Match Systems

🛡 Our Case. Episode 6 600K in One Transaction: How Deep Analytics Revealed a "Hidden" Block In one of our cases, a client lost over $3 million to theft. We immediately performed AML tagging so the assets would be flagged as stolen across exchange AML systems. One address stood out from the rest: approximately $600,000 in Bitcoin had been sitting in a separate wallet for an extended period — with no visible connection to any crypto service. No public links. A genuinely complex situation. We applied advanced investigative methods and additional checks, including clustering of related addresses. Eventually, we identified that this "invisible" address belonged to one of the major exchanges. The funds were blocked based on our AML tagging. We received confirmation of the block from the service and, together with the victim's law enforcement authorities, initiated the recovery process. Conclusion Basic analytics isn't always enough. Some blocks triggered by AML tagging remain hidden — and without deep analysis and specialized techniques, certain addresses simply cannot be attributed to an exchange at all.

🔐 Crypto Theft Schemes in 2026 — And How to Protect Your Assets Crypto scammers never sleep. While you're reading this, someone is losing funds to drainers, phishing attacks, SIM swaps, or a months-long "pig butchering" con. We broke down the most common attack schemes tracked by Match Systems analysts: 🪤 Crypto Drainers — you sign the permission yourself, thinking it's a routine action. The script handles the rest. 🎣 Phishing & Fake AML Checks — pixel-perfect clones of real services that ask you to "connect your wallet." Legitimate AML checks never require wallet access. Ever. 📋 Clipboard Hijacking — you copy a wallet address, but malware has already swapped it for the attacker's. The first and last characters often match — so you won't notice. 🐷 Pig Butchering — weeks of "friendship" or "romance," a too-good-to-be-true investment platform, then the withdrawal freezes and your new "friend" vanishes. 💸 Recovery Scammers — already been robbed? That's when "blockchain specialists" appear, promising to get your funds back — for an upfront fee. It's the second hit. Plus: OTC traps, dust attacks, fake ICOs, Ponzi schemes, and more. 3 rules that actually work: ✅ Slow down — urgency is a scammer's favorite weapon ✅ Separate your wallets by purpose — never use your main holdings wallet for day-to-day activity ✅ Keep your holdings private — in crypto, oversharing is an open invitation Full breakdown of every scheme, protection tips, and a step-by-step guide on what to do if you've been hacked — on our website.

Fake USDT is becoming a real problem in crypto. Scammers create tokens that look identical to USDT and send them to victims hoping they won’t notice the difference. In this article for CryptoTimes, we explain: • how fake USDT works • how scammers trick users • what to check before accepting a transaction If you work with crypto — it’s worth knowing how this scheme works. Read the full guide: https://www.cryptotimes.io/learn/fake-usdt-what-it-is-how-to-detect-it/

🚨 FATF: Stablecoins were the primary vehicle for illicit crypto transactions in 2025 On March 3, 2026, the Financial Action Task Force published a report outlining the risks associated with stablecoins and unhosted wallets. According to the report, up to 84% of illicit crypto transaction volume in 2025 involved stablecoins. A particular concern is P2P transfers conducted via unhosted wallets, outside regulated infrastructure. What does this mean in practice? A stablecoin is not a “clean money guarantee.” If a token was previously linked to illicit activity, the risk of restrictions or asset freezes may arise when depositing funds to an exchange.

How to reduce your risk exposure: ✅ Check the sender’s address before accepting funds. ✅ Avoid large P2P transfers without prior risk assessment. ✅ Assess your own wallet’s risk level before depositing funds to a CEX. ✅ Remember: a direct wallet-to-wallet transfer does not mean AML analytics are absent.

Regulatory scrutiny of the stablecoin segment is likely to intensify. And in many cases, it’s not the criminal who gets restricted first — it’s the unprepared user. In crypto, caution isn’t paranoia. It’s hygiene.

🛡️ How to protect yourself from “dirty” crypto Like we said — you can lose your funds, even if you did nothing wrong. Exchanges and crypto swap services check incoming transactions for AML risks 🔍

How to stay safe: ✅ Before accepting crypto, check the sender’s address to identify potential risks and reduce the chance of being blocked on a CEX. ✅ Before sending crypto, check your own wallet. If the risk score looks high — better not to send to a CEX to avoid getting flagged. ✅ Before withdrawing from an exchange, check the destination address. If you’re sending funds to a risky wallet, your CEX account could be blocked.

⚠️ You can use swap services with softer AML checks, but keep in mind: some CEXes may block funds even with just 2–3% exposure.

🔴 After withdrawing, it’s safer to create a new wallet for future transfers.

