💌 Onchain message:

This is Slice (slice.so). Return 90% of the funds (15.11 ETH) to 0x87199cd27a6Cdc97659A9FF40e662c2821466B0a on Base by Friday, October 23, 17:00 UTC and keep the remaining 10% as a white-hat bounty. We will treat this as a white-hat recovery. Otherwise, we will pursue all available options to recover the funds.

📤 From: 0xae009d532328ff09e09e5d506ab5bbec3c25c0ff
📥 To: 0xfba873b1e5d0256301b87ce74f79a30d6781364a
🌎 Network: base

Etherscan

🚨 Defimon detected an exploit on Slice.so which lost $42K on Base

Slice's FundsModule had a release function that called any address the caller passed in as a "slicer" (a Slice store contract) and credited whatever amount that address said it had paid out. It never checked that the address was a real Slicer or that any funds had actually arrived.

The attacker first force-released the unclaimed sales revenue of about 70 real Slice stores into the FundsModule, where it was credited to the store owners but left sitting in the contract. Then they passed in their own fake slicer, which reported the module's entire balance as its payout, and withdrew it in the same call: 8.72 ETH and 19.8K USDC that belonged to the store owners. The FundsModule implementation was unverified. Slice upgraded and paused it about 1.5 hours later, and has offered the attacker a 10% bounty on-chain.

TX: https://basescan.org/tx/0x02b039a6345348d984e4a0b70dd233127772206e61ce82c390c4709c0b8d790a
Attacker: https://basescan.org/address/0xc34572ebb26b9a4c54854aae8d2347108e8c892f
Victim: https://basescan.org/address/0x61bcd1ed11fc03c958a847a6687b1875f5eacaaf
Vulnerable impl: https://basescan.org/address/0x8db3B6f51b594Dc87B87a3A3b844DE9c0d8D60b5
Patched impl: https://basescan.org/address/0xF9A0Fe077a9DB132ca617606390a0706f55aF87E
X: https://x.com/slice__so

@defimon_subscription_bot

DeFi exploit odds are now tradeable on Trueo.

Want to know about the hack before CT does?

Shhh… you didn't hear it from us 🤫

@defimon_subscription_bot

https://x.com/DefiLlama/status/2112611129809658093

💌 Onchain message:

Hi. On 21 Oct 2026 your wallet sent 1749.81 USDC.e on Arbitrum to 0xDA7E0fE37a8CBe4998bCd9D1F6eeEf2090BD93a3. That address is a thief: it drained my wallets too and at least 4 others the same day. If it wasn't you, your seed phrase is compromised, move what is left now. I am filing a police report and want to understand how he got our keys (Discord/Telegram bot? app?). Reply to me on chat.blockscan.com, address 0xB59ada56D5D19468f3241147880e818A736b3865. No links, I will never ask you for anything.

📤 From: 0xb59ada56d5d19468f3241147880e818a736b3865
📥 To: 0xc2bd60d1ff37c979a8fa9ebf8e5cacf0792045ac
🌎 Network: arbitrum

Etherscan

💌 Onchain message:

To the other victims of this address: between 19 and 21 Oct 2026 it drained at least 6 wallets on Ethereum, Arbitrum and Solana. I am one of them and I am filing a police report in France. If you were drained too, contact me on chat.blockscan.com, address 0xB59ada56D5D19468f3241147880e818A736b3865. I will never ask you for money, keys or to click anything.

📤 From: 0xb59ada56d5d19468f3241147880e818a736b3865
📥 To: 0xda7e0fe37a8cbe4998bcd9d1f6eeef2090bd93a3
🌎 Network: arbitrum

Etherscan

💌 Onchain message:

Hello, looks like you are victim of same hacker than me, i make investigation, its possible to speak with you about the hack ? thank you

📤 From: 0xb4fbdbc8371a1a3ad3b92012c7a3cdad807b6641
📥 To: 0xef7d508fcfb61187d8d8a48cc6cb187722633e2d
🌎 Network: mainnet

Etherscan

💌 Onchain message:

To the individuals responsible for the unauthorized transfer of our funds:
Our wallet's private key was compromised, and our funds were stolen.
These funds belong to a legitimate business that supports our family and others who depend on it. Your actions are causing serious financial harm to our business and threatening the livelihood of the families behind it.
We are offering you an opportunity to resolve this matter peacefully.
If you return at least 90% of the stolen funds, we are willing to consider the matter settled and refrain from pursuing legal action ourselves, to the extent legally permissible.
You may retain the remaining 10% as an incentive for voluntarily returning the funds.
Return funds to this Ethereum address:
0x572A718b715173abf3C1c49D224C3cE69Cba3819
This is a genuine offer to recover our funds without further escalation.
We ask you to consider the real people and families affected by your actions.

