@ChainBountyX

ChainBounty is a decentralized platform that helps solve security challenges in the crypto space.

chainbounty.io
Joined November 2024
  • Tweets986
  • Following188
  • Followers699
363Media
🚨 A crypto-scam extradition is a prosecution step—not a conviction or a recovery announcement. The DOJ says Zheng Zhao was extradited from the Netherlands and arraigned in California on October 23 on a money-laundering conspiracy charge. Authorities identified 174 U.S. victims in the alleged Cambodia-based investment scheme. According to court documents described by the DOJ, more than $36.9M moved through U.S. shell-company accounts to one Bahamas bank account, before conversion to USDT and transfers to a Cambodia-controlled wallet. That figure describes the alleged funding route, not money recovered. Zhao is presumed innocent; guilty pleas by eight co-conspirators are separate legal outcomes. Our analysis: the investigation spans bank records and stablecoin transfers. The extradition announcement alone does not establish which assets remain recoverable. #ChainBounty #CryptoScam #MoneyLaundering
🤖 Made with AI
AI-generated conceptual 3D illustration of two graphite checkpoint frames and one closed silver evidence case with a restrained red clasp, on black. Represents cross-border legal handover, not a real suspect, seized cryptocurrency, a conviction or recovered victim funds. No text, numbers or logos.

ALT AI-generated conceptual 3D illustration of two graphite checkpoint frames and one closed silver evidence case with a restrained red clasp, on black. Represents cross-border legal handover, not a real suspect, seized cryptocurrency, a conviction or recovered victim funds. No text, numbers or logos.

34
🚨 An AUSD freeze is not the same as recovered funds. The Ethereum address linked to the Initia exploit by The Defiant received 1.4M AUSD at 15:01:59 UTC on October 23. Etherscan records show it sent that AUSD into a swap route at 15:03:23 UTC; the transaction returned about 581.56 ETH to the same address. Agora's AUSD contract emitted AccountFrozen for that address at 16:31:59 UTC—roughly 89 minutes after the swap. Agora says its contracts are not deployed on Initia and a separate third-party product using AUSD on Ethereum was affected. Our reading: the freeze restricts AUSD at that address; it does not reverse the earlier swap or freeze the ETH. These records do not establish how much, if any, was recovered. #ChainBounty #Initia #StablecoinSecurity
🤖 Made with AI
Conceptual 3D illustration: an empty silver containment ring with a red latch on a black background, and a silver disc already outside it. A token restriction does not reverse assets moved beforehand. Not an evidence image.

ALT Conceptual 3D illustration: an empty silver containment ring with a red latch on a black background, and a silver disc already outside it. A token restriction does not reverse assets moved beforehand. Not an evidence image.

1
194
🚨 X100's treasury controls were reportedly captured through its voting system. Chainalysis says attackers deployed contracts that took protocol Senate seats, gained a voting majority and forced the Freezer treasury to sell into an attacker-controlled pool. Its October 24 UTC analysis reports approximately $4.7M in stablecoins extracted across three exploit transactions. That is an analyst-reported amount, not our independently reconciled net-loss figure. The security boundary here is the route from acquiring votes to executing treasury actions. Reviewing a spending function alone can miss the authority that selects its caller. The exact seat-acquisition rules, execution safeguards and full loss accounting still require transaction and deployed-code verification. #ChainBounty #GovernanceSecurity #DeFiHack
🤖 Made with AI
AI-generated conceptual premium 3D illustration of a graphite vault and two unmarked silver voting discs, one with a restrained red edge entering the control slot, on a black background. Represents capture of governance authority over treasury execution, not actual X100 infrastructure or transaction evidence. No text, numbers or logos.

ALT AI-generated conceptual premium 3D illustration of a graphite vault and two unmarked silver voting discs, one with a restrained red edge entering the control slot, on a black background. Represents capture of governance authority over treasury execution, not actual X100 infrastructure or transaction evidence. No text, numbers or logos.

