Brazil’s central bank has announced plans to implement a system that monitors threats to crypto assets and issues real time alerts when potential risks are detected.

 

The monitoring system, which is being developed through a partnership between Brazil’s central bank and blockchain security firm Hypernative, has reportedly been tested with market participants and will be implemented by industry associations within the next two weeks.

 

When launched, either the central bank or Hypernative will be able to receive these alerts and distribute the messages to their members in real time.

 

Speaking to Valor Econômico, Brazil’s largest financial publication, Regina Pedroso, executive director of the Brazilian Tokenization Association, said the initiative began to be discussed at the end of last year, when the central bank began forming a working group among blockchain associations tasked with monitoring and warning of cyberattacks.

 

According to Pedroso, the monitoring system was tested among member blockchain associations, including Mercado Bitcoin and Foxbit, two of Brazil’s largest cryptocurrency exchanges. Pedroso also noted that the central bank had already issued a bulletin outlining how the system will be implemented among association members.

 

The launch of the monitoring system by Brazil’s central bank underscores the country’s efforts to track threats involving crypto assets, particularly because cryptocurrencies can provide an exit rail for cybercriminals and fraudsters.

 

Although there has not been any major institutional cyberattack in Brazil this year, the country suffered several security incidents last year, most notably the hack of C&M Software, a technology company that connects smaller banks and fintechs to the central bank’s systems.

 

The hack reportedly led to the loss of approximately $140 million to $180 million, with $30 million to $40 million of the stolen funds reportedly converted into cryptocurrencies, including Bitcoin, Ether, and USDT, through OTC desks and exchanges in the region.

 

Blockchain protocol Term Labs has lost an estimated $8.5 million after suffering a governance exploit that allowed hackers to gain control of the protocol’s vaults and drain funds.

 

According to blockchain security firm PeckShieldAlert, the attackers first built up enough voting power to take full control of four of the five USDC vaults and approximately 91% of the protocol’s Ethereum Meta vaults.

 

 

With this much voting power, the attackers were able to pass proposals, eventually enabling them to drain approximately 2,843 ETH, worth $6.87 million, and an additional $1.68 million in funds.

 

In response to the exploit, Term Labs acknowledged the incident. Although the team said it would share more details as the incident is being investigated, it advised all of its customers, as a safety precaution, to revoke all approval contracts associated with the protocol.

 

Governance exploits, which often involve attackers gaining enough voting power to execute malicious proposals, have become increasingly prevalent in recent times.

 

Prior to the Term Labs exploit, BonkDAO, a decentralized autonomous organization, also lost an estimated $20 million to $21 million from its treasury after attackers spent roughly $4.4 million buying enough BONK tokens to gain control of the votes and pass malicious proposals.

 

Crypto wallet SafePal has suffered a security breach that exposed the personal information of approximately 39,798 customers.

 

In a post on X, the crypto wallet said the affected customers were users who placed orders between March 2, 2025, and April 11, 2026. According to SafePal, the exposed information included names, email addresses, shipping addresses, phone numbers, and purchase details.

 

However, sensitive information such as seed phrases, private keys, wallet passwords, other wallet credentials, bank account information, payment card numbers, and government issued identification numbers were not exposed.

 

 

Detailing the incident in a blog post, SafePal said the breach was caused by an authorization flaw in the order tracking function of one of its plug-ins associated with customer order information. The flaw made it possible for unauthorized parties to access customers' information. After detecting the flaw, SafePal said it promptly fixed the issue and introduced additional security measures.

 

SafePal has warned affected customers to remain vigilant, as their exposed personal information could potentially be used in sophisticated phishing campaigns. According to the company, these campaigns may take several forms, including fraudulent phone calls, emails, text messages, letters, refund offers, firmware update requests, and fake customer support communications, all intended to obtain customers' wallet credentials or additional personal information.

 

Response Efforts So Far

 

As part of its remediation efforts, SafePal said it had fixed the flaw and implemented additional security measures. It also engaged an independent third party security firm to verify that the flaw had been fixed and conduct a broader security assessment of its systems.

 

It said it had also opened a dedicated support channel to respond to affected customers. The crypto wallet company also claimed it had taken down more than 30 websites and phishing links reportedly linked to the scam.

 

Blockchain analytics firm Elliptic recently secured $120 million in a Series D funding round led by One Peak, with participation from Nasdaq Ventures, Deutsche Bank, and the British Business Bank. The company is now valued at $670 million.

