Freeze case studies, sanctions alerts and AML guides for P2P. Live posts in our channel @amlconsensus_global.
On November 1 Binance began reopening withdrawals in phases after the October 29 hack. In the first 9.5 hours users withdrew $4.65B and deposited $1.01B — the exchange's own figures. The…
2026-11-03 · →
The key points from our October posts in one place. Save it so you don't have to look for it.
2026-11-01 · →
Yesterday we laid out the timeline of the $6.3B attack. On Oct 30 new facts came out — here is what matters. Times are UTC, status as of the evening of Oct 30.
2026-10-31 · →
Binance puts the damage at about $6.3B, with about $3B frozen. According to the exchange, no keys leaked: the attacker got in through a compromised DevOps engineer's laptop and submitted…
2026-10-30 · →
On October 25–26, Foundation, the maker of Passport hardware wallets, reported more than 23,000 phishing emails sent to its customers. The company does not yet know how many people are…
2026-10-28 · →
On October 24, Electrum 4.8.3 shipped a fix for a critical vulnerability. The developers confirmed that some servers were already using it against users.
2026-10-27 · →
The AML report says: "link to a mixer". Sounds scary. But the real question is how close. A mixer sending money straight to this wallet is one thing. Three strangers' wallets in between is…
2026-10-26 · →
A new wallet is empty. To send USDT from it on Ethereum or TRON, it needs the network's coin to pay the fee — "gas". So someone had to send it first. That first transfer is one of the most…
2026-10-25 · →
An AML check gives you a number from 0 to 100. But what does it mean in practice — when you deposit that money on an exchange? Let's go zone by zone.
2026-10-24 · →
Your exchange deposit is on hold and the email asks: "Please confirm the funds are not linked to high-risk jurisdictions." You've never been to Iran. But your counterparty may have been —…
2026-10-23 · →
On October 21, the PHP developers shipped emergency fixes for two vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, severity 9.2 out of 10). They let an attacker run…
2026-10-22 · →
Your wallet shows "2,000 USDT". Same icon, same name, a nice round amount. The buyer writes: "Sent, check it". But there isn't a single cent of real USDT on that address.
2026-10-21 · →
It happens: you receive USDT in a P2P deal, you check the buyer's address — "low risk". A week later your exchange holds the deposit and asks where the funds came from. How?
2026-10-20 · →
On October 11, Bitquery reported that after the Ledger wallet drain, 5.35M USDC was sitting in five addresses and Circle could freeze it.
2026-10-19 · →
The money arrived, the balance is there, withdrawals are locked, and support says "under review". Here is what to do on that day, step by step.
2026-10-18 · →
On October 12 at 19:01 UTC Tether blacklisted three TRON addresses in one batch. Two of them are linked.
2026-10-17 · →
Crypto card provider BasedApp disclosed a breach on October 8. An attacker got into its internal system; the company detected the attack on October 5.
2026-10-15 · →
Many people think a check is "is the address blacklisted or not". If it were, there would be far fewer freezes. An exchange's compliance team looks at four things.
2026-10-15 · →
SlowMist analyzed a new phishing wave against users of the trading app fomo. The trick is old, but it looks like an ordinary "I'm not a robot" check.
2026-10-14 · →
Look at the collector wallet from the Ledger drain. Its history shows three incoming transfers of exactly the same amount — 1,057,533.50 USDC.
2026-10-14 · →
On October 6, payments platform Conduit Technology sued Tether in the US District Court for the Southern District of New York. The reason: 2.76M USDT frozen in the company's wallet back on…
2026-10-13 · →
We checked the same BNB Chain address in another AML service's free check and in ours.
2026-10-11 · →
Someone sends you an address to pay, or says "sent it, check". No need to copy the address, open the bot and come back — the check works right inside the conversation.
2026-10-10 · →
On October 15, Sharjah Police and the UAE Ministry of Interior announced the results of operation "End of Battle":
2026-10-16 · →
On October 9, 315 wallets on 6 chains were emptied in under an hour, about $93M (Bitquery's count). The victims had one thing in common: their Ledger devices came from the reseller…
2026-10-12 · →
A buyer sends a "payment sent" screenshot, you release the goods — and there's no money. Or the money arrived, but it isn't real USDT. Or the hash is genuine, only the transfer went to…
2026-10-12 · →
According to UnbiasedCryptoNews, one user ran a pay-then-refund loop in a Telegram bot for almost two months and generated about $4.5M worth of Stars. Around $1.5M was cashed out, partly…
2026-10-11 · →
On October 4, a vault on Base lost 1,783 wstETH (~$6M). We traced the money on-chain, and the story has a date for its next move.
2026-10-10 · →
Most crypto thefts aren't hacks — they're one screen where someone missed the catch. We collected those screens in one guide and marked with red numbers where to look.
2026-10-09 · →
An address check answers one question: is this wallet clean? Often the better question is where the money came from and where it went next. That's what the new transfer map on our site is…
2026-10-08 · →
Analyst MASTR spotted a funny story on-chain. We checked it transaction by transaction and found more.
