BTC

518

OFAC SDN addresses

ETH

101,959

phishing domains tracked

SOL

2,318

phishing domains tracked

TRX

OFAC SDN addresses

BNB

hack incidents · 30d

$2.53M flowed into Tornado Cash in the last 24 hours.

139 discrete deposits across four pool denominations, computed live from on-chain logs. Tornado's smart contracts were sanctioned in August 2022 — the contracts themselves are immutable and keep accepting ETH. This is what the chain actually shows, not an API estimate.

Editor's note — what this edition actually is

This is Fraud Watch №1. Every figure below is pulled live from public sources at generation time. No sample data, no padding. Sections without live signal are hidden, not filled. We lead with Tornado Cash deposit counts because the signal is timely, computable on free public RPC, and missing from every free competitor. Our proprietary labeled-wallet database seeds with every run.

Lead · Mixer Inflows · Tornado Cash · Last 24h

$2.53M in · 139 deposits · 1505.20 ETH

Pool	Deposits	ETH in	Contract
0.1 ETH	42	4.20 ETH	0x12D66f87…
1 ETH	41	41.00 ETH	0x47CE0C6e…
10 ETH	46	460.00 ETH	0x910Cbd52…
100 ETH	10	1000.00 ETH	0xA160cdAB…

Computed via eth_getLogs against the four canonical Tornado Cash ETH pools. Contracts were designated by OFAC on 2022-08-08; they remain immutable and continue accepting deposits. Anyone who deposited in the last 24 hours has, by Treasury position, touched sanctioned infrastructure.

Our Focus · USDT-TRC20 on TRON · The Rail Nobody Covers

$21.0K

across 2 notable transfers in the latest Tronscan window — live from the chain, not an aggregator.

TRON USDT moved ~$62B at last issuance count and is the dominant stablecoin venue for pig-butchering, ransomware off-ramps, and sanctions evasion. Sell-side doesn't cover it. Chainalysis dashboards it but won't publish it. This is BlueWing's lane.

Amount	Time (UTC)	From → To
$11.0K	2026-06-18 17:48	`TNeK4VgH…tnYkRJ` → `TKZ7Lc1U…uN3Hvi`	trace →
$10.0K	2026-06-18 17:48	`TKd75fi2…oKPUvH` → `TZ2xbYW3…7zHkYt`	trace →

BTC Whale Moves · Last 24h

Transactions ≥5.0 BTC from mempool (unconfirmed) and the latest block (confirmed). Live from blockchain.info and mempool.space.

Size	Transaction	State
5.85 BTC $366.1K	`0c69baba…2987f5`	confirmed

Live X Alerts · PeckShield / SlowMist / ZachXBT · Last 72h

@CertiKAlert 2026-06-18 08:58
2/ In the 'escapeHatch()' call window of 240 per 4800 blocks, the attacker submitted 'proofData' with 'rollupSize' and 'numTxs 'as zero, yet real parameters for withdrawal after proof header to exploit the discrepancy of 'numTxs' used for verification and execution.
view post →
@CertiKAlert 2026-06-18 08:04
1/ The vulnerable product was deprecated years ago and should not affect the current Aztec network. Aztec Labs (@AztecLabs_) We are investigating a potential exploit affecting a deprecated Aztec payments product from 2021. ~$2m was transferred from the immutable smart contract in transaction: etherscan.io/tx/0xab30
view post →
@PeckShieldAlert 2026-06-18 06:59
#PeckShieldAlert The @aztecnetwork Private Rollup Bridge has suffered an exploit, resulting in a loss of ~$2.165M worth of cryptos, including 1.158K $ETH, 150K $DAI & 0.47 $renBTC The exploiter was originally funded with 0.134 $ETH from #HitBTC.
view post →
@CertiKAlert 2026-06-18 06:40
#CertiKInsight 🚨 We have seen suspicious transactions that drained @aztecnetwork PrivateRollupBridge contract of ~$2.15M by 0x6952d9246e9aFE8B887B2877225163436F78E97F. skylens.certik.com/tx/eth/0x… Stay Vigilant!
view post →
@PeckShieldAlert 2026-06-17 15:35 ETH
#PeckShieldAlert The @UXLINKofficial exploiter-labeled address has swapped ~14.6M $DAI for 8,298.6 $ETH. The exploiter then deposited 8,340 $ETH into #TornadoCash and bridged 2.64 $ETH ($4.63K) from #Ethereum to #BTC address bc1pv8...yc5q. The exploiter currently holds 10.54M $DAI.
view post →
@PeckShieldAlert 2026-06-17 09:33
#PeckShieldAlert @ThetanutsFi exploiter-labeled address has deposited 57 $ETH into Tornado Cash and 0.85 $ETH to @binance Deposit address 0x9AD8...701D
view post →

Stablecoin Footprint · Multi-Chain · By Issuer

Circulating USD-pegged supply by issuer across the seven largest stablecoin chains. Source: DefiLlama, refreshed hourly. The corridor concentration tells you where the fraud rails actually run — USDT dominates Tron, USDC dominates Solana and Base, both fight on Ethereum.

