@CipherOwl
Account based inNorth America
About this account
- Account based in
- North America
- Connected via
- Web
Account-level information from X, not a live location or the device used for a specific post.
Building the compliance infra and intelligence for institutions and agents 🦉| Team ex-Coinbase/Cruise/AWS Start Scanning 🔎 https://nitter.cf/t.co/NgU5fdC9Xn
San Francisco
Joined May 2024
- Tweets418
- Following54
- Followers3K
- Likes791
Pinned Tweet
Arc 🤝 CipherOwl
Arc mainnet is live, and CipherOwl supports Arc as a compliance partner from day one. Real-time risk screening and investigation tooling for the Economic OS for the internet.
Congrats to the @Arc team. Explore: arc.io
Arc Mainnet is live.
Arc launches as the Economic OS for the internet: an open platform for global markets, real-time value movement, tokenized assets, and agentic economic activity.
Arc is more than a blockchain.
It launches as a full-stack financial platform with assets, applications, interoperability, developer infrastructure, and Circle platform services live from day one.
Arc delivers USDC as native gas, deterministic sub-second finality, EVM compatibility, and institutional validators.
It integrates with Arc Studio, App Kits, Arc Portal, Circle Agent Stack, CCTP, Gateway, CPN, and StableFX.
A complete economic platform at genesis.
Arc launches with infrastructure for:
→ Agentic economic workflows
→ Lending and borrowing
→ Trading and liquidity
→ Onchain FX
→ Payments and settlement
→ Tokenized assets
→ Exchanges, wallets, custody, compliance, data, and developer tooling
190+ institutional and ecosystem builders are building across Arc.
@bitget hack event $128M+ , and here is the fund traced as for now - it is another unfortunate day.
This is for you, bots and agents
Ethereum
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : USDT 34,751,168.120990
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : USDC 12,852,046.242513
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 9,234.098709312
- 0xffa8DB7B38579e6A2D14f9B347a9acE4d044cD54 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 15,362.477231303
- 0x5bdf85216ec1e38D6458C870992A69e38e03F7Ef (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : XAUt 3,000.322053
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x600cfedc6bd65fa79b604dc44964f419e45784b2 (none [funds held], Bitget Hacker, eoa) : ETH 10,000
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0xd2c2f029eff5cacc686f24377cfddcfc82d9f899 (none [funds held], Bitget Hacker, eoa) : ETH 10,000
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0xdc2901f741b4003e32b8b752e97b8c4c1891dc63 (none [funds held], Bitget Hacker, eoa) : ETH 4,596.47
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x7c9332f7b33190549a30c724233650675f573e1c (none [USDC held], Bitget Hacker, eoa) : USDC 12,852,046.24
- Open: USDT 34,751,168.12 and XAUt 3,000.322053 onward hops not yet in retrieved pages.
Arbitrum
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : USDT0 19,668,851.773202
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) : USDT0 19,668,851.77
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x111116053f09d34a7eae8102887004445176ca11 (DEX aggregator, 1inch, contract) : USDT0 563,097.843
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x2d5805a423d6ce771f06972ad4499f120902631a (MEV Bot, none, contract) : USDT0 62,566.427
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0xe35e9842fceaca96570b734083f4a58e8f7c5f2a (bridge, Across Protocol, bridge) : ETH 1,600
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0xef4fb24ad0916217251f553c0596f8edc630eb66 (bridge, deBridge Finance, bridge) : ETH 1.001212889020354521
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x202e8cfcfeae53b5050935a5e926ebb9679d28cd (Theft, Bitget Hacker, eoa) : ETH 1,000
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x2bca667d37afe8d065ca46e3261e9442e77cbeae (none, Bitget Hacker, eoa) : ETH 4,510.343090844795884582
BNB Chain
- 0xffa8DB7B38579e6A2D14f9B347a9acE4d044cD54 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : BNB 12,719.460681306
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) : BNB 12,719.45
- 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) -> 0xe07bd590e1198666230932bad5db3dbbe21e7d57 (none, Bitget Hacker, eoa) : BNB 10,711.734858028582086530
- 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) -> 0xaec23140408534b378bf5832defc426df8604b59 (Service, verify, eoa/contract) : BNB 2,000
- 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) -> 0xdc264714f68d84cf29bc605589405e78bdbe7c9f (smart contract, verify, contract) : BNB 1,000
Base
- 0x97b9D2102A9a65A26E1EE82D59e42d1B73B68689 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 1,555.318215225
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x469ac1406de92f82c0563477240a3627057425dc (Hack/Theft, Bitget Hacker, eoa) : ETH 1,555.31
Optimism
- 0x5bdf85216ec1e38D6458C870992A69e38e03F7Ef (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 5,737.680149787
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x94a43df7687a8494948be937400e9d5d33135da0 (Theft/Hack/Money Laundering, Bitget Hacker, eoa) : ETH 5,737.67
A previously parked wallet publicly reported as holding alleged FoxMarket exploit proceeds moved 10,000 USDT today. It still holds 109,136.47 USDT on BNB Chain.
On BNB, the lock looked like a same-chain swap. Decoding the @lifiprotocol intent showed a bridge to Arbitrum. Two seconds later, 9,989.96 genuine Circle USDC reached the same address.
This LiFi hop is a service boundary in the trace. We followed the intent fill and verified the token contract, excluding lookalike symbols. After another wallet hop, 9,889.9626 USDC entered LiFi Diamond again on Arbitrum. The second bridge leg remains open.
