Specter

"Because you get rinsed by the same KOL grifters who have done it for years, and you never learn." Just a few weeks ago, CT was praising Kmichi. Some even went as far as calling a known bundler a "mentor." A few weeks later, a token was deployed, and he indirectly promoted it. That same token is now down 96%. Same pattern, as usual. He moves on. Everyone moves on. Come back a few months later, and CT will still be calling him a legend. I stopped spending time on memecoins because it's usually the same pattern over and over, yet people still never learn. I'd rather spend my time investigating real theft cases than chasing grifters and bundlers. My previous post on Kmichi: xitter.cf/SpecterAnalyst/status/… Stay Smart

with contributions from security reseachers and stablecoin issuers... $9M has been frozen

Relay's compliance and team are so bad that DPRK manage to bridged $38M (still bridging) in just 7 hours through the @RelayProtocol Bridge, and they couldn't stop it despite claiming to have an active KYT system. DPRK couldn't laundered that amount within such a short timeframe through THORChain, but Relay opened the door. so bad for you guys.... Address: TNhpfKq83wufEKGjBhQFnT7jnxYmyBzH6F Stay Relay.

Kite freeze 6M in kite and turtle team also seized 3.1M turtle using administrative transfer Total frozen/blacklisted now $3.1B

The Bloom drainer stole nearly $1M and is laundering it like an eight-figure haul. The transfer pattern suggests automation which includes repeated splits, consolidations, and bridges across thousands of addresses. The attacker has used 2,152 unique routing and destination addresses (1,326 Solana, 822 EVM and 5 Zcash) The attacker bridged to zcash with 26.099 ZEC going into the Sapling shielded pool, Stay Smart

For those who don't know how to identify stolen funds, it's often pretty easy. One way to identify a potentially compromised wallet is to look for a sudden change in its established transaction patterns. For instance, TQKJQ, a CoinDCX deposit address, had consistently been sending funds to the entity's hot wallet. Then, suddenly, wallets associated with the entity, including TQKJQ, were swept into a single wallet, which began distributing funds, swapping assets, using OTC services, and more. That's a potential sign of a compromised wallet. So, the point is: CoinDCX and its co-founder are lying.

It's crazy that CT has such a short memory. Scammers, grifters, and rug pullers are quickly forgotten. There seems to have been a coordinated push around @kimchi1x, with CT claiming that he "made eight figures from the TRUMP token." lol I decided to look into @kimchi1x . Based on my on-chain analysis, he and his group, including @orangie , have exposure to token launches, bundling, and rug pulls. Since this thread is about Kimchi, I'll focus on him. Wallet (publicly shared by Kimchi in a reply on X back in April 2024): 2yu3iNjH6zLa8Uqf1s4yKJ1kB9MHYPhMkDbpu8tLmBMC Example 1 – $STAR On May 30, 2024, at 13:41 UTC, $STAR was deployed. Within the same minute, the wallet linked to Kimchi bought 2.96 SOL ($407) and later sold the position for $45.6K. Tx: zWstdZjTHRGzPSEX5NPnfv7QS2412iroNx1HpwHNRBwu6UeyNA57ZMRcZRFfmDSi4V3uF7yHshA1YBKi3TncnF1 Example 2 – DADDY ANSEM On June 11, 2024, at 23:38 UTC, DADDY ANSEM (not launched by Ansem) was deployed. Two minutes later, the wallet linked to Kimchi bought 4.94 SOL ($730) and later sold it for $14.6K. Tx: 4DqJrynmKbaLLjPKLzZYfZwGPxSKtBCirH2Du2vDdd5Z7sfaGfA89W15x4VBzM5wzdm8BiMVA5xk1M8M9UGUut9c Example 3 – MUVA On June 26, 2024, at 22:45 UTC, MUVA was deployed. One minute later, the wallet linked to Kimchi bought 2.9 SOL ($407) and later sold the position for $53K. Tx: 55ZSNgEMDQRKvAvhcSYicrUnPoxuTV1iUR5FdSVoFK7GGXJ4S2rAtEoZ62wh7S4F39DMAHN5guoxfAmpSQwWfwS7 An exchange deposit address also clusters five other wallets that bundled the same MUVA launch. These are just a few examples. I decided not to dig through the wallet's entire bundling history. they have a private group known as @pioneerfnf While there is no verifiable evidence that @kimchi1x made eight figures from the TRUMP token, it's crazy to see someone with this kind of on-chain history being pushed as a role model. It's crazy how CT celebrate grifters and rug pullers even after knowing who they are. Stay smart.

I spent about 13 minutes reading this, and I must say, this is incredible. Just imagine the amount of risk involved and the money spent throughout this investigation. I hope Jimmy gets what he deserves, and that his fat-reducing meals are served with plenty of water in prison. Great job, ser. 👏

If there was no THORChain, shit would be hell for these guys😑. They’re laundering funds across several chains, even on bottom chains like dYdX, Noble, and Osmosis. So annoying. How stupid can you be to publicly post txs link of stolen funds that are being tracked by the public? very soon....

Regarding who is behind the hack: I present to you THE LAZARUS GROUP. just linked this hack to the AFX hack, which stole $24M in July and was specifically attributed to TraderTraitor. The stolen XRP from Bitget was bridged and can be directly linked to the funds stolen in the AFX hack. Stay smart.

Total loss: $353M The remaining addresses rwNhefsz1UQEusxhCvHip3RANinWi4CTck rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs TBWNguTTgezw9dVorX441C6nDrZpRxYwKD