Investigations
July 20, 2026
Allbridge Core · Investigation
A flash loan from Kamino, a distorted pool ratio, and three withdrawals out of Allbridge Core's Solana pool. One leg swapped to DAI and moved toward NEAR through a wallet funded via RAILGUN. Another leg matched — to the decimal — a bridge transaction already under separate investigation.
Allbridge Core
RAILGUN
NEAR Protocol
Mayan Protocol
Read investigation →
July 20, 2026
Raydium Exploit · Investigation
GoPlus and PeckShield's post-mortems on the June 10 Raydium legacy-pool exploit ended at "funds went to Tornado Cash." This investigation traces the 800 ETH further — a Dune query, a Maya Protocol hop, and two Zcash addresses that shielded, then deshielded again.
Raydium
Tornado Cash
Maya Protocol
Zcash
Read investigation →
June 16, 2026
Guide · Blockchain Forensics
A practical methodology for post-mixer tracing. Real tools, real SQL queries, and the behavioral patterns most investigators miss — developed across live exploit investigations.
Dune Analytics
Metasleuth
LI.FI
Hyperliquid
Read guide →
June 15, 2026
Cyrus Finance · Part 2
Closing the books on Cyrus Finance. The remaining 210 BNB followed the same laundering architecture — but 1.67 BNB peeled off through a different bridge entirely, on a route the attacker had been quietly preparing since January. That detour leads somewhere Part 1 never went: Solana.
BNB Chain
Tornado Cash
Solana
Hyperliquid
Read investigation →
May 29, 2026
Cyrus Finance · Part 1
On March 22, 2026, someone drained $516,840 from Cyrus Finance. CertiK's post-mortem ended with "funds went to Tornado Cash." This investigation picks up where theirs left off — tracing 600 BNB through the mixer, across bridges, and into Hyperliquid spot positions in a token called XMR1.
$516K exploit
Tornado Cash
LI.FI bridge
Hyperliquid
Read investigation →