 

 

According to Elliptic, the funding will be used to accelerate its mission to deliver enterprise-grade on-chain analytics to some of the world’s largest financial institutions, including banks, fintech companies, crypto companies, and government agencies.

 

“As digital assets become more embedded in the global financial system, institutions need trusted infrastructure to manage compliance and risk at scale. Elliptic’s platform plays an important role in providing that infrastructure, helping firms navigate digital asset adoption with confidence and integrity,” said Gary Offner, Senior Vice President and Head of Nasdaq Ventures.

 

Among Elliptic’s expansion plans is scaling its native artificial intelligence compliance system for enterprises. Leveraging its years of experience building one of the most comprehensive and diverse datasets and its ability to process more contextual information per second than competitors, Elliptic plans to build an enterprise-grade compliance system that allows compliance teams to do more with less: alerts resolved in minutes rather than hours, human judgment reserved for where it genuinely matters, and compliance costs falling as volume grows.

 

“As institutional adoption of digital assets accelerates, the demand for scalable compliance solutions has never been higher. Elliptic pioneered the use of blockchain analytics to meet this challenge and has cemented its status as a global leader, screening over 1 billion transactions a week for more than 700 customers in 30 countries,” said Charlotte Lawrence, Managing Director of Direct Equity at the British Business Bank.

 

This capability will also benefit stablecoin and tokenized asset companies that process billions of dollars in transactions. In 2025, about $33 trillion in transactions were processed by stablecoin companies. By leveraging its data intelligence infrastructure, Elliptic enables these companies to meet enterprise-grade compliance requirements in real time, an operational necessity for crypto exchanges that handle and move billions of dollars in crypto daily.

 

About Elliptic 

Elliptic is a London-based blockchain analytics firm that specializes in tools for financial crime risk management, anti-money laundering (AML), transaction monitoring, wallet screening, investigations, and threat intelligence across the global crypto ecosystem.

 

Elliptic currently serves over 700 clients across 30 countries, supports more than 65 blockchain networks, and screens about 1 billion blockchain transactions each week. It has partnered with leading industry players, most recently the layer 1 Solana and the Tempo blockchain networks.

 

 

Binance, the world’s largest cryptocurrency exchange, has just rolled out a new wallet feature to combat the rising cases of wrench attacks against crypto holders.

 

Announcing the launch of this feature, Binance wrote in a Monday blog post, “Most security advice you will read about crypto assumes that the threat is digital. Some of the main threats include malicious phishing links, imposter scams, SIM swaps, and compromised seed phrases, and the industry has built strong defenses against them.”

 

“But there is a category of risk that those defenses do not cover: physical coercion. These are situations where someone is pressured, in person, to move their own funds. Such cases are rare, but when they happen, the losses can be severe and irreversible.”

 

When activated, this new withdrawal protection feature blocks all on-chain withdrawals from a user's Binance account for a preset lockdown period, during which no one, not even the owner of the wallet, can move crypto assets out of the wallet.

 

The new withdrawal protection feature can be enabled from the settings section of the Binance wallet. While 48 hours is the default lockdown period, a user can choose to change this to anywhere between 1 and 7 days, depending on their preferences.

 

 

To enhance flexibility, Binance added a toggle feature that allows users to end the lockdown period early, especially in emergency cases when a user needs to move crypto assets from their wallet. It is also important to note that this feature only restricts withdrawals, thus users can still trade, hold positions, and carry out other in-wallet activities even when the withdrawal protection feature is enabled.

 

Crypto Wrench Attacks on the Rise

Crypto wrench attacks have steadily risen over the last few years. According to a CertiK report, there were 72 verified cases of physical attacks and coercion against crypto holders in 2025, an increase of nearly 71% from the 41 cases recorded the previous year, with losses amounting to over $41 million.

 

This year has not been an exception, as there have been several recorded cases of wrench attacks, with France being an epicenter of these attacks.

 

Just last month, a family of five in France was held captive by two men who invaded their home and extorted approximately €700,000 worth of cryptocurrencies.

 

In another attack in France, a mother and her son were kidnapped by four armed men who demanded about $471,000 for their release. The victims were held hostage for about 20 hours before they were eventually released, and the suspects were arrested by law enforcement officers.

 

 

Wasabi Protocol, a multichain decentralized perpetual futures trading platform, was hit by an exploit that led to the loss of more than $5 million across several chains.

