Defimon Alerts

🚨Arcus.xyz exploited for $2.2 million on Robinhood chain https://x.com/arcus_xyz/status/2120246299383763171

💌 Onchain message:

This message is from the Arcus team.

On November 9–10, 2026, address 0xeFbf442599310E5CeE1A4EDd5c66334c5f30b3Dd withdrew approximately $2,234,391 from Arcus that it was not entitled to.

We are offering a whitehat resolution: return 90% (approximately $2,011,000 in ETH, WETH or DAI) to the Arcus recovery address below, and keep 10% (approximately $223,000) as a bounty.

Recovery address: 0x1d4324C84e36D8104BDF327474755E5Aa0cFeBc9

If the funds are returned by the deadline, we will treat this as a whitehat recovery, say so publicly, and not pursue further action against you.

Deadline: November 13, 2026, 01:00 UTC.

Reply on-chain or email security@arcus.xyz.

This message will also be sent from the Arcus Finance multisig 0x1d4324C84e36D8104BDF327474755E5Aa0cFeBc9, which is the recovery address.

— Arcus

📤 From: 0x604d2124e96fdaa88b692806f8b964483328b8bb 📥 To: 0xefbf442599310e5cee1a4edd5c66334c5f30b3dd 🌎 Network: mainnet Etherscan

💌 Onchain message:

Wallet breach> FBI/USMS/USPO> as of 11/09/2026 wallet address: 0x43ccc96e8ef36a1bd27dc773ada1d5b0f8959334 is hereby considered compromised; unauthorized transactions are strictly prohibited and subject to prosecution.

📤 From: 0x7e5c3b2688711ed42053df09e5cec1abcacad2d7 📥 To: 0x43ccc96e8ef36a1bd27dc773ada1d5b0f8959334 🌎 Network: mainnet Etherscan

💌 Onchain message:

These are stolen funds. We are actively working to make sure you cannot launder them: your attempt to move them through Railgun failed, and we keep tracking every movement.

As you can see, this is no accident: despite no-KYC exchangers and cross-chain hops, you have not managed to launder the funds.

Contact us and become a whitehat: let's agree on a percentage for returning the funds. We are authorized to negotiate with you.

Email: investigations@amlcrypto.io
Telegram: https://t.me/HopZero
Or via Blockscan Chat.

📤 From: 0x0b31699a91d2a777ab9f5007aa030cd55d5a1c04 📥 To: 0x4567294ab21a2a53b13dd13dc604b1f226229bbb 🌎 Network: mainnet Etherscan

💌 Onchain message:

Follow-up #4: please refund 5 USDT for the incident at block 132425331 (tx 0x8716034e20dee61f7bf5f78ffbbdbc60be4ced8393896bcfafb5a4aeec1f1f2a). Refund to 0x98bc4B5E609Eaa99A80F43152BEC5dBb344d9E45. Finder fee 10% offered. Contact Telegram @AdiMulia.

📤 From: 0x98bc4b5e609eaa99a80f43152bec5dbb344d9e45 📥 To: 0xd715f6dabc496c7eb7ff5324cc01419e6fb3f346 🌎 Network: bsc Etherscan

💌 Onchain message:

BountyBurn:v1:6d6dd853dac10562632b02aff182d617:6655a43d0f33462e224d2f4307b45ea88fb5eaf5d74b68b482b8f10d0f335542

📤 From: 0xa718ca25ba5723d956171997f14236ce921dbda8 📥 To: 0xbadc0de00000000000000000000000000badc0de 🌎 Network: mainnet Etherscan

💌 Onchain message:

https://drainer-watch.pages.dev/ Your money trail is updated. The public tracker now shows 4,711 transfers, including your 8th swap of about 300 ETH and the 268.5 ETH move to 5b4259ad on 9 Nov 2026. I keep my word: I said I would build a tracker for your transactions, and I did. My offer still stands: return 0.737 ETH in two steps of 0.3685 ETH to 0x639D8Fb8f8AdC265b0185af95930029bF79E897a, and I delete the public reports and the tracker the same day step 1 lands. I am waiting for now. Also, I am going back to trace your transactions from a month ago - the more time passes, the deeper you go under the microscope. But tell me: are you really going to risk everything for 2,078 dollars? If step 1 does not come, I will take this further, to media and investigators. 9 Nov 2026, 19:40 UTC. https://drainer-watch.pages.dev/

📤 From: 0x639d8fb8f8adc265b0185af95930029bf79e897a 📥 To: 0x20c4ba365e492bbe95279ebf9df95b32619dfdc0 🌎 Network: mainnet Etherscan

💌 Onchain message:

🚨 INGRAVITY SECURITY ALERT: Wallet 0x2d4dbb... has active drainer threatening $6,861.64 USD. Safe-Harbor rescue calldata ready at https://red-shape-1b3b.daviddelmoral79.workers.dev/api/v1/tx-firewall?ticketId=TICKET-8453-C5601CB1bc_i26d7owr!!!!!!!!