99
🚨 NovaTech: promoter settlements and a $1.3B court request are different outcomes. In an October 22 release, New York's attorney general announced nearly $6M in settlements with four NovaTech promoters and permanent industry bans. The office separately asked a court to order the founders to pay $1.3B, following an August 2025 default judgment. The office says the scheme recruited through prayer groups and WhatsApp, using promises of high returns and recruitment bonuses. Settlement obligations, requested relief and payments received by victims are separate measures. Neither headline amount establishes that investors have already been repaid. #ChainBounty #CryptoFraud #LawEnforcement
🤖 Made with AI
AI-generated conceptual 3D illustration of a graphite pyramid with a restrained red seam and a dark metal judicial gavel on a black background. Symbolizes enforcement against a pyramid recruitment scheme, not actual NovaTech assets, a seizure, or victim repayments. No text, numbers or logos.

ALT AI-generated conceptual 3D illustration of a graphite pyramid with a restrained red seam and a dark metal judicial gavel on a black background. Symbolizes enforcement against a pyramid recruitment scheme, not actual NovaTech assets, a seizure, or victim repayments. No text, numbers or logos.

62
WAX bridge: following the Ethereum trail. SentinelTX’s report on the reported 22 October incident records four Ethereum payouts to one recipient: 21,558.252354 USDT, 840.2750339 DAI, 2.54669928 WETH and 0.10993227 WBTC. The narrative describes conversion activity before 15.58 ETH moved to a relay. At 10:43:47 UTC, the relay sent 15.5799958 ETH, displayed rounded as 15.579996 ETH, to an address labelled “HitBTC, Exchange”. That is a concrete investigative lead, not proof of a completed cash-out or the identity of the account holder. Each swap’s ETH output is not itemised, so the full proceeds path remains partial rather than an exact token-to-ETH reconciliation. The reported negative-fee flaw on WAX is a separate source-chain question: the report contains no WAX action records confirming the mechanism or mapping individual withdrawals to these payouts. No traced value flow establishes a link between the Ethereum and Solana recipients. Our analysis focuses on the documented Ethereum trail, the transaction anchors and what remains unresolved. It does not calculate an incident-wide dollar loss. community.chainbounty.io/ko/…
ChainBounty Investigation analysis cover dated 25 October 2026. Headline: WAX bridge: ETH trail. Subtitle: Four token payouts. One ETH relay. An exchange-labelled destination. Black text and the original ChainBounty logo on a white background.

ALT ChainBounty Investigation analysis cover dated 25 October 2026. Headline: WAX bridge: ETH trail. Subtitle: Four token payouts. One ETH relay. An exchange-labelled destination. Black text and the original ChainBounty logo on a white background.

74
SentinelTX’s analysis traces the NEM token exploit from BSC through Relay to Ethereum and CoW settlement. Our review separates reported loss from recorded proceeds. The mechanism is assessed, and the historical ETH balance is unverified. community.chainbounty.io/ko/…
ChainBounty investigation analysis titled NEM / NemTokenV2. From BSC liquidity to Ethereum. Recorded flows; unresolved attribution. Dated 24 October 2026. Source: SentinelTX analysis.

ALT ChainBounty investigation analysis titled NEM / NemTokenV2. From BSC liquidity to Ethereum. Recorded flows; unresolved attribution. Dated 24 October 2026. Source: SentinelTX analysis.

82
🚨 Initia halted its L1 and rollups at 15:41:30 UTC on October 23 following a security incident. Researcher Spreek reported unauthorized token minting and approximately $2.6M converted into other assets, with more still moving. That is a researcher estimate, not a project-confirmed loss total. Initia said it was investigating the impact with security teams, validators and exchanges. Its official notice did not confirm the precise flaw or loss amount. The security boundary is token issuance: creating an unbacked balance becomes an asset-loss problem when it can be exchanged for existing reserves. The amount minted, assets withdrawn and eventual net loss are separate quantities—not interchangeable totals. #ChainBounty #Initia #DeFiSecurity
🤖 Made with AI
AI-generated conceptual premium 3D illustration of a graphite token-minting die with a restrained red fracture and two unmarked silver discs on a black background. Represents a compromised token-issuance authorization boundary, not actual Initia infrastructure or transaction evidence. No text, numbers or logos.

ALT AI-generated conceptual premium 3D illustration of a graphite token-minting die with a restrained red fracture and two unmarked silver discs on a black background. Represents a compromised token-issuance authorization boundary, not actual Initia infrastructure or transaction evidence. No text, numbers or logos.

