BlueWing Intel · Fraud Watch · Issue №2026120

$8.44M flowed into Tornado Cash in the last 24 hours.

167 discrete deposits across four pool denominations, computed live from on-chain logs. Tornado's smart contracts were sanctioned in August 2022 — the contracts themselves are immutable and keep accepting ETH. This is what the chain actually shows, not an API estimate.

Editor's note — what this edition actually is

This is Fraud Watch №1. Every figure below is pulled live from public sources at generation time. No sample data, no padding. Sections without live signal are hidden, not filled. We lead with Tornado Cash deposit counts because the signal is timely, computable on free public RPC, and missing from every free competitor. Our proprietary labeled-wallet database seeds with every run.

Lead · Mixer Inflows · Tornado Cash · Last 24h

$8.44M in · 167 deposits · 3725.60 ETH

Pool	Deposits	ETH in	Contract
0.1 ETH	56	5.60 ETH	0x12D66f87…
1 ETH	50	50.00 ETH	0x47CE0C6e…
10 ETH	27	270.00 ETH	0x910Cbd52…
100 ETH	34	3400.00 ETH	0xA160cdAB…

Computed via eth_getLogs against the four canonical Tornado Cash ETH pools. Contracts were designated by OFAC on 2022-08-08; they remain immutable and continue accepting deposits. Anyone who deposited in the last 24 hours has, by Treasury position, touched sanctioned infrastructure.

BTC Whale Moves · Last 24h

Transactions ≥5.0 BTC from mempool (unconfirmed) and the latest block (confirmed). Live from blockchain.info and mempool.space.

Size	Transaction	State
34.14 BTC $2.61M	`d11d60a0…7bcc78`	mempool
10.00 BTC $764.2K	`544b4453…740407`	mempool
6.16 BTC $471.1K	`47090ec0…b9dccf`	mempool
5.82 BTC $444.5K	`a96f6350…b9f5cf`	mempool

OFAC Designation Changes · Last 7 Days

2026-04-25 Automatically updated lists: Sat Apr 25 04:09:20 UTC 2026

Protocol Exploits · Rekt Ledger · Last 30 Days

$290.0M

KelpDao

— 4/18/2026 A2 · Rekt

DPRK breached LayerZero's infrastructure, forged a bridge message, and walked $290 million out of KelpDAO in one transaction. Aave is holding hundreds of millions in bad debt. The dominoes are still falling. DeFi United is scrambling to catch them.

KelpDAOLayerZeroAave

post-mortem →

Live X Alerts · PeckShield / SlowMist / ZachXBT · Last 72h

@CertiKAlert 2026-04-30 12:00
#CertiKStatsAlert 🚨 Combining all the incidents in April we’ve confirmed ~$651M lost to exploits with ~$3.5M of the total attributed to phishing. April has had the highest losses recorded since March 2022 (~$715M), excluding Feb 2025 (Bybit). More details below 👇
view post →
@PeckShieldAlert 2026-04-30 11:10
It seems the admin key of @wasabi_protocol has been compromised with the estimated loss of $5.5m across multiple chains, including ETH, BASE, BLAST, and BERA chains. Here is the related tx to add the malicious admin: etherscan.io/tx/0x11ff84ffbd… Wasabi Protocol 🟢 (@wasabi_protocol) We're aware of an issue and
view post →
@PeckShieldAlert 2026-04-30 09:47 ETH
#PeckShieldAlert @wasabi_protocol has been exploited for $5M+ across multiple chains, including Ethereum, Base, Berachain, & Blast.
view post →
@CertiKAlert 2026-04-30 09:03
UPDATE: Total losses amount to ~$5.5M across the ETH, BASE, BLAST, and BERA chains: etherscan.io/tx/0xcd77423f1b… basescan.org/tx/0x10b371603d… blastscan.io/tx/0xaf0f58cb8e… berascan.com/tx/0xf4934fe89e…
view post →
@CertiKAlert 2026-04-30 08:30
2/ Funds are currently in wallets: - 0xb8Bb8aDDd6b283be57b4635Bf913B34824ca70dB = ~$677k - 0x6244117E1B30101F2De25442211F6A92833Cf906 = ~$1.1M - 0x6244117E1B30101F2De25442211F6A92833Cf906 = ~$1.1M
view post →
@PeckShieldAlert 2026-04-29 06:23
#PeckShieldAlert @KyberNetwork Exploiter has laundered 2,900 $ETH ($6.8M) to #Tornadocash KyberSwap fell victim to a reentrancy attack on November 23, 2023, which resulted in a loss of ~$47M.
view post →
@SlowMist_Team 2026-04-29 03:40
🚨SlowMist TI Alert🚨 We have detected a malicious transaction exploiting a flawed EIP-7702 account, resulting in a loss of 1,988.5 $QNT (approx. 54.93 $ETH). The root cause is that the admin identity of a QNT reserve pool is held by an EOA (0xc6ddf90790b433743bd050c1d1d45f673a3413f4), which delegated its code to a `Ba
view post →
@SlowMist_Team 2026-04-28 07:13 TRX
🥳Unphishable is participating in the current @thedaofund × @Giveth Ethereum Security Quadratic Funding round! If you care about #Web3 security and want to help users stay safe from phishing scams, please consider supporting us.🫶 Unphishable (unphishable.io) is a free, browser-based phishing simulation platform with 3
view post →
@SlowMist_Team 2026-04-28 03:26
🚨. @ZetaChain has been exploited. Based on initial analysis, the following outlines the root cause. Root Cause The core vulnerability lies in the call function of ZetaChain's GatewayZEVM contract, which lacks both access control and input validation. This allows any arbitrary user to invoke cross-chain calls through
view post →