👉 You can do AML checks in just a few clicks using @MsAmlBot

🛡 Our Case. Episode 5 The Long-Term Effect of AML Tagging: Blocks Still in Place a Year After the Theft In 2024, a major Asian exchange became the victim of a high-profile hack that media outlets linked to the so-called North Korean “crypto army.” Hundreds of millions of dollars were stolen. At the initial stage, the exchange chose to conduct the investigation independently. We continued monitoring the case for research purposes. Throughout this period, we tagged newly related addresses and tracked further fund movements. Nearly a year later, the exchange returned to us for assistance. At that point, the key outcome became clear: the previously established AML tagging was still effective. Assets continued to be blocked across multiple exchanges, despite the time that had passed. Large platforms strictly follow their AML policies and maintain restrictions on assets when relevant tagging is present. As a result, even months later, a portion of the funds remained frozen and available for transfer back to the affected party. Conclusion This case shows that AML tagging is not only about speed in the first hours after an incident. It is about creating a durable trail that continues to work months later.

😫 Why does one exchange allow a transaction with Medium risk, while another blocks it? Because a risk score is not the truth. It’s a reflection of the specific tool and the depth of data behind it. First, AML services build their databases in very different ways. If a tool simply doesn’t have information about certain addresses or connections, it may show Low or Medium risk. That doesn’t mean the address is “clean.” It means the data is incomplete. Second, what really matters is which AML tools are used by the compliance team of the crypto service that froze your funds. The same address can look acceptable in one system and trigger stop-flags in another — sanctions exposure, high-risk sources, or links to problematic clusters. And there’s another detail most people don’t talk about. 🤫 There are AML services on the market (we won’t name names) that show different risk scores for the exact same address: 🔵 one version for a regular user who buys a $1–2 report 🔵 and a completely different view for compliance teams with full platform access The user sees Medium risk. The exchange sees a set of red flags. The outcome is a freeze. No “exchange mistake” involved. The takeaway is simple: a risk score without understanding the data source, labeling depth, and decision context is a very poor reference point. We explain how address labeling actually works — and why speed and data depth matter more than a number in a report — in detail here. 🤔 So think about it: are you trusting the number — or the infrastructure behind it?

🛡 Our Case. Episode 4 How AML Tagging Stopped a $200,000 Withdrawal In one of our cases, a crypto exchange in the CIS region lost approximately $200,000 USDT. The theft occurred during an exchange transaction and was carried out using a man-in-the-middle scheme, commonly referred to as a “triangle” attack. The affected service responded immediately and contacted us right after the incident. We performed AML tagging of the involved addresses and added them to analytical databases. A few days later, the attacker attempted to withdraw and exchange the stolen funds through another exchange. However, that platform was already running an AML system that recognized our tagging. As a result, the transaction was halted. With legal support, the funds were returned to their rightful owner. Conclusion This case clearly shows that exchanges operating within a shared anti-fraud framework reinforce each other and reduce risk across the entire ecosystem. This outcome was possible only because the second exchange was already connected to our AML service. Connect to the Match Systems AML infrastructure to stop suspicious transactions before funds are withdrawn.

Trust Wallet Card Scam Instagram ads have started appearing with the wording “official Trust Wallet card with no KYC.” Even at this stage, the offer should raise questions, but the flow becomes more interesting further on. The ad does not lead to an official domain, but to a landing page at trustalpha.plus, styled to resemble Trust Wallet. The key detail is that when the button is clicked from a mobile device, the user is not taken to a regular browser. The page opens inside Trust Wallet, in the wallet’s built-in browser. For an unprepared user, this looks like a native part of the application. Next, another site loads, trustwallet.guide, where the user is invited to “activate the card.” To do so, they are asked to enter their seed phrase. From a social engineering perspective, the flow is well constructed: ad → pseudo-official domain → built-in wallet browser → sense of legitimacy → theft of funds. The seamless transition inside the wallet is what makes this scheme particularly dangerous. Visually, it does not feel like a redirect to a third-party resource. The main weak point of the scheme is the direct request for the seed phrase. If a contract drainer had been used instead, user losses could have been significantly higher. A reminder: any “wallet products without KYC” have no relation to official services. The fact that a page opens inside a wallet does not make it official. A seed phrase is never used for activations, cards, or confirmations. Stay safe. 👋 Match Systems

🛡 Our Case. Episode 3 Theft via Aptos: Even Obscure Blockchains Won’t Help Criminals Hide In one of our cases, a well-known crypto influencer was compromised. Under the pretext of attending a conference, the attackers convinced him to install malicious software, which gave them access to local wallets and allowed them to start draining funds. The assets were withdrawn across multiple networks — BTC, ETH, Solana — as well as less common blockchains, including Aptos, in significant volumes. The assumption was clear: these networks are analyzed less frequently. We promptly tagged the attacker’s addresses across all analytical systems available to us and placed them under continuous monitoring. As a result, more than $100,000 was frozen on exchanges across different jurisdictions. Notably, a substantial portion of the funds was intercepted specifically on the Aptos network. Conclusion: Using a less popular blockchain is not a guarantee of safety for attackers. AML tagging across analytical tools combined with continuous monitoring works there as well.

