AMLBot (@AMLBotHQ)

Pinned post

Follow-up on the @binance hack: the part of the stolen funds that is moving is being split fast across hundreds of TRON and EVM wallets. So we are opening Polytrop — a tool we had in the works — as a public beta today.

Polytrop follows stolen funds live. From the moment they leave a hacked wallet it labels every attacker address they touch within seconds, and shows how far ahead of the money each label was.

Binance case so far (21:20 UTC):
• 10 source wallets tracked (TRON + EVM), ~$225M moved out of them
• ~1,500 addresses labelled across 7 hops
• Median lead 2.5 h — the sender was labelled 2.5 hours before funds left it.
• 5 services reached
Coverage today: TRON, Ethereum and several EVM chains. Not covered yet: BTC/XRP/SOL.
Live case, updating as funds move: polytrop.io/incident/TSpe5…
It’s a beta. Tell us what you’d want in it — alerts when funds hit a service, a blocklist/API feed, more chains, something else.

AMLBot @AMLBotHQ 2d

Get 100% cashback and an exclusive AMLBot x Kolo card design

We’ve partnered with @KoloHub, a crypto wallet with a virtual Visa Platinum card. Use it to pay for AMLBot credits or spend crypto anywhere Apple Pay and Google Pay work.

To celebrate, AMLBot users get:
• An exclusive AMLBot card design in the Kolo app
• 100% cashback on one payment in your first month

0:32

Kolo💚 Verified account @KoloHub 2d

We're excited to announce our partnership with @AMLBotHQ

AMLBot is an all-in-one crypto compliance platform: AML wallet screening, real-time transaction monitoring (KYT), KYC/KYB verification and blockchain investigations. One platform, one API and one support team.

To celebrate, new AMLBot users get special terms:

- 100% cashback on one card payment in the first month
- An exclusive AMLBot x Kolo card design in the Kolo app

View quoted post on X

AMLBot @AMLBotHQ 2d

The @binance attacker is laundering the XRP leg through @THORChain using scripts/bots

Today, 1,027 swaps from 18 wallets sent 51.6M XRP (~$61M) into THORChain, a new swap roughly every 20 seconds for 15 hours. So far 33M XRP has been swapped to ~481 BTC (~$36M), paid out to 27 BTC addresses

The bots also glitched: 20 swaps from one wallet carried “NaN” instead of a price. A likely cause is the bot hitting THORChain’s price-quote limit (1 request per second), getting no answer, and sending anyway. THORChain rejected them and returned the XRP

Example: xrpscan.com/tx/40E09E0D30A…

AMLBot Verified account @AMLBotHQ 6d

Update: The @binance attacker has now started to move the XRP leg

All 233.46M XRP (~$292M) was split from the original wallet into 6 new wallets: five with ~40M XRP (~$50M) each and one with ~33.5M XRP (~$42M). Each received a 1,000 XRP test first

The funds have not moved further yet. We are monitoring the related addresses

View quoted post on X

AMLBot @AMLBotHQ 3d

$2.85B of the ~$6.3B stolen in the @binance exploit (~45%) can no longer be moved by the attacker

Our investigators dug into the case. USDT and USDC make up 91% of it: $1.77B USDT blacklisted across Ethereum, Tron, Avalanche and Polygon, and $823M USDC. The rest is 21 other assets, including wBETH, XAUt, RLUSD and USD1. Over $2B of the frozen total sits in a single address

However, not all of it is an issuer freeze. The @arbitrum Security Council seized 8,426 ETH + 74.56M ARB, @Optimism governance recovered 44.23M OP from the attacker, and 984M BEAM was burned ~77 minutes after the drain began. Binance blacklisted its own wBETH in the attacker's hands

AMLBot Verified account @AMLBotHQ 4d

After the @arbitrum Security Council took action, @Optimism has now recovered 44.23M OP (~$4.8M) from the @binance attacker

On Oct 31, Optimism's Security Council upgraded the code of the bridge contract linking Ethereum and OP Mainnet. This let them move the attacker's OP without the attacker's approval, sending all 44.23M OP to an address controlled by Optimism. The original code was put back in the same transaction

Related transaction:
optimistic.etherscan.io/tx/0x120aa6c2e…

View quoted post on X

AMLBot @AMLBotHQ 3d

North Korea has denied any role in the $6.4B Binance hack. The FBI attributed the October 29 theft to TraderTraitor.

@CoinDesk asked our COO and Head of Investigations Vasily Vidmanov what on-chain data can actually prove:

"Onchain analysis can link wallets to one actor. It can't prove nationality or state sponsorship. The evidence supporting the DPRK attribution is cumulative and goes well beyond speculation."

Read the full article:
coindesk.com/business/2026/…

www.coindesk.com North Korea denies role in $6.4 billion Binance hack after FBI points to TraderTraitor The high-profile denial follows FBI alerts identifying North Korean-controlled wallet addresses tied to the largest cryptocurrency exploit in history.

AMLBot

Latest posts 5