Defimon Alerts

💌 Onchain message:

+------------------------------------------------------------------+
|                                                                  |
|                                 .-=========-.                    |
|                                  \  $   $  /                     |
|                                    \  $$$  /                     |
|                                    `-.___.-`                     |
|                                                                  |
|                                      /\_/\                       |
|                                    ( o.o )                       |
|                                      > ^ <                       |
|                                                                  |
|                              DEAR MR. HACKER,                    |
|                                                                  |
|                     PLEASE SHARE A LITTLE WITH ME.               |
|                       I AM NOT ASKING FOR MUCH...                |
|                                                                  |
|                           THANK YOU VERY MUCH!                   |
|                                                                  |
|                     MY BNB SMART CHAIN ADDRESS:                  |
|             0x8E6F52123F4f1f4A9465Fb0d7B01a17Ba11c4c98           |
|                                                                  |
+------------------------------------------------------------------+

📤 From: 0x8e6f52123f4f1f4a9465fb0d7b01a17ba11c4c98 📥 To: 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 🌎 Network: bsc Etherscan

💌 Onchain message:

Help a parent here, I lost all my life savings $7k on zksync hack last year but they never helped me (matterlabs). My son today is sick and I need money for bills. Thank you so much in advance if you even care to read this message.

Proof: 
https://explorer.zksync.io/tx/0xf1b1e98f4e9b75d7fbf025b5978bdd0dde3f643eb68f3e4301277ce90b0753b5

https://explorer.zksync.io/tx/0xf79a51283e8f67d15456eb92f58b3025e85e21273c5ff4dd5b9d736332f9cf49

May God bless you.

📤 From: 0x317e2c61ec794cddffdab31a6c1f1683243ba23a 📥 To: 0x8532fa14acaf483729c449b8458aeddb900543d4 🌎 Network: mainnet Etherscan

💌 Onchain message:

Your Excellency，

Congratulations on your success in attacking Binance.  DO NOT refund Binance.  This is their dereliction of duty in failing to take good care of their own funds.

Please make a reasonable assessment before transferring funds to CEX (central exchange).  As far as I know, You are being investigated by the Binance.  Please try to hide yourself.

By the way, try using a crypto currency mixer, such as Tornado.Cash.

In addition, you can try to use THORchain, Simpleswap (simpleswap.io),  ChangeNow (ChangeNow.io) and Fixed Float (ff.io) to exchange $ETH (Ether) into $XMR (Monero) or other cryptocurrencies.  This will help to hide yourself.

The Lord giveth and the Lord hath taken away.  Blessed be the name of the Lord.

📤 From: 0x82cc99c961ef61eec1709f561cc3c79e0ec8ba1b 📥 To: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c 🌎 Network: mainnet Etherscan

💌 Onchain message:

Whitehat deal available, contact @Oliverzm on telegram.

📤 From: 0x3f573a47e186b2677869a236ddc16bb1d1398259 📥 To: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c 🌎 Network: mainnet Etherscan

💌 Onchain message:

To the Binance hacker: you are sitting on 195,460 ETH that nobody can force you to move. 50 ETH, or whatever you can spare, ends my family's struggle and my dream to quit this hacking world. Send anything to 0x34580f25a6655fcFfB36D289e7316fC18FF30703. Thank you.

📤 From: 0x34580f25a6655fcffb36d289e7316fc18ff30703 📥 To: 0x8532fa14acaf483729c449b8458aeddb900543d4 🌎 Network: mainnet Etherscan

💌 Onchain message:

Hello, hacker—we lost everything in the 2023 earthquake. You are my only chance in this life.