2026-10-08 · →
Not "be careful". Concrete actions, ordered by how people ACTUALLY lose money — and it isn't by breaking cryptography. In 2025, 76% of all losses came from stolen credentials, social…
2026-10-06 · →
Investigator ZachXBT published how he infiltrated a Chinese crime syndicate that laundered $1B+ for North Korea's Lazarus Group across several exploits. The biggest one: Bybit, $1.5B,…
2026-10-06 · →
On October 2, OFAC sanctioned a network that has raised more than $2M for Hamas since 2020 — about $1.5M of it after October 7, 2023. The scheme: "humanitarian aid for Gaza" fundraisers on…
2026-10-05 · →
This is not news. The indictment was filed in the Central District of California on 8 December 2020 — almost six years ago. What makes it worth reading is that nothing has changed since,…
2026-10-03 · →
Every customer asks an exchanger this — out loud or silently. Until now there was nothing to answer with: anyone can say "we screen", and nobody can show it.
2026-10-02 · →
Two things happened on September 30 in the same case. SlowMist, together with Mandiant, published an interim report on the theft from Bitget's hot wallets. And on the same day ZachXBT…
2026-10-01 · →
Tether reported that around $550 million in Iran-linked USDT was blocked with its involvement during 2026. The number alone tells you little. How it happened tells you a lot.
2026-09-30 · →
Bybit released its Restricted Counterparty List — over 50 platforms and organisations you are not allowed to transact with through the exchange.
2026-09-29 · →
Circle and Tether blocked roughly $318,000 out of $351.6M. Nine hundredths of a percent. It is being reported as a failure — the reason is structural.
2026-09-27 · →
After the $351.6M Bitget hack, crypto social media had one answer: stop keeping money on exchanges, move to self-custody and DEXs. It sounds right. Instead of arguing, we measured it.
2026-09-26 · →
On September 22, SlowMist and SentinelOne detailed a fresh campaign by the North Korean group TraderTraitor — the same actor that took $292M from KelpDAO in April through the LayerZero…
2026-09-23 · →
That's a dust attack. Your wallet gets a tiny transfer from an unknown address — sometimes as a token with a link baked into its name, like "claim your reward".
2026-09-23 · →
Sep 17: Treasury designated Iranian exchange BitBank, its developer Pishtaz Simorgh, and three associates in Babak Zanjani's network — under Operation Economic Outcast. Allegation: in…
2026-09-22 · →
An OTC deal, a large P2P trade, paying a contractor, withdrawing to an exchange — more and more often the counterparty wants proof that your address isn't tied to sanctions or mixers. Words…
2026-09-22 · →
You signed nothing, clicked no links, typed no seed. You just updated an app from the official App Store. That's how FomoPeek worked — a "whale tracker" for Solana, Ethereum and TRON, whose…
2026-09-21 · →
On September 19 the Lightning wallet Blink (formerly Bitcoin Beach Wallet, El Salvador) posted on X: "An attacker accessed a limited number of custodial accounts and withdrew funds. The…
2026-09-20 · →
Same story every time. You deal with an address — a counterparty, an exchanger, your own cold wallet. A week later it gets flagged: a sanctions cluster, a scam report. You don't know, you…
2026-09-20 · →
September 15, 16:29 UTC. A script starts draining users of the D'CENT App Wallet — the software companion to the Korean hardware wallet. Wave one stumbles: 72 failures, the script…
2026-09-19 · →
Over the past few weeks we've made wallet checks deeper and easier. The highlights:
2026-09-19 · →
On September 15, 2,900 rsETH (≈$7.73M) were drained from a Safe wallet on Ethereum. Safe, Aave, Uniswap and rsETH itself were not hacked. A custom automation module was — and that was…
2026-09-17 · →
The crypto community is rightly suspicious. We explain in plain terms why a service you only gave a wallet address to physically cannot reach your funds — and how to tell a safe check from a scam.
2026-07-24 · Read →
We took three real crypto addresses and ran them through an AML check. What the blockchain revealed: a clean wallet, an exchange deposit with a sanctioned trail, and North Korean hacker money.
2026-07-23 · Read →
USDT on TRON is the No.1 P2P asset — and the No.1 freeze zone. Step by step: how to check a TRC-20 address for a dirty history, sanctions and Tether freezes in seconds, and what to do at each risk level.
2026-08-02 · Read →
The exchange locked your deposit 'pending review'. We break down the real causes of freezes in 2026, retroactive blocks, and a step-by-step plan: how to get funds back and how to stop it happening again.
2026-08-04 · Read →
OFAC sanctions almost always lead to a freeze on an exchange. We explain what the SDN list is, how to check a BTC/ETH/USDT/TRON/Solana address for sanctions for free, and why it's the single most important AML signal.
2026-08-05 · Read →
One risk number hides the story. The connections graph shows a wallet's counterparties across 35+ networks: nodes coloured by risk, edges by amount. We explain how to read the graph and spot links to mixers and exchanges.
2026-08-07 · Read →
Not just a risk score, but a full investigation: history across all networks, counterparty attribution, category exposure (darknet/gambling/mixer) in USD, 2-hop tracing and typologies. How it works and why it beats competitors.
2026-08-08 · Read →
AML