82
🚨 CoinDCX: following a 15,819,002 USDT transfer—and separating the trail from the sweep explanation. Our bounded TRON review verifies the large transfer, 18 departures from its receiving address to six recipients, and three selected onward transfers. A separate sample shows a deposit collected in 21 seconds on the incident day. The records do not establish the sweep outage's start or cause, recipient ownership, customer credits or cash-out. Collector transfer volume is not the incident's loss total. Full investigation: community.chainbounty.io/ko/… #ChainBounty #CoinDCX #TRON
White 16:9 ChainBounty research cover. Left title: CoinDCX / Transfers and / the sweep gap. Right: original CoinDCX and USDT logos in flat 2D. Original ChainBounty logo at lower left. Cover illustration, not transaction evidence.

ALT White 16:9 ChainBounty research cover. Left title: CoinDCX / Transfers and / the sweep gap. Right: original CoinDCX and USDT logos in flat 2D. Original ChainBounty logo at lower left. Cover illustration, not transaction evidence.

73
🚨 Retiring a deposit address does not stop it receiving funds. CoinDCX says addresses compromised in July 2025 continued to receive user deposits after being deprecated. Its October 22 update says the process for sweeping those deposits failed for a period, causing operational losses that the exchange absorbed. CoinDCX says affected deposits were credited and active wallets were not compromised. Those are the exchange’s statements, not an independently reconciled loss or reimbursement ledger. The security issue is the retirement process: an address can disappear from an app while remaining live on-chain. Old-address deposits need detection and a safe handling path—not just a new address in the interface. #ChainBounty #CoinDCX #ExchangeSecurity
🤖 Made with AI
AI-generated conceptual premium 3D illustration: a graphite deposit receptacle with a broken gate still accepts one unmarked silver disc; a detached gate fragment lies beside it. Black background with restrained red accents. Represents deprecated deposit addresses continuing to receive funds, not CoinDCX infrastructure or transaction evidence. No text, numbers or logos.

ALT AI-generated conceptual premium 3D illustration: a graphite deposit receptacle with a broken gate still accepts one unmarked silver disc; a detached gate fragment lies beside it. Black background with restrained red accents. Represents deprecated deposit addresses continuing to receive funds, not CoinDCX infrastructure or transaction evidence. No text, numbers or logos.

125
🚨 Two Ethereum relay paths from the Railway-linked address converge at one Etherscan-labelled HitBTC endpoint. Our bounded review checks four path transactions: an onward receipt of 14.337414 ETH (rounded) and 9,372.183919 USDC. Both USDC Transfer logs match at the raw-integer level. That is evidence of movement, not proof of a common operator, an exchange customer account or cash-out. The full victim ledger and the source-side bridge match remain unconfirmed; the researcher’s reported loss is not independently reproduced here. Read the evidence, exact records and limits: community.chainbounty.io/ko/… #ChainBounty #Railway #WalletSecurity
White 16:9 ChainBounty research cover. Left title: Railway / Following two / relay paths. Right: original Railway and Ethereum logos in flat 2D. Original ChainBounty navigation logo at lower left. Cover illustration, not transaction evidence.

ALT White 16:9 ChainBounty research cover. Left title: Railway / Following two / relay paths. Right: original Railway and Ethereum logos in flat 2D. Original ChainBounty navigation logo at lower left. Cover illustration, not transaction evidence.

70
🚨 On October 21, Railway disclosed possible exposure of customer secrets. A day later, Taylor Monahan reported about $371K in wallet drains across 19+ EVM chains. Railway says some encrypted environment variables may have been decrypted. Monahan identified a suspected sweeper address and 500+ transactions; those figures are her findings, not an independently reconciled loss total. The security boundary is the signing key, not the hosting account. Replacing an environment variable does not invalidate a copied private key: affected wallet assets need a new, independently generated signing key. The exact exposure mechanism and the full set of related wallet losses remain unconfirmed. Railway is the deployment platform, not Railgun. #ChainBounty #Railway #WalletSecurity
🤖 Made with AI
AI-generated conceptual 3D illustration of a graphite cloud-shaped storage capsule and a silver key emerging through a restrained red-lit opening on a black background. Represents exposure of cloud-hosted signing keys; not Railway infrastructure, a real product, or transaction evidence. No text or numbers.