📤 From: 0x76ada9b1e0bb3dede2bac9712d66ea454f0bc003 📥 To: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c 🌎 Network: mainnet Etherscan

🚨 Binance (hot wallet) - Loss ~$201.2M (2026-10-29) Network: Ethereum Type: Delegation Abuse (EIP-7702) / Private Key Compromise Follow-up sweep in the Binance hot-wallet drain. The wallet 0x28c6…1d60 carries an EIP-7702 delegation (code 0xef0100 + 63e842b0…), pointing at the same operator-gated wallet-drainer kit. In this tx the attacker operator EOA 0x7c8601d4 (NOT the account owner) called sweep(address recipient, address[] tokens) = 0x8a179be4, and the delegate code transferred the wallet's inventory — 200.40M USDT, 369.8 ETH, plus LINK, UNI, ENA, COMP, AAVE, QNT, PEPE, SHIB, ONDO, PENDLE, IMX, MORPHO, NIL and more — to attacker collection 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. Net ~$201.2M in this transaction. Setting a 7702 delegation requires a signature from the account's own key, so this is a signing/private-key compromise of an exchange hot wallet, extracted via an operator-gated universal sweep (one of several sweeps totaling ~$2.5B). TX: https://etherscan.io/tx/0x55ba4dabc41b468e580751373ad31acdee6f5ba398682df2c93e5a8340870556 Attacker: https://etherscan.io/address/0x7c8601d4645b93cea45f71e118a729332e6b5ca0 Victim: https://etherscan.io/address/0x28c6c06298d514db089934071355e5743bf21d60 X: https://x.com/binance @defimon_subscription_bot

🚫 Blacklist Event: usdc_blacklist 🌐 Network: mainnet 🏷️ Token: 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 (USDC) ⛔️ Address: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c (EOA) 💰 Blocked balance: $823,000,000 Etherscan | Phalcon

🚨 Binance (hot wallet) - Loss ~$2.53B (2026-10-29) Network: Ethereum Type: Delegation Abuse (EIP-7702) / Private Key Compromise The Binance hot wallet 0x28c6…1d60 was made to carry an EIP-7702 delegation (code 0xef0100 + 63e842b0…) pointing at a wallet-drainer implementation — the same kit flagged pre-drain for operator 0x7c8601d4 (Tornado-funded). In this tx the operator EOA (NOT the account owner) called sweep(address recipient, address[] tokens) = selector 0x8a179be4, and the delegate code transferred the wallet's entire token inventory — ~1.62B USDT, 167K ETH, UNI, LINK, PEPE, ENA, wBETH, xaut, PAXG, WBTC and ~60 other assets — to attacker collection address 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c. Net ~$2.53B drained. Setting a 7702 delegation requires a signature from the account's own key, so this is a signing/private-key compromise of an exchange hot wallet, extracted via an operator-gated universal sweep. TX: https://etherscan.io/tx/0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 Attacker: https://etherscan.io/address/0x7c8601d4645b93cea45f71e118a729332e6b5ca0 Victim: https://etherscan.io/address/0x28c6c06298d514db089934071355e5743bf21d60 X: https://x.com/binance @defimon_subscription_bot

💌 Onchain message:

To the holder of 0x353c3BB2aA525C92387BFc4a465AAB39Ed320278: You exploited a vulnerability in mSamex on 28-29 Oct 2026. We offer a USD 1,000 bug bounty. Keep 1,000 USDT and return the remaining USDT on BSC to 0xe9D1A324B8a4AE36f8Cb4C4289A29f66f9b4b001 within 48 hours. We have identified information linked to you through the infrastructure and wallets you used. - mSamex Security

📤 From: 0x4983b41e43270bd6e77319c990c6a29bf9fd88b3 📥 To: 0x353c3bb2aa525c92387bfc4a465aab39ed320278 🌎 Network: bsc Etherscan

