Onchain Investigator | Peace ✌️ Specteranalyst.sol (.eth)
Joined May 2024
- Tweets14.4K
- Following464
- Followers17.6K
- Likes25.2K
Specter retweeted
"Because you get rinsed by the same KOL grifters who have done it for years, and you never learn."
Just a few weeks ago, CT was praising Kmichi. Some even went as far as calling a known bundler a "mentor."
A few weeks later, a token was deployed, and he indirectly promoted it.
That same token is now down 96%. Same pattern, as usual.
He moves on.
Everyone moves on.
Come back a few months later, and CT will still be calling him a legend.
I stopped spending time on memecoins because it's usually the same pattern over and over, yet people still never learn.
I'd rather spend my time investigating real theft cases than chasing grifters and bundlers.
My previous post on Kmichi:
xitter.cf/SpecterAnalyst/status/…
Stay Smart
Hi because you get rinsed by the same KOL grifters who have done it for years and never learn.
I tried calling out Ansem numerous times in the past for promoting micro cap and celeb tokens but gamblers brought him credibility and exit liquidity yet again this cycle.
So why should I care at all?
I am busy with recent incidents like the French bank heist, DPRK, or The Com where my work actually brings measurable impact rather than engagement from calling out known bad actors and saying the obvious.
"Because you get rinsed by the same KOL grifters who have done it for years, and you never learn."
Just a few weeks ago, CT was praising Kmichi. Some even went as far as calling a known bundler a "mentor."
A few weeks later, a token was deployed, and he indirectly promoted it.
That same token is now down 96%. Same pattern, as usual.
He moves on.
Everyone moves on.
Come back a few months later, and CT will still be calling him a legend.
I stopped spending time on memecoins because it's usually the same pattern over and over, yet people still never learn.
I'd rather spend my time investigating real theft cases than chasing grifters and bundlers.
My previous post on Kmichi:
xitter.cf/SpecterAnalyst/status/…
Stay Smart
Hi because you get rinsed by the same KOL grifters who have done it for years and never learn.
I tried calling out Ansem numerous times in the past for promoting micro cap and celeb tokens but gamblers brought him credibility and exit liquidity yet again this cycle.
So why should I care at all?
I am busy with recent incidents like the French bank heist, DPRK, or The Com where my work actually brings measurable impact rather than engagement from calling out known bad actors and saying the obvious.
Specter retweeted
Le groupe Crédit Mutuel Arkéa confirme l'incident dans un communiqué et assure qu'il est terminé.
Le montant du préjudice n'est pas dévoilé.
lemonde.fr/pixels/article/20…
Specter retweeted
Relay's compliance and team are so bad that DPRK manage to bridged $38M (still bridging) in just 7 hours through the @RelayProtocol Bridge, and they couldn't stop it despite claiming to have an active KYT system.
DPRK couldn't laundered that amount within such a short timeframe through THORChain, but Relay opened the door.
so bad for you guys....
Address: TNhpfKq83wufEKGjBhQFnT7jnxYmyBzH6F
Stay Relay.
Guess the only provider specifically mentioned by the FBI to block funds stolen from Binance by the DPRK?
Yes, you're right, @THORChain. They were explicitly mentioned.
I hope @jpthor and @CBarraford will do the right thing this time.
Stay Smart.
Relay's compliance and team are so bad that DPRK manage to bridged $38M (still bridging) in just 7 hours through the @RelayProtocol Bridge, and they couldn't stop it despite claiming to have an active KYT system.
DPRK couldn't laundered that amount within such a short timeframe through THORChain, but Relay opened the door.
so bad for you guys....
Address: TNhpfKq83wufEKGjBhQFnT7jnxYmyBzH6F
Stay Relay.
Specter retweeted
The scale of the danger North Korea poses to crypto has become impossible to ignore.
This is the story of the investigators exposing North Korean operatives working inside the industry.
You think you know who your developer is.
But do you?
🎬 Introducing THE DEVELOPER.
Specter retweeted
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO.
Commingling address:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
Bitget exploit context: xitter.cf/zachxbt/status/2104528…
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
So far, $2.8B has been frozen. Shout-out to the teams for their swift action.
Next: First Digital should help freeze the remaining $3.45M in FDUSD.
Stay smart.
USDT0 just froze 6.18m USDT0 on @0xPolygon tied to the Binance Exploit.
polygonscan.com/tx/0xfab58c6…
Specter retweeted
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Thanks to all other signers involved.
Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5
Trsanction hash: 0xb69c81774f507d46ce776aeaed8b4d31df96dd66ce6fd05073481011835355d6
Specter retweeted
It’s quite nuanced so I am not sure how much benefit a site would end up having.
