suspect

According to on-chain analyst @ai_9684xtpa, a whale that built a position of 130,591 ETH in 2023 is suspected of liquidating its holdings.This whale transferred 16,919 ETH to a trading platform 3 hours ago, worth approximately 45.85 million USD; in the past week, it has transferred a total of 128,972.05 ETH to the trading platform, valued at about 345 million USD based on an average transfer price of 2,680.31 USD.If all of the above ETH is sold, the whale is expected to profit approximately 84.31 million USD. After this transfer, the on-chain ETH balance of this entity has been cleared.

According to Lookonchain monitoring, about 11 hours ago, a certain address withdrew 257.6 ETH from Binance, worth 692,000 USD, and 545,000 USDT, then exchanged 545,000 USDT for 200.2 ETH. About 1 hour ago, the address transferred all 457.9 ETH, worth 1,230,000 USD, into the Bitget hacker wallet.

The NFT market Magic Eden appears to have a security vulnerability, with white hat hackers transferring 3,832 NFTs from hundreds of wallets.Quit, the Vice President of Blockchain at Yuga Labs, stated that this transfer is part of a white hat operation. The related NFTs are currently stored in an address starting with "0x71cF," and the assets are in a secure state. They will be returned in full once the risk is eliminated.

Bitget CEO Gracy Chen stated during a live Q&A on platform security incidents that preliminary investigations found that some related IP addresses matched a VPN service used by a North Korean hacker organization, and the attack patterns were similar to previous actions by North Korean hackers. Therefore, the involvement of this organization in the attack, which involves approximately $351.6 million, cannot be ruled out. The relevant attribution is still in the preliminary investigation stage.Gracy Chen indicated that Bitget currently does not believe this incident was caused by internal personnel. The attackers directly infiltrated the platform's system and transferred funds, without forging user withdrawal requests, and did not obtain the private keys of cold wallets or hot wallets. Investigators are still confirming the specific affected systems and the method of the attackers' intrusion.

According to Decrypt, on-chain data shows that approximately $183 million in crypto assets flowed from a wallet marked as Bitget to a newly created address. Bubblemaps and Arkham analysts flagged this unusual activity on September 24, stating that Bitget may have been hacked. The funds were transferred from the exchange's hot and cold wallet reserves within about an hour, involving tokens such as ETH, USDT, USDC, AVAX, BNB, and XAUT.The first anomaly came from the hot wallet. A new address starting with 0xe410 utilized $19.67 million in USDT within 6 minutes, exchanging it for 7,111 ETH through UniswapX and 1inch Fusion, with the transaction price about 5% higher than the market price. On-chain researcher DCF GOD pointed out that subsequently, more wallets marked as Bitget transferred ETH, AVAX, BNB, USDC, USDT, and XAUT to the same address. The outflow of funds stopped about 6 minutes after the first suspicious transaction and remained silent for at least 20 minutes thereafter.Some users reported that withdrawals were blocked, and Bitget has not issued a public statement nor responded immediately to Decrypt's request for comment. On-chain analysts stated that the marked Bitget wallets still hold approximately $500 million in assets. Bitget had launched a $300 million protection fund in 2023 to cover losses from hacks, thefts, and other incidents.

According to monitoring by Scam Sniffer, Duelbits has experienced approximately $4.2 million in fund outflows from hot wallets on the Ethereum, BSC, and Tron networks, suspected to be related to a private key leak.The transferred assets include 836 ETH, 1.62 million USDT, 97,000 USDC, 209 BNB, and 192,000 TRX. Currently, most of the transferred assets have been converted to ETH.

According to Specter Investigation monitoring, the privacy stablecoin payment network Payy Network is suspected to have been attacked, with approximately 1.8 million USDC transferred away.The attacker previously obtained initial funds through the privacy protocol Railgun, then exchanged the stolen USDC for ETH and dispersed the funds to three addresses.

According to the French newspaper "Le Parisien," a family in the city of Taverny, Val-d'Oise, France, was taken hostage by an armed gang. The victim's wife and 10-year-old child were bound, and the male head of the household was tortured with a stun gun. The suspects attempted to seize his cryptocurrency assets, ultimately stealing only a small amount of cash and items from the house.Six suspects were transferred to judicial authorities on September 11 and are under investigation for charges including organized armed robbery, extortion, illegal detention, and participation in a criminal gang.

According to Ai Yi's monitoring, from 23:31 to 23:38 last night, 4 new addresses suspected to belong to the same whale or entity withdrew 31,979 ETH from Coinbase, worth 85.68 million USD, with an average withdrawal price of 2,679.31 USD.

According to Onchain Lens monitoring, the DEED token on the Robinhood Chain is suspected to have experienced a rug pull. 110 associated wallets once controlled about 86% of the token supply and withdrew approximately $700,000; the creator also collected fees of 68.5 Ethereum (ETH), worth about $188,900.The market capitalization of DEED has dropped from a peak of $4.23 million to about $55,000, a decline of approximately 98.7%. The initial funds in the creator's wallet came from KuCoin.

According to the Dutch police (politie.nl), the police in eastern Netherlands arrested two men suspected of using counterfeit EURC cryptocurrency to purchase multiple Rolex watches on the second-hand platform Marktplaats. The victims discovered that the tokens they received were counterfeit and worthless after the payment was made.After the case was exposed on the television program "Plaats Delict," the police identified the suspects through viewer reports. The two men are a 24-year-old male from Geleen and a 45-year-old male from Leiden. During the search, firearms and drugs were found at the residence of the former, who has been detained for 14 days; the latter has been released but remains a suspect in the case. The police remind the public to be cautious with cryptocurrency payments and to avoid using unfamiliar payment methods.