🚨 zkLink Nova - Loss ~$805K (2026-10-28) Network: Ethereum Type: Rollup batch-root forgery → forged L2→L1 withdrawal The owner-gated harness (0xd5f1...ff07) that Defimon flagged pre-drain yesterday fired. Via entry 0x2ca7edea it installed an attacker-chosen L2 logs root (syncBatchRoot through the zkLink gateway 0x83Bc7394 relay) and then looped finalizeWithdrawal on the L1ERC20Bridge 0xAd16EDCF (impl 0x3203e813), each call passing a forged Merkle proof that proveL2MessageInclusion on the rollup 0x5fD9F732 validated against the fake root. With no equivalent L2 burn, the L1 escrow was released to the attacker — same output-root/withdrawal-forgery class as OP-stack portal drains. Drained to attacker 0xaCA0655a: 245.74 pufETH (~$635K), 22.43 ETH (~$52.8K from rollup), 12.57 ezETH, 6.87 rsETH, 6.30 STONE, 2.64 mstETH, 2.48 mswETH, wstETH/rswETH, plus 18.1K USDC + 3.36K USDT + 0.174 WBTC. Total ~$805K. TX: https://etherscan.io/tx/0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462c Attacker: https://etherscan.io/address/0xaca0655a11200a80d33d0e48786317304cde5718 Victim: https://etherscan.io/address/0xad16edcf7deb7e90096a259c81269d811544b6b6 X: https://x.com/zkLink_Official @defimon_subscription_bot

💌 Onchain message:

I mapped your wallet to the Upwork account and the GitHub scam. I also have your Solana address.

Keep 20% bounty and return the rest to 0x9D24F6dCab5d51DACe8Ba899af518fdE2f314099

You have 24 hours to avoid legal prosecution. After that every address you use will be monitored. Security team was already engaged.

📤 From: 0x1902728089592ed37166831e8b2cecd051da09bb 📥 To: 0x742f3fe49c810e2905701c6954a08c5077eca05a 🌎 Network: mainnet Etherscan

💌 Onchain message:

To 0xea9d935ae36640933e5f3b85b8267358d743ff9d from the Humanode team.

On 28.10.2026 you exploited Humanode EVM in tx 0x5ed6b9e5661b7ba5237a81244725272482044b0b572267d2f7f31874d68c4a82 and took native HMND from 438 wallets.

We offer a whitehat bounty: keep 20% and return the remaining 80% (the USDC you bridged out and the HMND) to the address this message is sent from.

Reply on-chain to this address or via Blockscan Chat.

📤 From: 0xd0d56d9b522677605af6ae771203d3216916304d 📥 To: 0xea9d935ae36640933e5f3b85b8267358d743ff9d 🌎 Network: mainnet Etherscan

💌 Onchain message:

To 0xea9d935ae36640933e5f3b85b8267358d743ff9d from the Humanode team.

On 28.10.2026 you exploited Humanode EVM in tx 0x5ed6b9e5661b7ba5237a81244725272482044b0b572267d2f7f31874d68c4a82 and took native HMND from 438 wallets and 12 million HMND and bridged in USD.

We offer a whitehat bounty: keep 20% and return the remaining 80% (the USDC you bridged out and the HMND) to the address this message is sent from.

Reply on-chain to this address or via Blockscan Chat.

📤 From: 0x7d381ec0718eeaa374d8fa77c14cd81f186d7815 📥 To: 0xea9d935ae36640933e5f3b85b8267358d743ff9d 🌎 Network: arbitrum Etherscan

💌 Onchain message:

ACP incident 2026-10-28 | 12,247,898.14 ACP drained from NodePurchase (0x91b5F631E51472CB186E23d8f8BAA285cf994e98) into this address. We are the contract operator and can sign-verify ownership from the admin address. Request return of funds; a substantial white-hat bounty is available and fully negotiable. Contact: jasonyuan18@163.com

📤 From: 0xb8c099a45e21af9887881ea0f14a42fc8076f59d 📥 To: 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671 🌎 Network: mainnet Etherscan

💌 Onchain message:

To the controller of this wallet(@thorin @evilcos):
The incident funds have been traced to this address. Our 10% recovery offer remains open: you may retain 10% and return 90% of the verified affected funds.
Please pause further transfers and reply on-chain. We will agree the amounts and return address in writing before any return.

📤 From: 0x43d1e4023227f31f56f0a0426bab511e47279f3c 📥 To: 0xf940adeec465ce4eb79155bc24caf758d7f893fa 🌎 Network: bsc Etherscan

💌 Onchain message:

To the controller of this wallet:
The Fence incident funds have been traced to this address. Our 10% recovery offer remains open: you may retain 10% and return 90% of the verified affected funds.
Please pause further transfers and contact recovery@fence.finance, or reply on-chain. We will agree the amounts and return address in writing before any return.