🎄 Happy New Year! The year coming to an end was a challenging one for the market and for everyone working in the crypto industry. It demanded focus, responsibility, and well-considered decisions. For our team, it was a year of intensive and truly meaningful work. ❤️ Thank you to all our clients and partners who stood with us throughout the year. New challenges lie ahead, and we are ready for them. We wish you resilience in difficult moments, clarity of focus, and steady progress toward your goals. We will continue doing our part so that you and your assets remain secure. 👋 Match Systems

Match Systems | Trust Wallet (Chrome Extension) — Incident Analysis Over the past 24 hours, we have observed a surge of reports about unauthorized withdrawals affecting users of the Trust Wallet Browser Extension for Chrome. The Trust Wallet team has officially stated that the issue affects only extension version v2.68 and has recommended disabling it and updating to v2.69. According to their statement, mobile users and other extension versions are not impacted. Based on our assessment, the incident most closely resembles a supply-chain compromise — specifically, a compromised update or component of the extension. In such cases, an attacker typically aims to gain access to critical wallet data (primarily the seed/mnemonic) or the signing process itself, after which fund theft becomes a matter of automation and time. Our initial review shows that victims’ funds are drained quickly, then dispersed across multiple chains and partially routed through exchange services. This is important because these points sometimes allow for intervention — AML responses, outreach to platforms, and in certain scenarios, freezes involving issuers and/or law enforcement requests. The total damage and number of affected users are still being clarified, but public estimates exceed $7 million. Our analytics also indicate the presence of large victims in this case: one with losses exceeding $3 million, and another with losses over $700,000. The highest risk applies to users who ran Chrome extension v2.68 (especially if they imported or entered a seed during that period). Even if you “did not sign anything,” a compromised extension can be sufficient for subsequent fund theft. If you had v2.68 installed, disable the extension and update to v2.69 from the official source. If your seed may have been compromised, act as you would after a leak: create a new wallet with a new seed and transfer assets, preserve evidence (extension version, timestamps, addresses, txids). If you were affected, save all transactions, addresses, and timestamps, prepare a brief incident timeline, and initiate the process by filing a police report — this is what enables official requests to platforms and potential freeze/recovery actions. We are continuing to collect artifacts and conduct on-chain monitoring of related flows. Trust Wallet has officially announced its readiness to compensate all affected users of the Chrome extension impacted by this incident. This involves hundreds of affected wallets. The Trust Wallet team has confirmed that they will work directly with each affected user for individual case review and to arrange reimbursements. It is important to retain all evidence and contact support through the project’s official channels.

🛡 Our Case. Episode 2 How the attacker tried to evade tagging 7 times A mining client, a compromised seed phrase, and a $250,000 theft . At first, the case looked fairly standard.But it quickly turned into a race between the attacker and our investigator. We immediately tagged the attacker’s addresses as stolen funds, sending a clear signal to exchanges and services across the ecosystem. In response, the attacker began routing the funds through multiple centralized and decentralized (DEX) services, trying to break the tracking trail and wash out the tagging. Each time the funds surfaced on a new address, we tagged it again, restoring full visibility of the stolen assets. Within 48 hours, this happened seven times: seven escape attempts and seven counter-actions. As a result, a significant portion of the funds was blocked, and the recovery process was initiated. Conclusion: even when an attacker actively tries to evade control, real-time tagging allows stolen funds to be tracked in motion and stopped before they disappear.