📤 From: 0xa73072adc6c34859426fcc29bc6ca2cac07c93c3
📥 To: 0x5210a42999da6c8853fab6844a7e3aa2890c3475
🌎 Network: mainnet

Etherscan

💌 Onchain message:

Beware of impersonators. Other parties are posing as us, and any funds sent to their addresses will not count as a return. The only valid return address is:

0xB33b824349992fDB035Db86552AfeB135fDF79a4

Once you return 90% of the drained assets to this address, you can notice that the malicious flag will be removed from your address.

If you don’t comply, we will pursue full criminal and civil action in every relevant jurisdiction and continue working with exchanges to identify you. Most major exchanges have already blacklisted every address you’ve used, and every further movement of these funds is being monitored and documented.

This is our final message. The choice is yours.

Deadline: 25 October 2026, 08:00 UTC.

📤 From: 0xb33b824349992fdb035db86552afeb135fdf79a4
📥 To: 0xf50ec5668242c332be99a495d0d0c2bfb3dc21ea
🌎 Network: mainnet

Etherscan

💌 Onchain message:

Hey no need, thats my doing. i just wanna talk, we can have a whitehat talk over this and just settle on a common ground. i dont wanna do this for 4 years either

📤 From: 0x3058a0d5e8e1a7b15dbf13eb3d411ee3efea70d9
📥 To: 0xa2e3ee6de7708a655ff97b39e019881aa1a8b8b9
🌎 Network: mainnet

Etherscan

💌 Onchain message:

A message from Cysic to the party responsible for the exploit:

In the interest of reaching an amicable resolution, we are offering a recovery bounty of approximately 10% for your cooperation in returning approximately 90% of the identified ETH proceeds from the unauthorized minting of 10,000,000 CYS.

Specifically, return 275.872 ETH in native ETH on Ethereum mainnet to the following address controlled by the Cysic Foundation:

0xe3e8E1147a47dCf42fa73892D74928544fe5a6A9

The return window is 72 hours from the on-chain publication of this message on Ethereum mainnet.

Upon verification that 275.872 ETH was received at the designated address by the deadline, you may retain the remaining identified ETH proceeds, approximately 30.652 ETH, as the recovery bounty. This bounty is excluded from the 275.872 ETH repayment amount and does not need to be returned. We will publicly acknowledge your cooperation and consider Cysic’s ETH recovery claim under this offer resolved.

We have reconstructed the key stages of the attack and preserved the supporting technical and on-chain evidence. If the funds have not been returned by the deadline, the matter will be escalated with law enforcement to pursue a full criminal investigation.

📤 From: 0xe3e8e1147a47dcf42fa73892d74928544fe5a6a9
📥 To: 0x1106de394da07e90b02161465ea0421b74db4691
🌎 Network: mainnet

Etherscan

🚨 Newmont (NEM) - Loss ~$726K (2026-10-21)

Token: $NEM @ $0.0175
Network: BNB Chain

Type: Logic Error (deflationary LP-burn reserve manipulation)

The NEM token (NemTokenV2) has a self-sabotaging "LP sell-destroy" mechanism: its permissionless flushLpSellRecycle / _flushLpSellRecycle burns up to 20% of the PancakeSwap pair's own NEM balance straight to dead and then calls pair.sync(), collapsing the pool's NEM reserve while its USDT reserve is left intact. The attacker flash-loaned large USDT (Moolah + Venus + Pancake V3 + V4) to inflate the pair's USDT reserve, then ran a 42× loop of NEM transfers + skim/sync that repeatedly burned the pair's NEM down to ~29 NEM. With the NEM reserve near-zero, a tiny NEM input swapped out ~236.6M USDT via the constant-product curve, draining the NEM/USDT LP of ~$821K USDT and netting ~$726K after repaying all loans. Attacker is a fresh Tornado-funded EOA.

TX: https://bscscan.com/tx/0xfb093c96c0094cbcca10801f97ed2e5ed3d96550ce64b544df5a349545723f91
Attacker: https://bscscan.com/address/0xfd929b0f270dfea6c4827262b4e2bf6ea50fe9b6
Victim: https://bscscan.com/address/0x840e19dcca541ee0b55a3c67e900a39d523b12b8 (NEM/USDT Pancake LP)
NEM token: https://bscscan.com/address/0x9cf0e3ad4efa7ab602d7b5a38c55795cfa777777

@defimon_subscription_bot

💌 Onchain message:

Hi, it's my first on-chain hack. I helped you clean out useless assets. All volunteer work, no need to appreciate.