📤 From: 0x7751d19a5c99024dc58f015cb0d751a7eb2602de 📥 To: 0x2d4dbb65bfeb78bf33db8381b381f7e909a395be 🌎 Network: base Etherscan

💌 Onchain message:

🚨 INGRAVITY SECURITY ALERT: Wallet 0x95884d... has active drainer threatening $333.35 USD. Safe-Harbor rescue calldata ready at https://red-shape-1b3b.daviddelmoral79.workers.dev/api/v1/tx-firewall?ticketId=TICKET-8453-F6847EA6bc_i26d7owr!!!!!!!!

📤 From: 0x7751d19a5c99024dc58f015cb0d751a7eb2602de 📥 To: 0x95884db436b05a1b8510b0bd41a9d74fb0de1eaa 🌎 Network: base Etherscan

💌 Onchain message:

🚨 INGRAVITY SECURITY ALERT: Wallet 0x8c2ea6... has active drainer threatening $1,771.40 USD. Safe-Harbor rescue calldata ready at https://red-shape-1b3b.daviddelmoral79.workers.dev/api/v1/tx-firewall?ticketId=TICKET-8453-24E5AF9Fbc_i26d7owr!!!!!!!!

📤 From: 0x7751d19a5c99024dc58f015cb0d751a7eb2602de 📥 To: 0x8c2ea65ee3922a66d8efbe0afc3a7e5a75c15cc7 🌎 Network: base Etherscan

💌 Onchain message:

🚨 INGRAVITY SECURITY ALERT: Wallet 0x5bc60b... has active drainer threatening $5,529.80 USD. Safe-Harbor rescue calldata ready at https://red-shape-1b3b.daviddelmoral79.workers.dev/api/v1/tx-firewall?ticketId=TICKET-8453-E11B1583bc_i26d7owr!!!!!!!!

📤 From: 0x7751d19a5c99024dc58f015cb0d751a7eb2602de 📥 To: 0x5bc60b9a834e760742dc0ccceaf67fd08fd98287 🌎 Network: base Etherscan

🚨 Zenji (zensats.app) - Loss ~$4.9K (2026-11-08) Token: USDT / crvUSD Network: Ethereum Type: Oracle/Price Manipulation (Flash Loan) Zenji's leveraged LlamaLend vaults (ZenjiWstEthLlamaUsdtStakeDao 0x23f1…dd2c, ZenjiWbtc… 0x18e2…3f74) expose a permissionless rebalance(). It values the StakeDAO Curve-LP yield strategy and the LTV/strategy-debt ratio from the crvUSD/USDT StableNG pool's own metrics (get_virtual_price, calc_withdraw_one_coin) — the same pool used to unwind the position. Attacker flash-borrowed 7.24M USDT (Morpho), swapped USDT→crvUSD in pool 0x390f…7bf4 to skew it, then called rebalance(): the vault read the manipulated pool state as "LTV/ratio out of band" and deleveraged — withdrawing LP and trading crvUSD through the skewed pool at a bad price. Attacker reversed the swap (crvUSD→USDT) and pocketed the spread. The swap minOut floor reuses the same manipulable pool quote, so it gave no protection. Net ~$4.95K USDT to attacker; ~$8.36K drained from the Curve pool. TX: https://etherscan.io/tx/0x79fa5b304186be7eaa19a59f57b82e1fa942afee92da45ae73afe27ee817d701 Attacker: https://etherscan.io/address/0x22161ac9d7cfeef020fa91f3eda41c75818a24f9 Victim: https://etherscan.io/address/0x23f189de34eed95f6303cff1c77f7676f211dd2c @defimon_subscription_bot

💌 Onchain message:

Follow-up #3: please refund 5 USDT for the incident at block 132425331 (tx 0x8716034e20dee61f7bf5f78ffbbdbc60be4ced8393896bcfafb5a4aeec1f1f2a). Refund to 0x98bc4B5E609Eaa99A80F43152BEC5dBb344d9E45. Finder fee 10% offered. Contact Telegram @AdiMulia.

📤 From: 0x98bc4b5e609eaa99a80f43152bec5dbb344d9e45 📥 To: 0xd715f6dabc496c7eb7ff5324cc01419e6fb3f346 🌎 Network: bsc Etherscan

💌 Onchain message:

4th Batch but this address is on Bot watch becareful and might not be able to trade with if fully compromise

📤 From: 0x1679976753a80aa9f4a8e21d4f967a90853c423b 📥 To: 0x27d2e5dc8ecf25735472e1661a564002d8849d33 🌎 Network: bsc Etherscan

💌 Onchain message:

STOP CLAIM DNX BRIDGE OR YOUR ADDRESS WILL GOT HACK

📤 From: 0x78611b440aa6559e0ce5ba0882d41c87e2a1c02d 📥 To: 0x210c1331be6ce5bc4f2adabc725761dbfc64a457 🌎 Network: mainnet Etherscan

💌 Onchain message:

STOP CLAIM DNX ON YOUR ADDRESS OR YOUR ADDRESS WILL GOT HACK!