Crypto Address Labeling — the primary way to stop stolen crypto from being moved The most common scenario after a crypto theft is simple: the victim contacts the exchange or wallet support and waits. While responses and checks are in progress, the attacker is already splitting the funds and moving them further down the chain. The problem is that, for the services used to cash out stolen crypto, these addresses look “normal” by default. Until an address is labeled as hack / phishing / scam, the infrastructure does not treat it as a risk — and the funds continue to move freely. That’s why the first critical step after a theft is to quickly collect incident details and initiate labeling of the attacker’s addresses. This is a signal that exchanges, swap services, and analytics platforms understand: it triggers checks and helps stop the outflow and freeze the funds. Only after that does the longer recovery process begin — involving law enforcement and issuers. In the article, we explain: • how crypto address labeling works • who uses it and how it’s applied in practice • why speed of signal propagation is critical • how crypto security infrastructure is evolving 📖 Read the full article on our website

The theft of 3M USDT and a Tether freeze within 48 hours: the power of rapid tagging ⏳ In one of our recent cases, a client from the CIS had the seed phrase of their wallet compromised. Nearly 3 million USDT were stored on that wallet. The attacker immediately moved the funds to two newly created addresses. In situations like this, time usually works against the victim — but in this case, everything changed thanks to a fast response from both the client and our team. We quickly initiated AML tagging across key analytics systems so the attacker’s addresses would be marked as stolen assets. At the same time, we prepared a documentation package for law enforcement, and the official request to Tether was sent the very same day. Both factors — tagging and legal grounds — turned out to be decisive. In less than 48 hours, Tether froze both addresses at the smart-contract level. The funds are now in the process of being reissued to the rightful owner. What this case shows Rapid tagging is not a formality or a secondary step. For issuers and services, it’s a clear signal that the assets are stolen. Combined with a fast legal request, it creates a window in which a freeze is still possible. The main takeaway is simple: the speed of response and the visibility of stolen assets in analytics are critical factors that make it possible to stop the movement of funds before the attacker has time to “wash them away.”

🤝 Announcing a new partnership with BestChange! Risk assessment for crypto wallets is now available on BestChange — powered by the Match Systems database. A user enters an address and receives a risk score with category breakdowns, helping to understand the overall risk level before a transaction. For the BestChange audience, it’s a convenient tool that helps assess risks in advance, understand the origin of funds, and reduce the likelihood of account freezes. For Match Systems, it’s an important step in expanding the crypto-security infrastructure.

How crypto is laundered in 2025 — and why classic investigation methods no longer work While regulators are still focused on mixers, criminal groups have already moved on. Cross-chain bridges, DEX aggregators, and “black-box” services like DefiWay or Bitget Bridge can blur transaction trails in minutes — splitting funds into hundreds of micro-transfers and hiding them inside DeFi liquidity. Solana is rapidly turning into a gray zone: ultra-low fees, massive throughput, and almost no public service labels. Meanwhile, platforms like Exolix use multi-layer internal routing, making external tracing nearly useless. In our breakdown, we cover: — why suspicious cross-chain flows are already in the hundreds of billions, — how bridges and aggregators break traditional analysis, — the new techniques criminals rely on, — and why the first hours of an investigation matter more than ever. 📖 Full article is on our website

🐖 Pig Butchering Scam is a multi-stage scheme where the victim gets deceived not once, but several times. It all begins with casual communication — flirting, friendly chats, social media, or dating apps. Once trust is established, the scammer introduces a “friend who invests successfully” and invites the victim to try a “reliable platform.” The pattern is always the same: a small deposit, fake “profits,” and sometimes even a small withdrawal to build confidence and push for larger investments. But once the amount becomes significant, withdrawals stop, the “friend” disappears, and the money is gone. And that’s only the first stage. Soon after, the victim is contacted by “lawyers,” “intermediaries,” or “fund-recovery companies.” They promise help, ask for upfront fees for “verification” or to “start the process” — and then vanish. Then comes the third layer: fake “regulators” and “government agencies.” They send emails with official-looking logos, forged domains, and messages like “your funds have been located — pay a tax or penalty to release them.” After payment, new requirements appear, leading to more losses. We prepared a short guide explaining: - how all three stages of the scheme work, - the red flags, - how repeat attacks happen, - and what to do if you’re already in phase one. If you hold crypto, read this beforehand. A mistake in the first stage is expensive — in the second and third, it’s even worse. 📖 Full article is on our website.

Yesterday we spoke at a webinar hosted by the Ministry of Internal Affairs of Kazakhstan, focused on identifying illicit crypto assets and tracking their transactions. Our presentation covered what truly determines the success of an investigation: the speed and accuracy of address labeling. We showed how timely labeling helps stop the movement of stolen funds, reveal chains across bridges and mixers, and why every minute after a theft matters. We discussed real cases and the tools that help law enforcement quickly identify high-risk addresses and make informed decisions in the first hours. A productive discussion, a strong audience, and a shared commitment to making the crypto ecosystem safer.

🤔 Crypto stolen? Most people lose not only their money, but also their chance to recover it. The first hour is critical, while hackers quickly move funds through wallets, bridges and mixers. We made a short guide on real steps that help, common mistakes and what to do in the first minutes. If you hold crypto, read this before you ever need it. 📖 Full article is on our website