the private sector, or rely solely on the law enforcement?
The breakdown is below 👇
1/
Today there was a very deep conversation within our team. The topic was "Asset recovery" for regular users, and especially the success rate.
The conversation ran into two topics:
1. What is needed to increase the success rate of asset recovery procedures?
2. Should the users use the private sector, or rely solely on the law enforcement?
The breakdown is below 👇
4/
If you think there are more important questions, feel free to share them so we can discuss them publicly.
We might also share some of our own conclusions in a follow-up - but first we want to hear what people actually go through.
Noxos Intelligence retweeted
All Bitcoin addresses mentioned by the FBI were also publicly shared by Noxos Intelligence shortly after the Binance incident.
We haven’t publicly launched yet, but having our findings align with those of one of the world’s leading investigative agencies is an important benchmark for us.
teapawt.org/NoxosIntel/status/2115…
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…
ALT FBI public service announcement with Department of Justice seal in the background on a gold gradient.
All Bitcoin addresses mentioned by the FBI were also publicly shared by Noxos Intelligence shortly after the Binance incident.
We haven’t publicly launched yet, but having our findings align with those of one of the world’s leading investigative agencies is an important benchmark for us.
teapawt.org/NoxosIntel/status/2115…
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…
ALT FBI public service announcement with Department of Justice seal in the background on a gold gradient.
Noxos Intelligence retweeted
1/
Did we just crack Tornado Cash?
Several weeks ago we shared that Noxos Intelligence started developing a new algorithm targeting funds routed through one of the most famous crypto mixers - Tornado Cash.
The results so far? 👇
6/
We're planning to launch this tool soon, and it will be open for public use. More details at a later stage.
Want in early? Join the waitlist on our website.
Stay tuned.
Noxos Intelligence retweeted
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Thanks to all other signers involved.
Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5
Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6
Noxos Intelligence retweeted
@binance was hacked, with losses estimated at ~$5.5B. The final figure is still being confirmed.
Thanks to @tether and @circle, ~$2.2B in USDT and USDC has already been frozen.
The rest of the stolen funds are on Bitcoin, Tron, and several EVM chains: Ethereum, Arbitrum, Base, and Optimism.
The attacker is actively moving the funds and splitting them across multiple wallets.
Noxos Intelligence is monitoring the flow.
This is what the Bitcoin side looks like so far:
1/ CERBERUS, our monitoring engine, alerted us that the attacker behind the @x100global exploit has begun laundering funds through Tornado Cash.
The following addresses made deposits:
0x8296721489d0a7e934edd66ea27159b1c88a42e5
↳ 420.8 #ETH across multiple deposits of 0.1 and 10 ETH.
0xF637DCeE7Dd96E8FDaB926C5993D558B52D635ea
↳ 400.4 #ETH across multiple deposits of 0.1 and 100 ETH.
An hour ago, @x100global was exploited for ~$4.75M in #USDT on Ethereum.
Our initial tracing shows the stolen funds were swapped to ~2,022 #ETH via Uniswap and are now split across 5 addresses:
0x8296721489d0a7e934edd66ea27159b1c88a42e5: 422 ETH
0xf637dcee7dd96e8fdab926c5993d558b52d635ea: 400 ETH
0x64b135af3d80733c9c290d58873e2cccb34a81ae: 400 ETH
0x4fdb9f9a44b356c8a9c2ea060a40fb7a9caabef3: 400 ETH
0x6790cf09ba33d05ada2c13cbb4104f5b8b666391: 400 ETH
We’re monitoring these addresses and will post updates.
Noxos Intelligence retweeted
1/ CERBERUS, our monitoring engine, alerted us that the attacker behind the @x100global exploit has begun laundering funds through Tornado Cash.
The following addresses made deposits:
0x8296721489d0a7e934edd66ea27159b1c88a42e5
↳ 420.8 #ETH across multiple deposits of 0.1 and 10 ETH.
0xF637DCeE7Dd96E8FDaB926C5993D558B52D635ea
↳ 400.4 #ETH across multiple deposits of 0.1 and 100 ETH.
An hour ago, @x100global was exploited for ~$4.75M in #USDT on Ethereum.
Our initial tracing shows the stolen funds were swapped to ~2,022 #ETH via Uniswap and are now split across 5 addresses:
0x8296721489d0a7e934edd66ea27159b1c88a42e5: 422 ETH
0xf637dcee7dd96e8fdab926c5993d558b52d635ea: 400 ETH
0x64b135af3d80733c9c290d58873e2cccb34a81ae: 400 ETH
0x4fdb9f9a44b356c8a9c2ea060a40fb7a9caabef3: 400 ETH
0x6790cf09ba33d05ada2c13cbb4104f5b8b666391: 400 ETH
We’re monitoring these addresses and will post updates.