Fresh Drainer Wallets

From ScamSniffer's daily-updated open blocklist. Import before the EOD open.

Chain	Address	Label	Grade
ETH	`0x0660e5…fb2ac7`	Drainer	B2
ETH	`0x1fa47d…e8c493`	Drainer	B2
ETH	`0x7fe421…757e55`	Drainer	B2
ETH	`0x0a24ea…701144`	Drainer	B2
ETH	`0xc61248…5b6906`	Drainer	B2
ETH	`0x04ee62…d43166`	Drainer	B2
ETH	`0x6a2142…4d3e44`	Drainer	B2
ETH	`0xd3ed4e…945e9d`	Drainer	B2
ETH	`0xb240f8…80e6ba`	Drainer	B2
ETH	`0x013c72…97a7c4`	Drainer	B2
ETH	`0x42b168…1b7de6`	Drainer	B2
ETH	`0xfe1e5b…37c858`	Drainer	B2
ETH	`0xcc0b48…5cb2b8`	Drainer	B2
ETH	`0x92c582…94b6c9`	Drainer	B2

Phishing Domains · MetaMask Feed

Live blacklist from MetaMask's eth-phishing-detect. 242,690 total entries, showing 12.

teams07web.com
blast-pools.pages.dev
hopprotocol.pro
blast-project.pages.dev
acces-blst.pages.dev
blast-asset.pages.dev
blst-node.pages.dev
distribution-blst.xyz
uniswap-trade.web.app
l2blast-check.xyz
lihea.build
l2blast-checker.xyz

Tether-Frozen Addresses

ETH addresses blacklisted by Tether on the USDT ERC-20 contract. These wallets hold frozen USDT that cannot be transferred.

Addresses frozen

The Moat · Labeled Wallet DB

Every Fraud Watch issue appends to our proprietary bluewing_labels database. 653 OFAC-sanctioned + 30 ScamSniffer drainers + 93 Tether-frozen seeded on day one. Queryable via REST API and the upcoming bluewing-mcp server.

Forensic reports · when a daily scan is not enough

Stop guessing. Start citing.

A risk verdict in thirty seconds, a filable report in three days, or the full intelligence package in ten. Same evidence discipline every BlueWing PDF has shipped since day one: SHA-256 manifests, confidence-graded findings, and a transaction hash behind every claim.

Free · Risk Check

Thirty seconds · Public

Paste the address. Green, yellow, or red in under thirty seconds. OFAC and sanctions, drainer and scam-registry hits, exposure tags, one-line plain-English summary. Enough to know whether to walk away or pick up the phone. No credit card.

First 3 lookups · no email needed
Then 2 / day · 10 / week · email-verified
Cloudflare Turnstile bot protection

Check a wallet now →

Pro · On-Chain Report

Three-hop graph · 3-day delivery

$2,500

For the deal that needs a paper trail. Full transaction history, a three-hop connected-wallet graph, mixer entry flags, supply-concentration analysis, drainer-ring identification, multi-chain on the single entity. Watermarked PDF with SHA-256 evidence manifest, independently verifiable by your counterparty. Priced to close on a corporate card. No RFP. No committee.

Request a Pro report →

Founding price

Elite · Full Intelligence

Five-hop · Multi-chain · OSINT · 10-day

$7,500

$12,500 at list after founding window

For serious matters where counsel is already involved. Everything in Pro, plus the OSINT layer that holds up under scrutiny: GitHub scam-site enumeration, IPFS metadata, WHOIS pivots, social and homoglyph cross-reference, up to three chains with a five-hop network graph. Structured JSON export for the data room. Optional on-chain anchoring for chain-of-custody. Used by attorneys in live crypto-fraud matters.

Request an Elite report →

Source status this run: mixer flowsofacofac delta weekrektscamsniffercoingeckosecx alertsbtc whalestrx usdt flowstether frozenphishing domainschainabusedefillama hacks