📤 From: 0x71c26fadf3a87eaac283a360ef39351f5ab176f8 📥 To: 0x210c1331be6ce5bc4f2adabc725761dbfc64a457 🌎 Network: mainnet Etherscan

💌 Onchain message:

**drainer-watch.pages.dev** — the site I told you about is live. Go and see it. The record of your network since 18 October 2026 is there — 2,791 transfers, $29.80 million in stablecoins and 2,568.46 ETH traced — and it is kept up to date. Nothing disappears from the record now.

Since my last message, four more deposits from your network reached Bybit Hot Wallet 5: 200 USDT on 31 October 2026 (UTC), and 1,521.32, 520 and 268 USDT on 2 November 2026 (UTC) — 2,509.32 USDT in total. A freeze request was sent for each one. That is seven freeze requests now, seven replies, and no freeze confirmed. The requests stay on file.

Your network also moved about 800.95 ETH through the same swap service in four swaps on 3–4 November 2026 (UTC): 205.74, 262.61, 80.00 and 252.60 ETH. The wallet that sent them now holds almost nothing. Every one of those moves is on the site too, with its transaction hash and block number.

The stolen 0.5189 ETH is still untouched, and the standing offer is still open while it stays untouched: keep $300, return 0.737 ETH in two steps of 0.3685. When the first 0.3685 arrives, both public reports and this site are deleted the same day. When the second 0.3685 arrives within 24 hours after that, the swap-service reports are withdrawn and the pursuit ends permanently.

I want nothing else from this. I just need my money back — it was everything I had, and I have no choice but to see this through to the end. I know $2,078 is nothing to you.

You can reach me on Telegram: @ed7ls. It is also on the site. I am waiting for your move. Go and see it for yourself: **drainer-watch.pages.dev**.

📤 From: 0x639d8fb8f8adc265b0185af95930029bf79e897a 📥 To: 0x8f171c739dc939179bfd3c70739263c380b3e577 🌎 Network: mainnet Etherscan

🚨 TENDRIL (Flap-style tax token) - Loss ~$555K (2026-11-04) Token: $TENDRIL @ $0.000001 Network: BNB Chain Type: Flash Loan / Oracle (spot-price) Manipulation — fee-on-transfer tax-token auto-liquidation A fresh Tornado-funded contract (0xc8cb…e0f8) flash-borrowed ~30.6M USDT from the PancakeSwap Infinity Vault (0x238a…e6c4), then repeatedly ran swapExactTokensForTokensSupportingFeeOnTransferTokens (USDT→TENDRIL) through the thin TENDRIL/USDT pair 0x5de0…99e0. TENDRIL's _transfer applies a 30% tax and, on every taxed transfer, calls _poolControl.sellToken(amount) (controller 0xd00be871) which dumps the controller's accumulated TENDRIL into the pair for USDT at the attacker-manipulated spot price. By skewing the pool first, the attacker made that auto-liquidation sell TENDRIL far above its true value, draining the pair's USDT reserve, repaid the flash loan in the same vault lock, and swept the profit. The TENDRIL/USDT pool lost ~555K USDT (~$555K); attacker payout addresses received ~$541K. TX: https://bscscan.com/tx/0xfdff4fba4327821c204af07944076ecaaee163a994398fdf4063d08712e40059 Attacker: https://bscscan.com/address/0xb81e4aafa347b27112b7f6f5de6cf7cd516021ff Victim: https://bscscan.com/address/0xd00be871eb7a5cb8a69aea41e4c95affc92e54fe @defimon_subscription_bot

💌 Onchain message:

Your 194.2531 DAI (about $194) from the Eminence exploit refund was never claimed. We claimed it for you and paid the gas. It is already in this wallet, sent by the official refund distributor 0x5e37996bcff8c169e77b00d7b6e7261bbc60761e. No action needed. This is a small project; your support keeps it running for more people. Suggested tip: 10%, 19.4253 DAI (about $19), to 5.unlost.eth (0x806e6D519705DB6AAdd6Afee9bE545607452b3f3). Thank you. Not affiliated with Yearn. We never ask for keys, seed phrases, signatures or approvals.

📤 From: 0x806e6d519705db6aadd6afee9be545607452b3f3 📥 To: 0xadb9078b21685e3d1ea01669ffbfe9995b10dc1c 🌎 Network: mainnet Etherscan

💌 Onchain message:

Your 113.6878 DAI (about $114) from the Eminence exploit refund was never claimed. We claimed it for you and paid the gas. It is already in this wallet, sent by the official refund distributor 0x5e37996bcff8c169e77b00d7b6e7261bbc60761e. No action needed. This is a small project; your support keeps it running for more people. Suggested tip: 10%, 11.3687 DAI (about $11), to 5.unlost.eth (0x806e6D519705DB6AAdd6Afee9bE545607452b3f3). Thank you. Not affiliated with Yearn. We never ask for keys, seed phrases, signatures or approvals.

📤 From: 0x806e6d519705db6aadd6afee9be545607452b3f3 📥 To: 0x6642715cf5a7c6ef75c2e1312a8aad22799beb8f 🌎 Network: mainnet Etherscan