LIVE · ON-CHAIN · Generated Wednesday · May 13, 2026 · 12:28 UTCIssue №2026133 · bluewingintel.com
BlueWingIntel
Fraud Watch · Daily · BTC · ETH · SOL · TRX · BNB · Free
Issue №2026133
Wednesday · May 13, 2026 · 12:28 UTC
Ed. #1 · First Edition
$1.52M flowed into Tornado Cash in the last 24 hours.
334 discrete deposits across four pool denominations, computed live from on-chain logs. Tornado's smart contracts were sanctioned in August 2022 — the contracts themselves are immutable and keep accepting ETH. This is what the chain actually shows, not an API estimate.
Editor's note — what this edition actually is
This is Fraud Watch №1. Every figure below is pulled live from public sources at generation time.
No sample data, no padding. Sections without live signal are hidden, not filled. We lead with
Tornado Cash deposit counts because the signal is timely, computable on free public RPC, and
missing from every free competitor. Our proprietary labeled-wallet database seeds with every run.
Lead · Mixer Inflows · Tornado Cash · Last 24h
$1.52M in · 334 deposits · 659.80 ETH
Pool
Deposits
ETH in
Contract
0.1 ETH
158
15.80 ETH
0x12D66f87…
1 ETH
134
134.00 ETH
0x47CE0C6e…
10 ETH
41
410.00 ETH
0x910Cbd52…
100 ETH
1
100.00 ETH
0xA160cdAB…
Computed via eth_getLogs against the four canonical Tornado Cash ETH pools.
Contracts were designated by OFAC on 2022-08-08; they remain immutable and continue accepting deposits.
Anyone who deposited in the last 24 hours has, by Treasury position, touched sanctioned infrastructure.
Our Focus · USDT-TRC20 on TRON · The Rail Nobody Covers
$93.8K
across 4 notable transfers in the latest Tronscan window — live from the chain, not an aggregator.
TRON USDT moved ~$62B at last issuance count and is the dominant stablecoin venue for pig-butchering, ransomware off-ramps, and sanctions evasion. Sell-side doesn't cover it. Chainalysis dashboards it but won't publish it. This is BlueWing's lane.
DPRK breached LayerZero's infrastructure, forged a bridge message, and walked $290 million out of KelpDAO in one transaction. Aave is holding hundreds of millions in bad debt. The dominoes are still falling. DeFi United is scrambling to catch them.
Live X Alerts · PeckShield / SlowMist / ZachXBT · Last 72h
@PeckShieldAlert2026-05-13 12:21
#PeckShieldAlert @TransitFinance seems to have been hacked for ~$1.88M
The stolen funds are currently sitting in the following address in $DAI: 0x8a634DfA2609358849D7D65FFA270C8A57a8abA5
6/ The source of funds for 0x97da traced back to $5.85M+ stolen across five other high confidence social engineering thefts in 2025.
Theft addresses
Oct 2025
bc1qfv64ltd7fzfr9h6wcn540wv2jpadm6zswnj90w
bc1qsh43dxcze5vfdf5utqv2qyp86epz9xjweuvqj6
bc1qtzwzn9r6a0d32mcva7txvsden8srm05gaxpz5z
Sep 2025
bc1qky6zk8fkuwg5a7nr992
5/ Ironically Dritan previously did a B4B with John Daghita (Lick) which led to my January 2026 investigation of a $46M theft from the US government by John and later his arrest.
John posted one of Dritan's old wallet addresses in a now-deleted Telegram post in retaliation:
0x97da0685dbba50b4cbabb0ca9e8336f4fbe41122
🚨SlowMist TI Alert🚨
💸 @Aurellion_Labs Loss: 455,003 USDC (~$455,003)
🔍 Root Cause: Unprotected initialize(address varg0) in SafeOwnable Facet. Diamond set owner via non-initialize path without updating _initialized version slot (bytes 0-7 of 0xf0c57e...) from 0, allowing re-init by attacker to overwrite owner, ca
🚨 MistEye TI Alert 🚨
MistEye has detected a highly sophisticated npm worm, "Mini Shai-Hulud," spreading through trusted developer projects like TanStack, UiPath, and DraftLab. The attackers hijacked GitHub credentials to publish malicious, yet seemingly legitimate, package updates.
The malware injects a heavily disgu
#PeckShieldAlert The @trustedvolumes exploiter has laundered $278K in stolen funds so far: they deposited 10.2 $ETH ($23.6K) to #TornadoCash and laundered 110 $ETH ($250K) via #THORChain to #BTC; they also attempted to deposit 0.5 $ETH to #Railgun but changed their mind and sent it back.
TrustedVolumes was exploited f
Forensic reports · when a daily scan is not enough
Stop guessing. Start citing.
A risk verdict in thirty seconds, a filable report in three days, or the full intelligence package in ten. Same evidence discipline every BlueWing PDF has shipped since day one: SHA-256 manifests, confidence-graded findings, and a transaction hash behind every claim.
Free · Risk Check
Thirty seconds · Public
$0
Paste the address. Green, yellow, or red in under thirty seconds. OFAC and sanctions, drainer and scam-registry hits, exposure tags, one-line plain-English summary. Enough to know whether to walk away or pick up the phone. No credit card.
First 3 lookups · no email needed Then 2 / day · 10 / week · email-verified Cloudflare Turnstile bot protection
For the deal that needs a paper trail. Full transaction history, a three-hop connected-wallet graph, mixer entry flags, supply-concentration analysis, drainer-ring identification, multi-chain on the single entity. Watermarked PDF with SHA-256 evidence manifest, independently verifiable by your counterparty. Priced to close on a corporate card. No RFP. No committee.
For serious matters where counsel is already involved. Everything in Pro, plus the OSINT layer that holds up under scrutiny: GitHub scam-site enumeration, IPFS metadata, WHOIS pivots, social and homoglyph cross-reference, up to three chains with a five-hop network graph. Structured JSON export for the data room. Optional on-chain anchoring for chain-of-custody. Used by attorneys in live crypto-fraud matters.