On August 13, a victim searching for Hyperliquid clicked a sponsored phishing ad on Google and signed a permit approval; 550,000 USDC was drained in a single transaction split across three wallets (Arbitrum).

The attacker most likely operates from Europe, while deposits and withdrawals may have passed through accounts related to Hong Kong, China. Joint inference over a group of wallets linked to the attacker.

On August 10, an attacker exploited a pricing flaw in USM's redemption function, splitting the redemption into 64 small transactions to steal ~70.83 ETH (~$136K).

Iran ranks second at 19%. Joint inference over a cluster of wallets controlled by the attacker.

On July 23, the Drift Protocol exploiter moved 23,095 ETH (~$44M) to Tornado Cash after months of dormancy.

U.S. authorities froze this address holding proceeds of a pig-butchering scam (D.D.C. Civ. No. 26-2644).

Jaredfromsubway, Ethereum's most notorious MEV sandwich bot, was drained of ~$7.5M in a honeypot exploit.

Russia, Ukraine & Eastern Europe combined: 44%, based on joint inference over a set of wallets controlled by the hacker.