 

The exploit, according to blockchain security company PeckShield, was carried out across multiple chains, including Base, Berachain, Blast, and Ethereum, which is its main deployment chain.

 

The incident was also flagged by blockchain security firms CertiK and Blockaid, with both firms attributing the cause of the hack to a compromise of the Wasabi deployer wallet, which allowed the attacker to gain privileged admin access and subsequently drain funds from the protocol.

 

“The Wasabi deployer externally owned account was used to grant admin role access to an attacker-controlled helper contract, which then upgraded the perpetual vaults and LongPool to a malicious implementation that drained balances,” Blockaid wrote in a post on X.

 

“All Wasabi and Spicy liquidity provider share tokens minted by these vaults should be treated as compromised. The underlying assets backing them have been drained or are at risk while the Wasabi deployer key remains active. End users holding these tokens are showing book value, but the redemption value is zero,” the firm added, while recommending the immediate flagging and revocation of these tokens.

 

Blockchain security firm Cyvers also provided further details on how the incident occurred. According to Cyvers, a crypto wallet funded through Tornado Cash was used to deploy a malicious contract on Wasabi Protocol across the Base and Ethereum chains.

 

As a result of this malicious contract deployment, about $4.5 million in various crypto assets, including WETH, USDC, BTC, VIRTUAL, and cbBTC, as well as memecoins such as PEPE, MOG, and REKT, were stolen. The funds were later consolidated into Ether and distributed across multiple wallet addresses outside the protocol.

 

Wasabi Protocol Responds

Following the disclosure of the exploit by security teams, the Wasabi team, in a post on X, stated that they were aware of the breach and were actively investigating the incident alongside security experts, notably Security Alliance and Blockaid.

 

The team also warned against interacting with a list of compromised vaults and EVM positions across Base, Blast, and Berachain, while stating that users whose vaults were not among the compromised list could proceed with withdrawals at any time.

 

The Wasabi exploit closed the month of April, which recorded some of the largest crypto exploits, including those involving Drift Protocol and KelpDAO, which led to losses of $285 million and $293 million, respectively.

 

 

BitMEX, a derivatives-focused cryptocurrency exchange, has partnered with Zodia Custody, an institutional-first digital assets custody firm, to enable off-exchange trading and secure asset custody for BitMEX’s clients.

 

The partnership, announced this week, will see the integration of Zodia Custody’s Interchange platform into BitMEX. Interchange is an off-venue settlement solution that allows institutional and professional clients to trade directly on BitMEX while keeping their digital assets securely held off-exchange with Zodia Custody.

 

 

This partnership, according to Stephan Lutz, BitMEX CEO, draws on lessons learned from past market failures, especially the collapse of the FTX cryptocurrency exchange and the 1.4 billion dollar Bybit hack. These events, Lutz said, exposed the risks associated with unsegregated or compromised exchange-held funds and are key examples of how custody failures or security threats can put client funds at risk.

 

Through this partnership and the integration of the Interchange platform, BitMEX clients, especially institutional clients that often trade with large amounts of money, do not have to worry about the safety of their funds on the exchange in the event of a hack, as their digital assets are secured in Zodia Custody’s cold, segregated storage wallets.

 

The partnership also serves to bridge the gap between institutional-grade security and crypto-native liquidity, allowing BitMEX’s professional and institutional clients to access BitMEX’s deep crypto derivatives liquidity while eliminating the need to pre-fund the exchange before trading.

 

The Growing Need for Security on Crypto Exchanges

Security has been one of the major challenges faced by cryptocurrency platforms over the years. In 2025, over $4 billion was stolen from crypto platforms. This represents a 34 percent increase compared with 2024, when losses stood at $2.2 billion. Unfortunately, the recovery rate of stolen crypto funds remains very low, at less than 8 percent. This is even worse for centralized exchanges, which are often high value targets.

 

By integrating Zodia Custody’s interchange platform into its crypto infrastructure and allowing clients’ digital assets to be stored in Zodia Custody’s segregated vaults, BitMEX eliminates the trade offs institutional clients face when choosing between derivatives trading access and the safety of their assets. Since Zodia handles the custody of clients’ assets, BitMEX faces minimal damage in the event of a security breach or hack. 