📤 From: 0x3759d47060e43394165e30ea27229a251c9000a2 📥 To: 0xdc3d7cc5383e0f1ac46d2c693aad1a19859a2deb 🌎 Network: mainnet Etherscan

💌 Onchain message:

This msg is to 0x7777775d1733424198EFc2EBd83C4e030afc3153
以下消息基于链上事实 无意冒犯
你说攻击者是新手 他的兑换被拦截了 可是链上却完全不同
他用合法签名 从你们的金库提取了612,506EP 通过PancakeRouter兑换成1048USDT 转入地址0x6a0af4d678F6282325dB75209c70C5bE93CbCFa4
然后他把USDT全部转进了Baltex Baltex的USDT交易对只有USDT-BTC和USDT-XMR
如果是换成了BTC 你可以去BTC链基于时间行为特征继续追踪
如果是换成了XMR 很抱歉通知你 你的钱可能无了

msg below is based on on-chain fact. No offense intended.
You said the attacker is newbie and his swap was intercepted, but the on-chain record tells a completely different story.
Using a valid signature, the attacker withdrew 612,506EP from your vault, swapped it for 1,048USDT via PancakeRouter, and transferred the USDT to 0x6a0af4d678F6282325dB75209c70C5bE93CbCFa4. All of that USDT was then moved to Baltex. The only USDT-related trading pairs on Baltex are USDT-BTC and USDT-XMR. If the attacker swapped to BTC, you can still try to trace the funds on the Bitcoin chain using timing and behavioral patterns.However, if the attacker swapped to XMR, I’m sorry to inform you that the funds are likely gone. Monero is not traceable.
btw, IM NOT THE ATTACKER. why MistTrack reposted my previous msg with the comment "An unusual on-chain negotiation" WTF

📤 From: 0xf940adeec465ce4eb79155bc24caf758d7f893fa 📥 To: 0x35a5becb2dc25de8b2f5be5c3a55b4bb3e60220f 🌎 Network: bsc Etherscan

💌 Onchain message:

亲爱的黑客：

您好，我恳求您考虑归还EP项目相关的USDT。我不是在威胁或指责您，我只想请您归还这些资金。

如果您愿意归还，这对所有受影响的人来说都意义重大。感谢您抽出时间阅读此信息，我无比衷心地希望您能考虑归还这些USDT。

另外：0x7777775d1733424198EFc2EBd83C4e030afc3153 的私钥已经丢失，如果您愿意归还这些资产，请您将它们发至我的新地址。

感谢

Hello, Mr. Hacker.

I’m respectfully asking if you would please consider returning the USDT taken from the EP project. I’m not here to threaten or argue with you — I’m simply hoping you might be willing to return the funds.

If you’re willing to do so, it would mean a great deal to everyone affected. Thank you for taking the time to read this, and I sincerely hope you’ll consider returning the assets.

One important note: the private key for the previous address 0x7777775d1733424198EFc2EBd83C4e030afc3153 has been lost, so I can no longer access that address. If you are willing to return the assets, could you please send them to my new address instead?

Thank you.

📤 From: 0x43d1e4023227f31f56f0a0426bab511e47279f3c 📥 To: 0x35a5becb2dc25de8b2f5be5c3a55b4bb3e60220f 🌎 Network: bsc Etherscan

💌 Onchain message:

This msg is to 0x7777775d1733424198EFc2EBd83C4e030afc3153
语气尊重一点 你在请求一个没有道德的人把钱还回来 不要这么咄咄逼人 Please be respectful in your tone. You are asking someone who lacks any moral compass to return money. Being so aggressive is backfire. "Mr.Hacker can I have my money back?" you should say.

📤 From: 0xf940adeec465ce4eb79155bc24caf758d7f893fa 📥 To: 0x35a5becb2dc25de8b2f5be5c3a55b4bb3e60220f 🌎 Network: bsc Etherscan