BlueWing Intel · Fraud Watch · Issue №2026127

$2.88M flowed into Tornado Cash in the last 24 hours.

178 discrete deposits across four pool denominations, computed live from on-chain logs. Tornado's smart contracts were sanctioned in August 2022 — the contracts themselves are immutable and keep accepting ETH. This is what the chain actually shows, not an API estimate.

Editor's note — what this edition actually is

This is Fraud Watch №1. Every figure below is pulled live from public sources at generation time. No sample data, no padding. Sections without live signal are hidden, not filled. We lead with Tornado Cash deposit counts because the signal is timely, computable on free public RPC, and missing from every free competitor. Our proprietary labeled-wallet database seeds with every run.

Lead · Mixer Inflows · Tornado Cash · Last 24h

$2.88M in · 178 deposits · 1252.60 ETH

Pool	Deposits	ETH in	Contract
0.1 ETH	76	7.60 ETH	0x12D66f87…
1 ETH	65	65.00 ETH	0x47CE0C6e…
10 ETH	28	280.00 ETH	0x910Cbd52…
100 ETH	9	900.00 ETH	0xA160cdAB…

Computed via eth_getLogs against the four canonical Tornado Cash ETH pools. Contracts were designated by OFAC on 2022-08-08; they remain immutable and continue accepting deposits. Anyone who deposited in the last 24 hours has, by Treasury position, touched sanctioned infrastructure.

Our Focus · USDT-TRC20 on TRON · The Rail Nobody Covers

$275.5K

across 5 notable transfers in the latest Tronscan window — live from the chain, not an aggregator.

TRON USDT moved ~$62B at last issuance count and is the dominant stablecoin venue for pig-butchering, ransomware off-ramps, and sanctions evasion. Sell-side doesn't cover it. Chainalysis dashboards it but won't publish it. This is BlueWing's lane.

Amount	Time (UTC)	From → To
$17.0K	2026-05-07 18:47	`TWMgoy1q…eR7ta8` → `THbXb4fx…swneJP`	trace →
$73.5K	2026-05-07 18:47	`TS5KqemE…3z1aKP` → `TENWBz9z…mW8pNC`	trace →
$10.0K	2026-05-07 18:47	`TB7kbwF4…oiGTTe` → `TVmHMp77…YMVDky`	trace →
$165.0K	2026-05-07 18:47	`TAMpC4B9…ikRsvD` → `TAMbC2kC…jbXZCa`	trace →
$10.0K	2026-05-07 18:47	`TP3r8rkA…eRnoY8` → `TS76o4YX…uxQQT3`	trace →

BTC Whale Moves · Last 24h

Transactions ≥5.0 BTC from mempool (unconfirmed) and the latest block (confirmed). Live from blockchain.info and mempool.space.

Size	Transaction	State
97.16 BTC $7.79M	`184a451b…027aa1`	confirmed
21.29 BTC $1.71M	`dc260b4a…3dd56d`	mempool
14.78 BTC $1.18M	`51b09654…82b476`	mempool
5.93 BTC $474.9K	`a356bbfc…218765`	mempool

Protocol Exploits · Rekt Ledger · Last 30 Days

$290.0M

KelpDao

— 4/18/2026 A2 · Rekt

DPRK breached LayerZero's infrastructure, forged a bridge message, and walked $290 million out of KelpDAO in one transaction. Aave is holding hundreds of millions in bad debt. The dominoes are still falling. DeFi United is scrambling to catch them.

KelpDAOLayerZeroAave

post-mortem →

Live X Alerts · PeckShield / SlowMist / ZachXBT · Last 72h

@zachxbt 2026-05-07 10:29
Price manipulation now happens almost every week, with $LAB by @LABtrade_ becoming the latest pump-and-dump token while Bitget continues playing the usual CEX role. The LAB team, @vsadkovv, appears to control a significant portion of the supply. Wallets linked to the team still hold large allocations: 0x7Cfd8d2d8626B
view post →
@SlowMist_Team 2026-05-07 07:02 BASE
🚨 A typical AI Agent security incident recently occurred on the Base chain. An attacker sent a carefully crafted Morse code message to @grok, inducing it to output transfer instructions. @bankrbot then directly parsed and executed those instructions, ultimately leading to the transfer of real on-chain assets. Our ana
view post →
@SlowMist_Team 2026-05-07 03:20 ETH
🚨SlowMist TI Alert🚨 💸 Loss: ~1,291.16 ETH + ~1,268,771 USDC + ~206,282 USDT + ~16.94 WBTC @trustedvolumes 🔍 Root Cause: In fillOrder function (selector 0x4112e1c2) of RFQ Implementation, signature validation checks _allowedSigners[msg.sender][signer] using caller (taker) instead of order's maker as key, allowing re
view post →
@PeckShieldAlert 2026-05-07 02:17
#PeckShieldAlert @trustedvolumes has been exploited for ~$5.9M, including $3.02M $ETH,$1.37M $WBTC & 1.47M stablecoins, the exploiter has swapped the stolen funds for 2.513K $ETH
view post →
@CertiKAlert 2026-05-07 01:25
#CertiKInsight 🚨 We have seen ~$5.87M pre-approved fund stolen through 0xeEeEEe53033F7227d488ae83a27Bc9A9D5051756. The attacker registers as an AllowedOrderSigner through a public function, then executes the order to transfer from the victim. Please revoke any approval to the vulnerable contract. Stay vigilant!
view post →
@PeckShieldAlert 2026-05-06 19:08 ARB
It seems the 0x1f4c_Kelp DAO Exploiter on ethereum is being liquidated (w/ ~$123m debt) in @aave Here is the related tx: etherscan.io/tx/0xe2391ea418… The arbitrum position is also liquidated: arbiscan.io/tx/0x78b41623cd2…
view post →
@zachxbt 2026-05-05 12:51
8/ While these Chinese investment frauds are obvious to most, they purposely target unsophisticated retail investors via social media. Reading through victim posts, many still seem to be in denial that they were scammed. If you are a victim of BG / DSJ I suggest filing a police report in your jurisdiction (US victims
view post →
@zachxbt 2026-05-05 12:51 TRX
7/ I performed a timing analysis to find withdrawals and located Solana/Tron deposits to Binance and found matching Tron withdrawals and provided details to relevant parties. It resulted in $38.4M frozen by Tether on May 4 (yesterday) with another $3.1M+ frozen at various services/exchanges.
view post →
@zachxbt 2026-05-05 12:51
6/ I traced $93M+ in outflows from consolidations to multiple deposit addresses from April 27 to May 3, 2026. Cobo ($63M total received) TFjQWjNkyTJ5xmqy87WBTYaUS7gWzLuWzu TD1yXHq8NAPFZN5tCAAsd2HsrYfMuuqGCq TMsA7dJpEYJ8r8HCGK7tyAg5NGtJzFWMom TN5YhGsCBPZSi3ATUp2G5wht5Wmbumy23o OKX ($30M total received) TTV5Dn2tfU16Nzr
view post →

