ChainCatcher message, on-chain detective ZachXBT posted on X: "Over the past few months, I have been tracking a series of related attacks against McDonald's, Usher, Kabosu's owner, Andy Ayrey, Wiz Khalifa, SPX 6900, etc., which have resulted in over $3.5 million in stolen funds due to the launch of the Pump.Fun Meme coin."He also mentioned that the second part of this investigation may be released tomorrow, revealing multiple threat actors related to more than 9 intrusions.

ChainCatcher News, an agent from the Internal Revenue Service tracked and seized 120,000 bitcoins stolen from the cryptocurrency exchange Bitfinex using a MacBook Pro, which is now housed at the Smithsonian in Washington, D.C.Ellen Feingold, the curator of the National Numismatic Collection (NNC), explained in an article for Smithsonian Magazine on November 18: "This laptop is at the center of a criminal case, indicating that people's understanding of cryptocurrency is continually evolving."The owner of the laptop is former IRS agent Chris Janczewski, who now leads global investigations at blockchain intelligence firm TRM Labs. Janczewski helped uncover the keys to the 120,000 bitcoins stolen by Ilya Lichtenstein from Bitfinex, who was sentenced to five years in prison earlier this month for hacking.

ChainCatcher message, Slow Mist posted on platform X stating that its team will assist law enforcement in tracking stolen funds and analyzing related clues. A complete list of hacker addresses will soon be released in collaboration with DEXX. Currently, approximately 2,000 suspicious addresses have been roughly identified.

ChainCatcher message, according to the Cyvers Alerts system monitoring, polterfinance has reported an attack event on the Fantom chain, with over $7 million in crypto assets stolen. The attacker initially obtained funds on Ethereum through Tornado Cash, and the funds were later bridged to Fantom.The team has taken immediate action:The platform is suspended to control the vulnerability.The bridge has been notified, and the involved wallets have been traced to Binance.An active investigation into the vulnerability is underway.

ChainCatcher news, Beosin Alert posted on platform X, currently has collected about 2800 DEXX victim addresses, with over 9000 stolen transactions. An analysis of some stolen addresses' funds revealed that the stolen funds are still held in the hacker's address and have not been transferred out. It is likely the work of the same hacker, who is speculated to transfer funds based on the victims' token balances and arranged them in descending order of value.

ChainCatcher message, according to GoPlus security monitoring, has currently discovered phishing scams related to rights protection and compensation, such as "Rights Protection Community," "DEXX Theft Registration," and "DEXX Compensation," specifically targeting users who have been stolen from DEXX. Users should be cautious in identifying these and must not upload private keys/mnemonic phrases or connect wallets for confirmation to avoid further harm.

ChainCatcher news, according to Cointelegraph, the Ontario Provincial Police (OPP) thanked the stablecoin issuer Tether for assisting in the investigation, freezing approximately 10,000 Canadian dollars (7,186 USD) worth of Tether stablecoin stolen from an individual, which has now been returned to the victim.OPP Detective Inspector Addison Hunter stated, "With the voluntary assistance and cooperation of Tether International Ltd., the stolen digital assets were successfully seized and returned to the victim. This collaboration played a crucial role in ensuring the swift recovery of the assets."

ChainCatcher message, according to CertiK Alert monitoring, the private key of SUNRAY·FINANCE has been leaked, and the attacker has gained ownership of SUN and ARC tokens, minted a large number of tokens, and then sold them off to drain its DEX trading pair.Currently, the attacker has stolen $2.855 million in funds.

ChainCatcher news, Aark Digital announced the launch of the Arkham Bounty Program on X, aiming to recover recently stolen funds. The bounty is divided into two types:Bounty 1: A reward of up to 6,100 ARKM (or 10,000 USDC) for actionable intelligence that directly leads to reporting to CEX or freezing/recovering stolen assets;Bounty 2: For those who contribute to the successful recovery of stolen assets, the team will offer a reward of 207,912.83 USDC and 3.62 ETH, or 15% of the stolen amount as a white hat reward.It is reported that Aark Digital recently experienced a security incident, where unauthorized parties accessed and stole approximately 1,386,085 USDC and 24.143 ETH, totaling around 1.5 million USD.

ChainCatcher news, according to an update disclosed by Arkham on the X platform, data shows that after the reported hacking attack yesterday, the U.S. government's address has just recovered $19.3 million, less than 24 hours after the initial address breach, and has received 88% of the stolen funds so far.Previous news, according to Arkham monitoring, a cryptocurrency wallet associated with the U.S. government was allegedly hacked, resulting in approximately $20 million in assets being stolen. The stolen funds originated from a portion of the funds seized by the U.S. government in the 2016 Bitfinex exchange hacking incident.

ChainCatcher message, according to @ai_9684xtpa monitoring, after the stolen funds from the U.S. government were transferred to an address starting with 0x348, some stablecoins have been exchanged for 2709 ETH (approximately 6.08 million USD).The exchanged ETH has been distributed to Binance and two new addresses, and the hacker's wallet currently still holds AUSDC worth 13.2 million USD.