Majority of CT is not capable of thinking critically about the following:
-what’s the threshold for number of scams promoted before it’s malicious?
-what’s the threshold for undisclosed paid shills before it’s malicious vs accidental?
-when is it fair to call a project a scam vs failure?
(people call projects a scam because the token price never went up or the token was never launched)
-when can you forgive people for past mistakes?
-what burden of proof is considered as evidence?
(people get falsely accused of being paid shills without evidence and it gets a lot of engagement on X bc they’re controversial)
There’s a difference between doing 1-2 paid promotions with the same legit brand for months or years vs multiple per week with a questionable brand.
Ethos made an attempt at reputation however it was abused by low quality farmers.
Majority of CT would see a name on the site and immediately bring out the pitchforks….
The conclusion reached would be the exact same thing everyone knows.
Do not trust random people online.
Specter retweeted
The Bloom drainer stole nearly $1M and is laundering it like an eight-figure haul.
The transfer pattern suggests automation which includes repeated splits, consolidations, and bridges across thousands of addresses.
The attacker has used 2,152 unique routing and destination addresses (1,326 Solana, 822 EVM and 5 Zcash)
The attacker bridged to zcash with 26.099 ZEC going into the Sapling shielded pool,
Stay Smart
The Bloom drainer stole nearly $1M and is laundering it like an eight-figure haul.
The transfer pattern suggests automation which includes repeated splits, consolidations, and bridges across thousands of addresses.
The attacker has used 2,152 unique routing and destination addresses (1,326 Solana, 822 EVM and 5 Zcash)
The attacker bridged to zcash with 26.099 ZEC going into the Sapling shielded pool,
Stay Smart
Specter retweeted
For those who don't know how to identify stolen funds, it's often pretty easy.
One way to identify a potentially compromised wallet is to look for a sudden change in its established transaction patterns.
For instance, TQKJQ, a CoinDCX deposit address, had consistently been sending funds to the entity's hot wallet. Then, suddenly, wallets associated with the entity, including TQKJQ, were swept into a single wallet, which began distributing funds, swapping assets, using OTC services, and more.
That's a potential sign of a compromised wallet.
So, the point is: CoinDCX and its co-founder are lying.
Specter retweeted
It's crazy that CT has such a short memory. Scammers, grifters, and rug pullers are quickly forgotten.
There seems to have been a coordinated push around @kimchi1x, with CT claiming that he "made eight figures from the TRUMP token." lol
I decided to look into @kimchi1x . Based on my on-chain analysis, he and his group, including @orangie , have exposure to token launches, bundling, and rug pulls.
Since this thread is about Kimchi, I'll focus on him.
Wallet (publicly shared by Kimchi in a reply on X back in April 2024):
2yu3iNjH6zLa8Uqf1s4yKJ1kB9MHYPhMkDbpu8tLmBMC
Example 1 – $STAR
On May 30, 2024, at 13:41 UTC, $STAR was deployed. Within the same minute, the wallet linked to Kimchi bought 2.96 SOL ($407) and later sold the position for $45.6K.
Tx:
zWstdZjTHRGzPSEX5NPnfv7QS2412iroNx1HpwHNRBwu6UeyNA57ZMRcZRFfmDSi4V3uF7yHshA1YBKi3TncnF1
Example 2 – DADDY ANSEM
On June 11, 2024, at 23:38 UTC, DADDY ANSEM (not launched by Ansem) was deployed. Two minutes later, the wallet linked to Kimchi bought 4.94 SOL ($730) and later sold it for $14.6K.
Tx:
4DqJrynmKbaLLjPKLzZYfZwGPxSKtBCirH2Du2vDdd5Z7sfaGfA89W15x4VBzM5wzdm8BiMVA5xk1M8M9UGUut9c
Example 3 – MUVA
On June 26, 2024, at 22:45 UTC, MUVA was deployed. One minute later, the wallet linked to Kimchi bought 2.9 SOL ($407) and later sold the position for $53K.
Tx:
55ZSNgEMDQRKvAvhcSYicrUnPoxuTV1iUR5FdSVoFK7GGXJ4S2rAtEoZ62wh7S4F39DMAHN5guoxfAmpSQwWfwS7
An exchange deposit address also clusters five other wallets that bundled the same MUVA launch.
These are just a few examples. I decided not to dig through the wallet's entire bundling history.
they have a private group known as @pioneerfnf
While there is no verifiable evidence that @kimchi1x made eight figures from the TRUMP token, it's crazy to see someone with this kind of on-chain history being pushed as a role model.
It's crazy how CT celebrate grifters and rug pullers even after knowing who they are.
Stay smart.