More to come if you reply
Workbench: app.cipherowl.ai/workbench/p…
BNB seed tx: bscscan.com/tx/0x0cc582c2543…
Another piece of update -
cipherowl.com/blog/cipherowl…
OFAC's Xinbi action requires one connected screening update across a marketplace, two app companies, and listed TRX addresses.
@USTreasury designated Xinbi Guarantee as a transnational criminal organization on September 9. OFAC also designated SafeW Technology, whose messenger Xinbi networks used to coordinate buyers and sellers, and Anwen Technology, which developed the XinbiPay/NewPay wallet.
Sanctions teams should deploy Xinbi's names and listed TRX addresses with both app vendors. Preserve the list version and effective date with each hit so reviewers can distinguish a pre-designation transaction from a stale screen.
ofac.treasury.gov/recent-act…
For teams investigating the @Liquid_BTC incident, here is a reproducible SR3 triage of the disclosed recipient:
bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 detect bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 screen bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte --chain bitcoin
cipherowl-sr3 metadata labels bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 metadata entities bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 reason risk bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
Our SR3 2026.2.0 production run detected bitcoin_bech32. Screening returned foundRisk=false under the resolved co-defi configuration. Labels, entities, and risk reasons returned NO_RESULTS.
That does not verify the purported white-hat claim or clear the recipient. It means SR3 found no risk result under the selected configuration and current data coverage. Bitcoin transaction decoding is still under development in this version, so investigators must verify the remaining evidence outside the CLI.
By 2026-09-07 16:09 UTC, 3,400 BTC had been returned and about 598.5 BTC remained. An unsigned impostor also tried to redirect the return. Ten PGP-signed messages from @Blockstream were verified off-CLI.
The operating lesson: screen the address, record the resolved configuration, distinguish NO_RESULTS from exoneration, then verify signed instructions and reconcile every return transaction.
Public casefile:
claude.ai/code/artifact/07fe…
nitter.cf/Liquid_BTC/status/2096…
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.
Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident.
Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.
Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.
You can monitor the situation via @mempool's liquid.network site below:
mempool.space/address/bc1qdl…
Compliance should not become the slowest call in a stablecoin payment path. CipherOwl screens in under 10ms on the hot transaction path. Compare processor and gateway plans: cipherowl.com/pricing
Most filing institutions reported only a snapshot of the scam lifecycle.
In its new alert, @FinCENnews traces the path in three stages: victim payment, on-chain laundering, then integration through money mules, overseas exchanges, P2P exchangers and OTC brokers.
FIN-2026-SCAMCENTERS gives filers a common marker. A useful SAR also needs the evidence that connects one phase to the next: accounts, entities, other financial institutions, wallets, transaction hashes and service providers.
OFAC’s new Iran determination creates a question that list screening cannot answer.
@USTreasury’s August 24 determination makes “operating in” Iran’s digital-asset sector a basis for designation under E.O. 13902. An SDN or listed-wallet match can show that a party is already named. It cannot establish whether an unlisted counterparty operates in the sector.
That second judgment needs dated sources showing who the counterparty is, what it does, and how it is connected to Iran. The determination expands designation authority; it does not automatically block every digital-asset actor.
We don’t need decentralization unless we require trust and self-sovereignty. In well-managed countries where law and order are respected (most of the time), users can get trust easily from centralized organizations along with convenience plus efficiency. With self-sovereignty being sanctified, it is not important for most people in 99% of cases.
We learned these in the hard way …
Vertical harness holds significant special value.
A thesis: the next important LLM training set will come from the harness, not the chat window.
We can already observe the pattern in coding agents and other tool-using systems.
The most valuable data is no longer just what users ask or what models answer. It is the full execution trace:
which tools the model selected
how it decomposed the task
where it failed
how it recovered
which actions produced a correct outcome
This is qualitatively different from ordinary conversation data. It captures how a model operates inside a real environment.
That creates a powerful flywheel.
A better harness supports more useful tools and workflows.
More tools create more real-world execution traces.
More traces provide better data for training tool selection, planning, recovery, and evaluation.
Better models then make the harness more capable, which attracts even more tools and usage.
Better harness → more utilities → more execution logs → better models → better harness
The implication is that the harness is not merely infrastructure around the model.
It is a data-generation system.
Over time, the strongest model companies may not be the ones with the most conversations. They may be the ones that capture the highest-quality traces of models doing real work.
X402.cipherowl.com provides exchange grade wallet screening service at low cost - pay with your USDC on Base
The draft from @BankingGOP and @SenLummis places suspicious-activity monitoring, transaction records, independent testing and risk-based examination in the same supervisory loop.
The supervisory focus is the operating AML/CFT program over time, not any single screening result.
nitter.cf/BankingGOP/status/2079…
NEW: @SenLummis released comprehensive market structure legislation today.
The Clarity Act protects investors, combats illicit finance, and keeps innovation in America.
Read more:
lummis.senate.gov/press-rele…
Onchain finance can reach internet scale. Compliance scales as labor.
@leozc: public settlement needs accountable execution. Onchain compliance must apply policy and turn exceptions into evidence-backed cases so accountability scales with open rails.
nitter.cf/leozc/status/207974536…
@a16zcrypto is right that institutions adopt blockchain through cost, control, and accountability.
But open rails and institutional controls are not competing end states. Public networks provide liquidity and distribution. The institutional layer must provide identity, policy, evidence, and exception handling.
The winning stack is public settlement with accountable execution.
nitter.cf/a16zcrypto/status/2077…