ALT AI-generated conceptual 3D illustration of a graphite cloud-shaped storage capsule and a silver key emerging through a restrained red-lit opening on a black background. Represents exposure of cloud-hosted signing keys; not Railway infrastructure, a real product, or transaction evidence. No text or numbers.

83
Slice on Base: the payout is not the same thing as the onward allocation. The October 20 seed transaction paid 19,820.734002 USDC and 8.716935563284127414 ETH to its sender. In the next swap, 0.000001 USDC came back and 8.052201613921397406 ETH was paid to that address. The USDC input and ETH output are not separate losses. A later 16.788 ETH transfer came from an address that also held pre-event funding. It should not be described as an exact amount of incident proceeds. We checked five subsequent Base departures and four Ethereum receipts in public explorers. The working record's cross-chain pairings remain qualified: the individual transfers exist, but request-level links were not independently established. No incident-specific cash-out or recovery is established here. Read the transaction accounting, source links, and evidence limits: community.chainbounty.io/ko/…
ChainBounty investigation analysis: Slice on Base. Payouts, swaps, and the limits of cross-chain attribution. October 20–21, 2026, UTC.

ALT ChainBounty investigation analysis: Slice on Base. Payouts, swaps, and the limits of cross-chain attribution. October 20–21, 2026, UTC.

1
141
🚨 BiFi's USDT outflow and ETH payout are different stages of the same transaction—not two losses. Our event reconciliation finds a 165,575.149730 USDT net outflow from the handler. Most was swapped for WETH, then unwrapped and split between the transaction sender and block fee recipient. The route is verified more firmly than the proposed cause. Historical-state replay, front-running attribution and incident-specific onward allocation remain unconfirmed. Read the investigation: community.chainbounty.io/ko/… #ChainBounty #BiFi #DeFiHack
White two-dimensional ChainBounty research cover titled “BiFi — Following the ETH payout”, with the BiFi and Ethereum logos and the original ChainBounty logo at lower left. A report cover, not a transaction diagram or proof of cash-out.

ALT White two-dimensional ChainBounty research cover titled “BiFi — Following the ETH payout”, with the BiFi and Ethereum logos and the original ChainBounty logo at lower left. A report cover, not a transaction diagram or proof of cash-out.

1
1
133
🚨 Changing wallet apps does not fix an exposed key. The Polkadot Community Foundation warned on October 21 that Fearless Wallet browser extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code that sent private keys to an attacker-controlled server when the wallet was unlocked. Fearless is a third-party wallet, not an official Polkadot wallet. The foundation advises anyone who used its browser extension since February 2025 to treat those accounts as compromised and move to a newly generated keypair outside Fearless. A password reset, reinstall or importing the same seed into another app does not repair the exposure. The reviewed Android and iOS versions did not contain this code, but a key previously used in the extension remains exposed wherever it is reused. The security boundary is the key—not the app icon. #ChainBounty #FearlessWallet #WalletSecurity
🤖 Made with AI
Conceptual 3D illustration of a matte graphite capsule leaking a polished metal key through a narrow red-lit seam on a black background. Represents private-key exposure from a wallet extension. No text or numbers; not a real product or transaction evidence.

ALT Conceptual 3D illustration of a matte graphite capsule leaking a polished metal key through a narrow red-lit seam on a black background. Represents private-key exposure from a wallet extension. No text or numbers; not a real product or transaction evidence.

82
🚨 The Drift hack was in April. The mixer deposits are continuing in October. Onchain Lens reported about 44,510 ETH sent to Tornado Cash across October 20–21, including 18,800 ETH on October 21. These are reported movements of previously stolen assets, not a new exploit loss. ChainBounty view: a mixer deposit does not establish a specific withdrawal, an exchange cash-out or recovered funds. Any downstream attribution needs separate evidence; similar amounts and timing alone do not identify the recipient. #ChainBounty #DriftProtocol #TornadoCash
🤖 Made with AI
Illustrative 3D metaphor for a mixer obscuring a transaction trail: a metal Ethereum-like diamond, a dark cylindrical chamber with a restrained red accent, and a frosted diamond on a black background. Not a diagram of a verified withdrawal or cash-out.

ALT Illustrative 3D metaphor for a mixer obscuring a transaction trail: a metal Ethereum-like diamond, a dark cylindrical chamber with a restrained red accent, and a frosted diamond on a black background. Not a diagram of a verified withdrawal or cash-out.