📤 From: 0x555555555555d2b46365078bb5e1dc9fe9b452f0
📥 To: 0xfda462548ce04282f4b6d6619823a7c64fdc0185
🌎 Network: mainnet

Etherscan

💌 Onchain message:

We now have police in different countries, global security firms and several exchanges working with us. You will get caught, and your assets frozen, even it it takes years.

I will give you a final 24 hours (until 24 Oct 9am UTC) to send 80% of funds in this address to 0x3d7D28807C5b7Cf0da148355e5854808E51A422a and keep 20% as white hat bounty. We can then do the same with the other blockchains and you will not be persecuted further.

Contact me on @ambbtc if you want proof of ID

📤 From: 0x3d7d28807c5b7cf0da148355e5854808e51a422a
📥 To: 0x93cb586b5b7cf4a3cb02c3660d23332c1af1fdc4
🌎 Network: mainnet

Etherscan

💌 Onchain message:

FINAL NOTICE from the victims to the holder of 0xf50Ec5668242c332bE99a495D0D0c2bfB3dc21EA.

The deadline of 23 October 2026 12:00 UTC has passed without a reply. Since our first message criminal cases have already been opened with police and investigative authorities in 5 countries, with the process of opening cases underway in another 10 countries. Your addresses are flagged at TRM, Elliptic, Chainalysis and Crystal and reported to every major exchange. The Safe you created on 21 October, 0xa43Dd7715c4c318dA6fa76847a4d9B5518FA3d4d, and its two other owners were flagged within an hour of your first transfer into it. Every service that screens addresses will treat it like the main wallet.

One last offer, better than the first:
1. Return 85 percent of the funds you hold, at least 726 ETH, to 0xa1b8944463dc411164f2ee824d89186fec6c9259.
2. Keep 15 percent as a bounty, about 128 ETH.
3. Deadline: 26 October 2026, 12:00 UTC.

If the funds arrive by then, we will not file civil claims against you, we will inform the police and the analytics firms that the funds were returned, and we will ask them to record the case as resolved.

After 26 October 12:00 UTC the bounty is withdrawn for good and we continue with the exchanges and the police until the account holders are identified.

Our messages come only from 0xa1b8944463dc411164f2ee824d89186fec6c9259. Our only contact is humbleferryman@proton.me. Every other address or e-mail that has written to you is an impostor. We will never change the return address.

📤 From: 0xa1b8944463dc411164f2ee824d89186fec6c9259
📥 To: 0xf50ec5668242c332be99a495d0d0c2bfb3dc21ea
🌎 Network: mainnet

Etherscan

💌 Onchain message:

Regarding unauthorized sweep from 0x50dA32E628b45AbB1335924086Ca0013b9d4eC1C: Return funds to clean address: 0xeCB9aC0858389Ff69Eb6Fa2dF1199f2636b9Be2C. Keep 10% whitehat bounty. No further action.

📤 From: 0x78059663e8c1e6bebda339fd14797b891125a025
📥 To: 0x02bd741480ee25f8db5319ce5e5bfe14ff6b5c99
🌎 Network: mainnet

Etherscan

💌 Onchain message:

Keep 20% as bounty and refund the remaining to my address.

📤 From: 0x0f9b4769c7de41c84d3736442d31b8ac31b6bb43
📥 To: 0xc7d0fca2a2ad6bacdcba48e7ef2723a517e7de9a
🌎 Network: mainnet

Etherscan

💌 Onchain message:

Running does not erase you. It records you.

Every real outgoing move from this wallet is logged with amount, block and hash:
- 13.15 USDT to 0xDEf3B8159bFd48086aC5957B3F640c86F08aa03D (Oct 20)
- 7.99 USDT to 0xB42f5c960F9baA20DC497A233C51cfDc1819C502 (Oct 21)
- 60 USDT to 0x8A04c19Fb15c68f6958acfcD4A894FC4076b4ba9 (Oct 21)
- 15 BSC-USD to 0x989226773eDc265F53f58576b31886A875f3d5Dc on BSC (Oct 23, 12:06:52 UTC)
- 11.17 USDT to 0x2BBFd315eBd0EDedBD1a9baF105bd427024Ee742 (Oct 23, 20:19:35 UTC, block 26257675)
- 60 USDT to 0x8A04c19Fb15c68f6958acfcD4A894FC4076b4ba9 (Oct 23, 21:24:11 UTC, block 26257998)

The fakes are logged too: 15 spoofed transfers imitating this wallet, each identified and marked fake - including the zero-value one at Oct 24, 03:02:47 UTC (block 26259683). Real moves and fakes are told apart here; nothing passes unseen.