ChainCatcher news reports that, according to Arkham monitoring, a cryptocurrency wallet associated with the U.S. government has allegedly been hacked, resulting in approximately $20 million in assets being stolen. The stolen funds originated from a portion of the assets seized by the U.S. government during the 2016 Bitfinex exchange hack.The attackers transferred the stolen funds to a wallet address starting with "0x348". The stolen assets include various cryptocurrencies such as USDC, USDT, aUSDC, and ETH. Arkham reports that the hackers have begun converting stablecoins into Ethereum and laundering the funds through addresses suspected to be linked to money laundering services.Specifically, the attacked U.S. government address is 0xc9E6E51C7dA9FF1198fdC5b3369EfeDA9b19C34c, which previously received funds related to the Bitfinex hack from 9 different government seizure addresses. This includes the address 0xE2F699AB099e97Db1CF0b13993c31C7ee42FB2ac, which was named in the court documents of the Bitfinex case.Previous news reported that the U.S. government address withdrew $6.57 million in stablecoins from Aave, which were then exchanged for 2,135 ETH.

ChainCatcher news, according to PeckShieldAlert monitoring, the hacker address involved in the Radiant Capital attack has bridged almost all stolen funds from Arbitrum and BNB to the Ethereum network, totaling approximately 20,500 ETH, worth about 52 million USD.

ChainCatcher news, according to official sources, the Tapioca Foundation has announced a bounty for hackers seeking the return of stolen assets. The deadline for this proposal has now passed without any response, making the offer to hackers invalid.Contributors of the Tapioca Foundation are currently collaborating with law enforcement and various security organizations. Most of the stolen funds are still in the hands of the hacker team that stole the assets.The Tapioca Foundation is now offering a 10% bounty as a reward for any information or actions that lead to the recovery of the stolen funds.

ChainCatcher news, according to on-chain detective ZachXBT, Chinese OTC trader Yicong Wang has helped the Lazarus Group convert tens of millions of stolen cryptocurrencies into cash via bank transfers since 2022.A few months ago, a follower contacted ZachXBT after their trading account was frozen following a P2P transaction with OTC trader Yicong Wang (using aliases such as Seawang, Greatdtrader, and BestRhea977). He then shared one of Yicong Wang's Tron wallet addresses from a WeChat conversation screenshot.When reviewing blockchain data related to Yicong Wang, a high risk of illicit funds was noted from Alex Labs, co-founder of Irys. Alex Labs was hacked by the Lazarus Group in May 2024, resulting in a loss of approximately $4.5 million. An Ethereum address, 948K, which was blacklisted by Tether in August 2024, is also directly related to Yicong. It is evident from on-chain data that he has continued to actively assist the Lazarus Group in recent weeks.

ChainCatcher message, Radiant Capital has issued a reminder on X regarding the security incident, stating that all users need to take immediate action to protect their wallets.If you have ever interacted with Radiant (or believe you may have), you must immediately revoke authorization for the affected contracts, or you risk having your funds stolen. Please use revoke.cash to protect your assets by removing any permissions to prevent further losses. Radiant will continue to fully track and freeze the stolen funds and work closely with security experts and law enforcement.It is reported that Radiant Capital was previously hacked, resulting in a loss of $53 million.

ChainCatcher message, Tapioca DAO has encountered a major security vulnerability, with attackers stealing approximately 4.4 million dollars worth of cryptocurrency, and the price of TAP tokens plummeting by over 95%.The attackers obtained the private keys through social engineering, resulting in a significant amount of funds being transferred. Nevertheless, the team collaborated with security agencies and successfully moved 1,000 ETH (approximately 2.7 million dollars) to a secure location, preventing further losses. Currently, the hackers still hold part of the stolen assets, and the team is continuing efforts to recover the remaining funds.

ChainCatcher news, Radiant Capital's official social media post reviewed that the protocol experienced a highly complex security vulnerability on the 16th, resulting in a loss of $50 million. The attacker exploited multiple developers' hardware wallets through highly advanced malware injection.During the intrusion, the front end of Safe Wallet (also known as Gnosis Safe) displayed legitimate transaction data, while the poisoned transactions were signed and executed in the background. This vulnerability occurred during a routine multi-signature emission adjustment process, which is conducted regularly to adapt to market conditions and utilization rates. DAO contributors strictly adhered to many industry standard operating procedures throughout the process. Each transaction was simulated on Tenderly to ensure accuracy and was individually reviewed by multiple developers at each signature stage. During these reviews, neither Tenderly nor the front-end checks in Safe showed any anomalies. To emphasize the importance of this, it was completely undetectable during the manual review of the Gnosis Safe UI and the Tenderly simulation of regular transactions, as confirmed by external security teams.Radiant Capital stated that it has been working closely with Seal911 and Hypernative and has implemented more robust multi-signature controls. The FBI and zeroShadow are fully aware of the violations and are actively working to freeze all stolen assets. The DAO is deeply disturbed by this attack and will continue to work tirelessly with relevant agencies to identify the attackers and recover the stolen funds as soon as possible.