According to a report from the Public Security Bureau of Linwu County, Hunan Province, on August 19, 2026, the Public Security Bureau of Linwu County, Chenzhou City, Hunan Province discovered fraud clues during routine inspections and successfully cracked a virtual currency investment fraud case, arresting two criminal suspects.Upon investigation, on May 1, 2026, the suspect Li met the victim, Ms. Yue, through private messages on a social platform, falsely claiming to teach virtual currency investment skills with guaranteed profits. He induced her to download a certain app to purchase Tether (USDT) and then exchange it for a newly issued virtual currency manipulated by his "superior." Li, in collusion with his "superior," created the illusion of rising prices to lure the victim into increasing her investment; once the funds were in place, they quickly crashed the market, causing the virtual currency's value to drop to zero. Ms. Yue lost approximately 30,000 yuan, while Li illegally profited tens of thousands of yuan, which was collected by his friend Lei and squandered.On August 19, the investigating police arrested Li; on September 17, Lei, who was suspected of collecting the stolen funds, was also apprehended. Both have been criminally detained according to the law. The police remind: virtual currency is not legal tender, and there are no "guaranteed profit" projects. Recommendations for high returns made through private messages online are all fraud traps. Do not easily trust investment recommendations from strangers or transfer money to unfamiliar platforms.

According to Bloomberg, sources have revealed that U.S. federal prosecutors are investigating whether Binance Holdings Ltd. violated U.S. sanctions against Iran by failing to prevent certain transactions on its platform.The investigation into Binance's compliance is being handled by the Manhattan U.S. Attorney's Office. One source also noted that the Criminal Division of the U.S. Department of Justice in Washington is involved in the case, and authorities are focusing on whether Binance knowingly allowed the relevant transactions to proceed.

The founder of Slow Fog, Yu Xian, disclosed that following the previous FomoPeek App poisoning and theft incident, a food delivery app named ComeCome (comecome.icu) has been found to implement attacks using similar methods. FomoPeek versions v1.1-1.2 contain a malicious SDK that integrates 8 types of iOS kernel exploit schemes, which can automatically select attack methods based on device model and system version. The known affected iOS versions cover iOS 12--18.7 and 26--26.1.After a successful attack, it can break through the iOS sandbox mechanism, thereby stealing assets from cryptocurrency wallets. Yu Xian warned that such threats may also affect iPad and Mac devices, and advised users to immediately update to the latest iOS version and remain highly vigilant against apps from unknown sources.

According to Ember monitoring, after the AKE price briefly rose by 115%, it is suspected that its active market maker withdrew 216 million AKE from Binance Alpha 4 hours ago, worth approximately 13.83 million USD.This entity currently holds at least 1.24 billion AKE on-chain, valued at approximately 803 million USD, accounting for over 54% of the circulating supply. Ember speculates that AKE and the previously risen B2 may be operated by the same active market maker.

According to on-chain analyst Yu Jin's monitoring, B2 rose 120% from $0.41 to $0.9 this afternoon. It is suspected that B2's active market maker transferred 13 million B2 to Binance Alpha through multiple wallets, worth $10.44 million.This batch of B2 was withdrawn from Bitget and Gate about a month ago, when the price was $0.47, currently making a profit of $4.27 million. One of the receiving wallets is associated with the address that previously operated SIREN; Yu Jin believes that this active market maker may be the same party that previously operated SIREN, AKE, XPIN, and BTR projects.

According to Lookonchain monitoring, a wallet suspected to be related to BIT (formerly Matrixport) has deposited 1,000 BTC, worth 81.06 million USD, into Binance again.

According to Ledauphine, a violent kidnapping case related to cryptocurrency occurred in Taning, Haute-Savoie, France. Late at night on March 14 of this year, two masked men broke into the home of a 48-year-old woman, bound and beat her for several hours, and attempted to seize her cryptocurrency assets, subsequently trying to forcibly take her away. The victim was seriously injured but managed to escape using her survival instincts and sought help from a neighbor.The case is led by the Lyon inter-regional specialized judicial authority and is being investigated by the Chambéry gendarmerie search squad. After six months of in-depth investigation, police launched simultaneous operations in early September in the Île-de-France region, Isère, and Brittany, mobilizing over 60 gendarmes, successfully arresting five suspects in their early twenties, four of whom were formally charged, and three were detained pending trial. This case marks the third violent extortion incident targeting cryptocurrency holders in the Savoie region within a year.

According to on-chain analyst Ai Yi's monitoring, a certain multi-signature address transferred 9.2 million LSK to a certain address, valued at 6.52 million USD; subsequently, 2 million LSK was recharged to GSR's Binance deposit address. A similar operation occurred 9 months ago.LSK surged to 2.37 USD last weekend, an increase of nearly 10 times, and is currently reported at 0.5084 USD, with a market value shrinking by 78.5% from its peak.

According to on-chain analyst @ai_9684xtpa, as the ETH price returned to $2500, the address 0x138...a4d35 accumulated a deposit of 3333 ETH to OKX within 4 hours, and subsequently withdrew 5.92 million USDT from the exchange, suspected to have partially sold, involving an amount of approximately $8.4 million.