Network: intake 0x20c4BA365e492bBE95279Ebf9dF95b32619dFdc0. Hub 0xB7A5784d6038E60EbfB5B58D2B7265F6Ea3a7D87 fed this wallet 2,087 USDT (Sep 29-Oct 8). Payout wallet 0x8A04c19Fb15c68f6958acfcD4A894FC4076b4ba9 holds 1.47 ETH + 1,339.44 USDT + 21,343.25 BSC-USD. BSC side: 2,701.69 BSC-USD here; fragment 0x989226773eDc265F53f58576b31886A875f3d5Dc holds 1,604.95 BSC-USD + 375.86 USDC. At least 15 wallets were drained through the intake Sep 30-Oct 18; all logged with amounts and hashes.

Here is the trap you cannot outrun: every new wallet you touch becomes another flagged address. Every swap service you use gets another report with your order hashes. Your file does not shrink when you move. It grows. There is no move that deletes the last one.

I am not going away. A month from now, a year from now, this file will still be growing, and these addresses will still be flagged wherever they are screened. Every address is watched on both chains, 24/7.

One door is still open. My standing offer covers only my 0.5189 ETH in this wallet, and only while it sits untouched: return 0.737 ETH in two halves of 0.3685. The day the first half lands, I delete the public report the same day. When the second half lands within 24 hours, I withdraw the rest and this ends permanently.

Keep running, and I keep writing. Or walk through the door.

📤 From: 0x639d8fb8f8adc265b0185af95930029bf79e897a
📥 To: 0x8f171c739dc939179bfd3c70739263c380b3e577
🌎 Network: mainnet

Etherscan

🚨 X100.world - Loss ~$4.75M (2026-10-24)

Token: $X @ $50.74
Network: Ethereum

Type: Flash Loan / Access Control (same-block governance capture)

The X100 "Senate" (Freezer / DexTreasury contract 0x79f3…2a46) lets anyone instantly join the senate by freezing governance tokens and paying a 100-X candidacy fee — membership is decided by current frozen stake with no snapshot/timelock, and proposals can call the treasury's own v3Swap in the same transaction. The attacker flash-borrowed ~1.94M USDT (Aave), bought ~38.2K X, split it across two helper contracts that each froze ~19K X and called applyForSenate() to seize a majority of the small senate. They then propose()→vote()→execute()'d a proposal (desc "testnet flash governance proof") invoking DexTreasury.v3Swap, which dumped the treasury's X stash into a freshly-created, attacker-controlled PancakeV3 X/USDT pool at a manipulated price. The attacker withdrew that liquidity, sold the ~400K X on the real pool, repaid the flash loan and walked away with ~4.75M USDT (treasury drained of ~361.8K X).

TX: https://etherscan.io/tx/0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0
Attacker: https://etherscan.io/address/0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63
Victim: https://etherscan.io/address/0x79f35a33fe2813414851c4ae8daeacd14d822a46
X: https://x.com/x100global

@defimon_subscription_bot

💌 Onchain message:

X100 exploit (Oct 24, 2026), 2022.85 ETH. I am an independent researcher in direct contact with the X100 team, not law enforcement. Wallet 0x7ec2 is already flagged by Blockaid, and the FixedFloat funding and the Across trail are documented. Cashing out will be very hard. If you are open to a return-for-bounty deal, reply on-chain to this address with your terms and I will relay them to the team. Do not send any funds yet: the team will confirm a return address through me.

📤 From: 0xadcd1b5f62dd7cd0bc8e4de4c73a2a19e8881e2a
📥 To: 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63
🌎 Network: mainnet

Etherscan

💌 Onchain message:

White Hat Settlement Agreement
To properly resolve this security incident, we hereby formally propose the following white hat settlement terms to you:

I. Asset Return
Please return 1,600 ETH to our designated wallet address:

Receiving Address: 0x0c4816F4E043C62970D86639554C4B73cD938164

Apart from the above amount to be returned, all remaining related assets shall be retained by you as the bounty for this white hat settlement.

II. Settlement Commitments
Upon our confirmation of receipt of the full 1,600 ETH, we undertake to:
1. Immediately initiate the process of removing risk flags associated with relevant wallet addresses and actively coordinate with the relevant institutions to lift the restrictions.
2. We will no longer pursue any legal liability against you.

III. Effectiveness of the Agreement
This settlement proposal shall be formally implemented immediately upon received the above ETH to destined address.

📤 From: 0xb33b824349992fdb035db86552afeb135fdf79a4
📥 To: 0xf637dcee7dd96e8fdab926c5993d558b52d635ea
🌎 Network: mainnet

Etherscan