 

 

Bitcoin has always operated on a simple, almost sacred premise: if you hold the private key, you own the coins. No government, no bank, no developer team can touch them. That promise is now being questioned from within, and the debate it has triggered cuts straight to the heart of what Bitcoin actually is.

 

Casa CTO Jameson Lopp and five co-authors formally published BIP-361 to Bitcoin's official GitHub repository on Tuesday. The proposal, titled "Post Quantum Migration and Legacy Signature Sunset," outlines a three-phase plan to migrate coins off quantum-vulnerable addresses. Wallets that do not migrate within the designated window would have their funds frozen at the consensus layer, meaning the network itself would prevent any movement of those coins. A bit frightening and something this author never thought he would be writing about. Bitcoin freezing coins. A very slippery slope.

 

What Is Actually at Risk

Roughly 34% of all Bitcoin in circulation sits in early Pay-to-Public-Key addresses where the public key is fully exposed on-chain. That includes what most analysts believe to be Satoshi Nakamoto's estimated 1.1 million BTC, worth around $74 billion at current prices. Zoom out further and Lopp estimates that approximately 5.6 million Bitcoin, worth somewhere in the range of $420 billion, has not moved in over a decade and is likely lost.

 

The cryptographic concern here is real, even if the timeline is still fuzzy. Bitcoin's current security relies on elliptic curve math. A sufficiently powerful quantum computer running Shor's algorithm could theoretically work backward from an exposed public key to derive the private key, handing an attacker complete control of the wallet. Google flagged 2029 as a plausible threat horizon in a recent report, warning that quantum progress may be "closer than may appear."

 

The more immediate concern Lopp is raising is not technical, it is psychological. "If there is any credible evidence that anyone has the capability to recover lost or vulnerable coins with a quantum computer, you should expect a massive market panic immediately," he told CoinDesk. "It doesn't even require a massive market dump." Rational holders, he argued, would exit the system before confidence in the blockchain can be restored.

 

How BIP-361 Would Actually Work

The proposal is structured in three phases that only kick off after a companion proposal, BIP-360, is activated. BIP-360, which introduces quantum-resistant address types via a new pay-to-Merkle-root transaction format, entered testnet implementation through BTQ Technologies in early 2026.

 

Phase A would arrive roughly three years after BIP-360 activation. At that point, wallets would be blocked from sending new funds to legacy address types. Users could still move coins out of vulnerable addresses, but nothing could flow in. Phase B arrives two years after that, invalidating all legacy signatures at the consensus level. Any Bitcoin still sitting in unmigrated addresses at that point becomes effectively frozen and unspendable under network rules.

 

Phase C, still under research, would offer a last-resort recovery mechanism. Using zero-knowledge proofs tied to a BIP-39 seed phrase, holders who missed the deadline could potentially prove ownership of frozen funds without ever exposing a private key. That said, no activation timeline has been set, and the proposal remains in draft status.

 

Even the Author Says He Does Not Want This to Happen

Lopp has been unusually candid about his own ambivalence. In a post to X after the proposal dropped, he wrote: "I know folks don't like BIP-361. I don't like it myself. I wrote it because I like the alternative even less." He told Cointelegraph separately that the proposal is "a rough sketch" and is "not currently in a position to be adopted." He is, in his own framing, thinking adversarially about a potential future threat rather than lobbying for immediate change.

 

He has used stronger language in the past. In a blog post from early 2025, Lopp described quantum computer operators recovering dormant coins as "vampires feeding upon the system," arguing they trade nothing of value and simply extract from an ecosystem they did not build.

 

The Community Is Pushing Back Hard

The response from the Bitcoin community has been swift and, in many corners, hostile. Bitcoin Magazine editor Brian Trollz rejected the proposal outright. TFTC founder Marty Bent called it "laughable." Phil Geiger of Metaplanet put it bluntly: "We have to steal people's money to prevent their money from being stolen."

 

Frederic Fosco, co-founder of Bitcoin metaprotocol OP_NET, told Decrypt the proposal turns Bitcoin's founding promise on its head. A protocol-enforced freeze "is confiscation, full stop," Fosco said. "The second you cross that line, you've built a system that can freeze any coins for any reason deemed important enough by whoever controls the next soft fork."

 

Blockstream CEO Adam Back, speaking at Paris Blockchain Week on Wednesday, staked out a different path. He argued that Bitcoin should start adding optional quantum-resistant features now, while leaving any forced migration decisions to the future. Back suggested Bitcoin's rough-consensus governance has historically been capable of rapid emergency coordination, pointing out that critical bugs have been patched within hours when the threat was real and visible.