Issuer · Asset	ETH	SOL	TRX	BNB	Base	ARB	MATIC	Total
TetherUSDT	$79.5B	$2.9B	$87.4B	$9.2B	—	$979M	$895M	$185.9B
CircleUSDC	$48.4B	$7.3B	$28M	$1.6B	$4.2B	$2.3B	$1.8B	$75.0B
MakerDAODAI	$3.6B	$510K	—	$31M	—	$19M	$627M	$4.4B
PaxosPYUSD (PayPal)	$1.7B	$678M	$23	—	—	$219M	$10M	$2.7B
PaxosUSDP	$3M	—	—	$10K	—	—	—	$3M
SkyUSDS	—	—	—	$92K	$5K	—	—	$0M
Chain total	$133.3B	$10.9B	$87.5B	$10.8B	$4.2B	$3.5B	$3.3B	$268.0B

Fresh Drainer Wallets

From ScamSniffer's daily-updated open blocklist. Import before the EOD open.

Chain	Address	Label	Grade
ETH	`0x0660e5…fb2ac7`	Drainer	B2
ETH	`0x1fa47d…e8c493`	Drainer	B2
ETH	`0x7fe421…757e55`	Drainer	B2
ETH	`0x0a24ea…701144`	Drainer	B2
ETH	`0xc61248…5b6906`	Drainer	B2
ETH	`0x04ee62…d43166`	Drainer	B2
ETH	`0x6a2142…4d3e44`	Drainer	B2
ETH	`0xd3ed4e…945e9d`	Drainer	B2
ETH	`0xb240f8…80e6ba`	Drainer	B2
ETH	`0x013c72…97a7c4`	Drainer	B2
ETH	`0x42b168…1b7de6`	Drainer	B2
ETH	`0xfe1e5b…37c858`	Drainer	B2
ETH	`0xcc0b48…5cb2b8`	Drainer	B2
ETH	`0x92c582…94b6c9`	Drainer	B2

Phishing Surface · Multi-Chain Coverage

Public blocklists aggregated across the two largest wallet ecosystems. Showing the 8 most recent additions per chain.

Ethereum MetaMask eth-phishing-detect

101,959

domains tracked

poly-mark.xyz
openseoa.app
opencea.mom
opensea.support
openmsea.io
opnsea.top
openesea.eu
opencea.shop

Solana Phantom blocklist

2,318

domains tracked

coinfixsolution.pages.dev
photon-sols-tinyastro.xyz
photons-sol.xyz
webjup.cc
index-raydium.web.app
pumpp-fun.pages.dev
phantom-restorewalletteamdesk.webflow.io
dextoolwallets.on.fleek.co

Stablecoin Issuer Enforcement

Issuers can freeze tokens on-chain at the contract level — the regulator-of-last-resort signal. Comparison framing matters more than the raw count: which issuer freezes fastest, freezes most, and freezes at all.

Tether USDT

ETH addresses frozen · live

0x175d4445…b92c

0x19aa5fe8…4dff

0x2f389ce8…6535

Circle USDC

—

Multi-chain freeze feed · Phase 3-C

Paxos USDP / PYUSD

—

Freeze feed · Phase 3-C

The Moat · Labeled Wallet DB

Every Fraud Watch issue appends to our proprietary bluewing_labels database. 660 OFAC-sanctioned + 30 ScamSniffer drainers + 93 Tether-frozen seeded on day one. Queryable via REST API and the upcoming bluewing-mcp server.

Forensic reports · when a daily scan is not enough

Stop guessing. Start citing.

A risk verdict in thirty seconds, a filable report in three days, or the full intelligence package in ten. Same evidence discipline every BlueWing PDF has shipped since day one: SHA-256 manifests, confidence-graded findings, and a transaction hash behind every claim.

Free · Risk Check

Thirty seconds · Public

Paste the address. Green, yellow, or red in under thirty seconds. OFAC and sanctions, drainer and scam-registry hits, exposure tags, one-line plain-English summary. Enough to know whether to walk away or pick up the phone. No credit card.

First 3 lookups · no email needed
Then 2 / day · 10 / week · email-verified
Cloudflare Turnstile bot protection

Check a wallet now →

Pro · On-Chain Report

On-chain analysis - 24 hr delivery

$2,500

For the deal that needs a paper trail. Full transaction-graph trace, sweep / consolidation / round-trip pattern detection, mixer entry flags, supply-concentration breakdown, drainer-ring identification across the single entity. Every load-bearing claim Admiralty-graded (A1 / B2 / C3). Watermarked PDF with SHA-256 evidence manifest, independently verifiable by your counterparty. Priced to close on a corporate card. No RFP. No committee.

Request a Pro report →

Founding price

Elite · Full Intelligence

On-chain + OSINT - 48 hrs delivery

13 / 50 founding reports delivered · 37 slots remain

$7,500

$12,500 at list after founding window

For serious matters where counsel is already involved. Everything in Pro, plus cross-chain operator-cluster tracing (up to three chains), sponsored-transaction rotation analysis on Solana, serial-issuer identification, and the OSINT layer that holds up under scrutiny: GitHub scam-site enumeration, IPFS metadata, WHOIS pivots, social and homoglyph cross-reference. Structured JSON export for the data room. Optional on-chain anchoring for chain-of-custody. Used by attorneys in live crypto-fraud matters.

Request an Elite report →

Source status this run: mixer flowsofacofac delta weekrektscamsniffercoingeckosecx alertsbtc whalestrx usdt flowstether frozenphishing domainschainabusedefillama hacksphantom sol