Fresh Drainer Wallets

From ScamSniffer's daily-updated open blocklist. Import before the EOD open.

Chain	Address	Label	Grade
ETH	`0x0660e5…fb2ac7`	Drainer	B2
ETH	`0x1fa47d…e8c493`	Drainer	B2
ETH	`0x7fe421…757e55`	Drainer	B2
ETH	`0x0a24ea…701144`	Drainer	B2
ETH	`0xc61248…5b6906`	Drainer	B2
ETH	`0x04ee62…d43166`	Drainer	B2
ETH	`0x6a2142…4d3e44`	Drainer	B2
ETH	`0xd3ed4e…945e9d`	Drainer	B2
ETH	`0xb240f8…80e6ba`	Drainer	B2
ETH	`0x013c72…97a7c4`	Drainer	B2
ETH	`0x42b168…1b7de6`	Drainer	B2
ETH	`0xfe1e5b…37c858`	Drainer	B2
ETH	`0xcc0b48…5cb2b8`	Drainer	B2
ETH	`0x92c582…94b6c9`	Drainer	B2

Phishing Domains · MetaMask Feed

Live blacklist from MetaMask's eth-phishing-detect. 108,715 total entries, showing 12.

poly-mark.xyz
openseoa.app
opencea.mom
opensea.support
openmsea.io
opnsea.top
openesea.eu
opencea.shop
oplensea.io
opensaea.io
opensrea.io
opensesa.io

Tether-Frozen Addresses

ETH addresses blacklisted by Tether on the USDT ERC-20 contract. These wallets hold frozen USDT that cannot be transferred.

Addresses frozen

The Moat · Labeled Wallet DB

Every Fraud Watch issue appends to our proprietary bluewing_labels database. 653 OFAC-sanctioned + 30 ScamSniffer drainers + 93 Tether-frozen seeded on day one. Queryable via REST API and the upcoming bluewing-mcp server.

Forensic reports · when a daily scan is not enough

Stop guessing. Start citing.

A risk verdict in thirty seconds, a filable report in three days, or the full intelligence package in ten. Same evidence discipline every BlueWing PDF has shipped since day one: SHA-256 manifests, confidence-graded findings, and a transaction hash behind every claim.

Free · Risk Check

Thirty seconds · Public

Paste the address. Green, yellow, or red in under thirty seconds. OFAC and sanctions, drainer and scam-registry hits, exposure tags, one-line plain-English summary. Enough to know whether to walk away or pick up the phone. No credit card.

First 3 lookups · no email needed
Then 2 / day · 10 / week · email-verified
Cloudflare Turnstile bot protection

Check a wallet now →

Pro · On-Chain Report

On-chain analysis - 24 hr delivery

$2,500

For the deal that needs a paper trail. Full transaction history, a three-hop connected-wallet graph, mixer entry flags, supply-concentration analysis, drainer-ring identification, multi-chain on the single entity. Watermarked PDF with SHA-256 evidence manifest, independently verifiable by your counterparty. Priced to close on a corporate card. No RFP. No committee.

Request a Pro report →

Founding price

Elite · Full Intelligence

On-chain + OSINT - 48 hrs delivery

$7,500

$12,500 at list after founding window

For serious matters where counsel is already involved. Everything in Pro, plus the OSINT layer that holds up under scrutiny: GitHub scam-site enumeration, IPFS metadata, WHOIS pivots, social and homoglyph cross-reference, up to three chains with a five-hop network graph. Structured JSON export for the data room. Optional on-chain anchoring for chain-of-custody. Used by attorneys in live crypto-fraud matters.

Request an Elite report →

Source status this run: mixer flowsofacofac delta weekrektscamsniffercoingeckosecx alertsbtc whalestrx usdt flowstether frozenphishing domainschainabusedefillama hacks