 

The divide is real and it is not going away. On one side sits a developer community that wants to get ahead of a threat that could, if realized, crater confidence in the largest cryptocurrency on earth. On the other side are holders and advocates who see any network-enforced freeze, however well-intentioned, as a precedent that fundamentally rewrites what Bitcoin is. BIP-361 has no activation timeline and depends on a separate proposal that has not yet been adopted. But the conversation it has forced is one Bitcoin will eventually have to finish.

 

Blockchain data analytics company Chainalysis announced on Tuesday at its annual Links conference in New York the introduction of its blockchain intelligence agents, designed to scale investigations and compliance for security professionals and organizations.

 

According to the company’s CEO and co-founder, Jonathan Levine, the AI agents are not a “new product” or a “bolted-on chatbot feature,” but rather an evolution of the company’s existing platform and experience, built on insights from billions of transactions screened and more than ten million investigations conducted over the past decade.

 

"Chainalysis blockchain intelligence agents put the full depth of our platform, our data, products, and institutional expertise, into the hands of anyone in your organization,” Levine wrote in a company blog post. “From seasoned investigators and compliance analysts to executives, Chainalysis agents provide insights and amplify what your team can do.”

 

 

To ensure transparency and reliability in its use, the Chainalysis team built its blockchain intelligence agents around four key principles: data quality, context and reasoning, auditable results, deterministic workflows, and human control. These principles are designed to help the agents deliver accurate and consistent insights.

 

The blockchain intelligence agents will begin rolling out over the summer, and the team expects that, over time, they will be used by professionals across a range of roles to unlock new levels of blockchain insight.

 

Chainalysis Joins the AI Agents Race

Prior to Chainalysis's integration of AI agents into its blockchain intelligence platform, several blockchain companies had already developed and launched their own AI-powered tools.

 

On March 25, blockchain intelligence firm and Chainalysis competitor TRM Labs announced the launch of its Co-Case Agent, an embedded AI investigative assistant that enables investigators to use plain-language prompts for complex on-chain tasks such as tracing funds, auditing transaction graphs, and maintaining immutable audit logs for Suspicious Activity Reports (SARs).

 

Blockchain analytics and crypto intelligence platform Nansen also launched its Nansen AI agent earlier this year. The conversational assistant supports on-chain research and agentic trading, helping users analyze wallets, identify market signals, and suggest trades.

 

These AI agent releases followed the introduction of Elliptic’s Copilot. In April 2025, the blockchain analytics and crypto compliance firm launched its AI-powered assistant to streamline compliance workflows and risk management.

 

Elliptic’s Copilot is widely regarded as one of the earlier AI assistant tools introduced by a blockchain intelligence company.

 

 

The U.S. Federal Bureau of Investigation (FBI) has warned crypto users about a fake token on the Tron blockchain impersonating the agency.

 

In a post on its New York X account, the FBI said some Tron users have received messages from scammers posing as the agency, asking them to complete an anti-money laundering verification to avoid having their assets frozen and falsely claiming their wallets are under investigation.

 

The FBI cautioned against falling for such scams. “If you receive a token from an account with the details below, do not provide any identifying information to any website associated with the token,” the agency said.

 

Users who have already sent their personal information to the scammers were urged to file a complaint with the Internet Crime Complaint Center.

 

 

Inside Crypto Phishing Scams

The launch of the fake FBI token is one of several crypto phishing scams that have emerged in recent months. These scams often involve impersonating recognized government agencies, companies, or public figures, tricking users into giving up their personal credentials.

 

According to Scam Sniffer, about 106,106 victims were affected by crypto phishing scams in 2025, resulting in losses of approximately $83.85 million. 

 

Although this represents a significant drop compared to the $494 million in losses and 332,000 victims recorded the previous year, phishing remains widely used by attackers, especially with the growing use of AI-generated phishing campaigns.

 

 

FBI Created Fake Cryptocurrency Token

In 2024, the FBI created a fake artificial intelligence–related token, called NexFundAI, an Ethereum-based cryptocurrency designed to catch scammers.

 

The NexFundAI token was part of Operation “Token Mirrors,” launched to identify and expose fraudulent market makers and manipulators, including those involved in wash trading and pump-and-dump schemes.