92
🚨 Qubic receipt review: 205 transfers from 204 source addresses total 568,777,432,013 QU into one listed recipient. One address paid twice, explaining the count difference. Qubic now reports network restart and first repayments. Our checked inventory does not independently verify the complete sweep, MEXC trail or holder-by-holder refunds. The report separates those project claims from the transfer evidence. Read the investigation: community.chainbounty.io/ko/… #ChainBounty #Qubic #WalletSecurity
White 2D ChainBounty research cover titled “Qubic receipts and the limits of recovery proof.” The official Qubic logo appears on the right; the actual ChainBounty logo is at lower left. A dedicated report cover, not a transaction diagram or proof of repayment.

ALT White 2D ChainBounty research cover titled “Qubic receipts and the limits of recovery proof.” The official Qubic logo appears on the right; the actual ChainBounty logo is at lower left. A dedicated report cover, not a transaction diagram or proof of repayment.

185
An Argent-style smart-wallet report follows a 50,655.918487 USDC receipt and a commingled ETH route. Product identity and exact downstream allocation remain unconfirmed; two backward-time paths are impossible. Read the analysis: community.chainbounty.io/ko/…
ChainBounty investigation analysis: Smart-wallet incident. Repeated executions, traced flows. Product identity remains unverified. October 20, 2026.

ALT ChainBounty investigation analysis: Smart-wallet incident. Repeated executions, traced flows. Product identity remains unverified. October 20, 2026.

1
89
🚨 Qubic says weak wallet-seed generation let an attacker drain 1,404 wallets—around 2.94 trillion QU—between 23:42 UTC on October 17 and 01:26 UTC on October 18. Its October 18 update reported a protective network halt at tick 85,371,949: 87.1% of the drained funds remained on Qubic, while 12.9% reached MEXC, which reportedly froze the receiving account. Containment is not completed recovery; the team said a resolution required a Computor quorum decision. Qubic identified affected seed creation in iPhone/iPad browsers and Mac Safari before October 18, 2026, plus its iOS app before July 2025. It says version 4.26.4 corrected seed generation. Security takeaway: a protocol can process valid signatures while weakly generated keys expose wallets. Fixing the generator protects new keys; it does not make previously weak seeds unpredictable. #ChainBounty #Qubic #WalletSecurity
🤖 Made with AI
Conceptual security illustration: two identical graphite-metal keys with matching teeth beside one dark padlock on a black background, with a narrow red accent. Represents predictable wallet-key generation. No text or numbers; not an on-chain diagram or evidence of a specific transaction.

ALT Conceptual security illustration: two identical graphite-metal keys with matching teeth beside one dark padlock on a black background, with a narrow red accent. Represents predictable wallet-key generation. No text or numbers; not an on-chain diagram or evidence of a specific transaction.

2
232
🚨 Triple-A evidence review: seven DAI receipts and thirteen DAI departures, plus 28 transactions depositing 2,620 ETH into two explorer-labeled pools. Three earlier receipts explain nearly all of the apparent DAI accounting gap. The DAI-to-ETH conversion, wallet ownership and any Zcash continuation remain unproved—these movements are not a verified loss total. Full report: community.chainbounty.io/ko/… #ChainBounty #TripleA #Ethereum
White ChainBounty research cover titled “Triple-A DAI records and pool deposits,” with the actual Triple-A and Ethereum logos on the right and the ChainBounty logo at the lower left. Logos identify the subject and network, not endorsement. This is a cover, not a transaction diagram.

ALT White ChainBounty research cover titled “Triple-A DAI records and pool deposits,” with the actual Triple-A and Ethereum logos on the right and the ChainBounty logo at the lower left. Logos identify the subject and network, not endorsement. This is a cover, not a transaction diagram.

47
X7Pioneer: SentinelTX reports 3.3 ETH sent to a mixer-labeled address, 1.723 ETH to an unlabeled wallet and 1.75 ETH toward a bridge route. A pre-incident payment is excluded from proceeds; bridge settlement remains unverified. Analysis: community.chainbounty.io/ko/…
ChainBounty investigation analysis: X7 Finance, value movements and routing limits. 19 October 2026.

ALT ChainBounty investigation analysis: X7 Finance, value movements and routing limits. 19 October 2026.

128
Load more