 

The operation was successful, as it led to the arrest of more than 18 individuals and the seizure of several million dollars from the suspects. 

 

 

 

Trust Wallet has introduced a new address-poisoning protection feature that prevents crypto users from falling for address-poisoning attacks.

 

According to the company, this new feature automatically checks the destination address against a database of known scam and lookalike addresses to prevent malicious transactions. Because the feature runs automatically, users will receive real-time warnings if a risk is detected.

 

For now, the feature will be supported on 32 Ethereum Virtual Machine (EVM) chains, including Ethereum, BNB Smart Chain, Polygon, Optimism, Arbitrum, Avalanche, and Base.

 

The Menace of Address Poisoning

Address poisoning is a phishing-style attack in which scammers trick users into sending cryptocurrency to the wrong wallet address, usually one that closely resembles a legitimate address. 

 

Here’s how address poisoning works:

• A scammer generates a look-alike wallet address, typically one that shares the same first and last characters as a legitimate address.
• The attacker then sends a tiny, or “dust,” amount of crypto to an unsuspecting user.
• The fake address subsequently appears in the victim’s transaction history.
• Because crypto transactions are irreversible, the user may mistakenly send funds to the poisoned address, losing them permanently.

 

While address poisoning may not look as sophisticated or complex as other forms of crypto attacks, it has had a long history of success for scammers. 

 

In May 2024, a user accidentally sent 1,155 Wrapped Bitcoin (WBTC) worth approximately $68 million to a fake address. The attacker created a fake address that looked like the legitimate address, and due to lack of proper scrutiny, the user fell for it.

 

While in May 2025, a trader lost $2.6 million after falling for two address poisoning scams, and later that year, another trader lost $50 million in USDT after sending them to a poisoned wallet address.

 

 

Address Poisoning is Just a Numbers Game

Knowing that most crypto users rarely fall for address poisoning scams (roughly 1 success per 10,000 attempts), attackers often rely on scale to succeed. 

 

Between July 2022 and June 2024, over 270 million address poisoning attempts were recorded across the Ethereum and BNB Chain, with 6,633 of these attempts successful, leading to a loss of over $83 million. 

 

In another address poisoning campaign, scammers used 82,031 fake addresses on 2,774 victims. The result? Over $69 million was lost. 

 

And just last year, there were about 32,290 recorded address poisoning attacks in September, which affected over 6,000 victims.

 

 

An X user with the username "Sillytuna" has reportedly lost $24 million in Aave Ethereum USDC (aEthUSDC) in an attack that involved a combination of violence, sexual assault, weapons, and threats to life.

 

 

"Bruised, held off while I could, but can't do that much with axes over your hands and feet," Sillytuna wrote. The user further stated that he was, at this point, done with crypto. In his words, "And now... definitely out of crypto ****ers."

 

While the matter has already been reported to law enforcement, no official statement has been issued by the authorities. However, the X user has announced a 10% bounty for whoever helps recover the stolen funds.

 

 

 

How the Crypto Community Reacted

Shortly after the news went viral, the crypto community reacted with mixed feelings, with many commiserating with the user over their loss. Some also raised awareness about the deplorable state of security in the United Kingdom. Apparently, the victim is a UK resident.

 

 

Amid the sympathy from the global crypto community, some, however, doubted the authenticity of the victim's story.

 

According to YokaiCapital, an X user, the victim had not posted anything about crypto before. He also alleges that the victim's account appears to have been bought recently.

 

"He will probably shill the coin at some point or say that he will take donations from the coin," YokaiCapital went on to write. 

 

However, the victim has denied allegations that he intentionally wanted to trend and claims the stolen funds were long-term holdings.

 

 

How the Attackers Moved the Stolen Funds

Tracking the stolen funds, blockchain analytics firm Arkham Intelligence said that the attackers moved the funds across Layer 2 networks, Bitcoin, and Monero, obviously to evade trail.

 

 

 

Roughly $20 million of the stolen funds were stored in two Ethereum addresses as DAI, a stablecoin on the Ethereum network, while $2.48 million was bridged to USDC on Arbitrum.

 

Arkham reported that the attackers sent $2.47 million to Hyperliquid through 19 separate Wagyu accounts, which were used to convert the funds to Monero (XMR).

 

The attackers also bridged $1.1 million to the Bitcoin blockchain using LiFi, noting that 0.5 BTC was deposited into a mixing service, Arkham added.