← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,211
Relationships
32,356
Potential duplicates
0
Filter by kind
Entities (event)
↯d0834d23
EXMO detects and halts a hot-wallet hack; roughly 5% of platform assets (an estimated $10.5 million) are stolen and never fully recovered.(2020-12-21:exmo-exchange-uk-russia-sanctions-shutdown)event
↯0e4cf2e9
EXMO managing director Pavel Lerner is abducted in Kiev, Ukraine, by unidentified individuals; EXMO says the incident does not affect user funds.(2017-12:exmo-exchange-uk-russia-sanctions-shutdown)event
↯ff290e0e
EXMO cryptocurrency exchange founded; grows a large user base among Russian-, Ukrainian-, and Kazakh-speaking traders.(2014:exmo-exchange-uk-russia-sanctions-shutdown)event
↯a3e627b4
Coinkite ships additional enhanced firmware update, stating that post-incident AI-assisted code review found additional unrelated vulnerabilities in transaction approval logic, USB handling, and firmware update validation.(2026-08-21:coldcard-wallet-coinkite-firmware-exploit)event
↯c18792d6
Galaxy Research publishes update noting attack activity has halted. Potential total losses estimated at up to 2,417 BTC (~$151.3 million) including an unconfirmed fourth wave.(2026-08-14:coldcard-wallet-coinkite-firmware-exploit)event
↯33714870
Coinkite suspends its standard 120-day customer data deletion policy, citing legal preservation obligations arising from anticipated litigation. Opt-out mechanism offered to customers.(2026-08-07:coldcard-wallet-coinkite-firmware-exploit)event
↯2da308bc
Galaxy Research reports no confirmed attacker activity after this date. Approximately 1,531 BTC remains unmoved in attacker-controlled addresses.(2026-08-06:coldcard-wallet-coinkite-firmware-exploit)event
↯705bbaca
Galaxy Research identifies at least 15 independent attackers. TechCrunch reports losses exceeding $130 million across more than 7,700 addresses. TRM Labs publishes full analysis characterizing the event as the largest hardware wallet exploit on record and the third-largest crypto hack of 2026.(2026-08-04:coldcard-wallet-coinkite-firmware-exploit)event
↯1d4a7b38
Galaxy Research identifies approximately 1,367 BTC drained across 4,585 addresses. Class-action threats against Coinkite reported by Bitcoin.com News. Attack spreads reported by CoinDesk.(2026-08-02:coldcard-wallet-coinkite-firmware-exploit)event
↯b5829071
CoinDesk reports total losses at approximately $38 million with the exploit still ongoing. Coinkite confirms patched firmware versions available (Mk4/Mk5: 5.6.0+; Q: 1.5.0Q+; Mk3: 4.2.0+). Self-custody debate begins publicly.(2026-07-31:coldcard-wallet-coinkite-firmware-exploit)event
↯7082273e
First wave of exploitation begins. Approximately 1,082.65 BTC (~$70.2 million) drained from 1,196 addresses in roughly 41 minutes. Coinkite publishes security advisory the same day acknowledging the vulnerability and releasing initial patched firmware.(2026-07-30:coldcard-wallet-coinkite-firmware-exploit)event
↯7bee23d6
Coldcard firmware version 4.0.0 (followed shortly by 4.0.1) released, introducing the libngu library integration error that caused seed generation to fall back to the Yasmarang software PRNG instead of the STM32 hardware RNG. Bug lay dormant in open-source code.(2021-03-17:coldcard-wallet-coinkite-firmware-exploit)event
↯e540f20e
Haruko publicly confirms a targeted cyberattack affecting 15 institutional clients. Attackers exploited a server-side process vulnerability to extract access tokens, gaining read-only API access to client exchange credentials and trading data. A small but confirmed amount of client funds was stolen. Co-founder and CTO Adam Carlile states the vulnerability has been patched and server-side secrets rotated. A technical post-mortem is announced as forthcoming.(2026-09-18:haruko)event
↯0b78f3e3
Haruko announces $6 million Series A funding round co-led by White Star Capital and MMC Ventures, bringing total funding to approximately $16 million, and announces expansion into Southeast Asia with a Singapore office.(2024-07-15:haruko)event
↯b2beae61
Haruko founded in London as a digital asset portfolio management and infrastructure platform.(2021-03-01:haruko)event
↯d13387bf
TRM Labs published its investigation into fake AI trading bot drainers, documenting the nine-video "Claude-built arbitrage bot" YouTube cluster, victim count, total ETH drained, and fund movement patterns. Nine videos had accumulated 310,474 combined views as of publication.(2026-09-01:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯31dc6ced
Earliest YouTube video in the nine-video "Claude AI arbitrage bot" cluster identified by TRM Labs was posted, approximately.(2026-04-01:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯74afda31
YouTube channel @Jazz_Braze published "How to Create Passive Income MEV Bot on Ethereum," an early iteration of the drainer-as-trading-bot pattern documented by SentinelOne. The video accumulated over 387,000 views before SentinelOne's report. A "free offer" urgency window (June 6-30, 2024) was used as a persuasion tactic.(2024-06-06:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯d6bcd58c
The nine tracked videos remain live on YouTube and have accumulated a combined 310,474 views since the campaign began.(2026-09:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯9b1da354
TRM Labs publishes its blog post "Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers," detailing the campaign, its scale, and its mechanics.(2026-09-14:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯b3964559
Latest victim transaction in TRM Labs' tracked window. By this date, 224 victims had lost 274.60 ETH (~$517,205 USD) across 234 deployed contracts, all funds flowing to six shared operator collection addresses.(2026-08-11:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯636e34bc
Earliest victim transaction in the TRM Labs-tracked cluster of "Claude-built arbitrage bot" YouTube tutorial drainers, based on on-chain data analysis.(2026-02-12:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯a32e3c76
The earliest of the nine tracked "Claude-built" arbitrage bot tutorial videos in this campaign is posted to YouTube.(2026-04:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯7899bec2
SentinelOne published research documenting Ethereum drainers posing as MEV and trading bot tutorials on YouTube, identifying specific channels, wallet addresses, and obfuscation techniques. The most active identified address had received over $900,000 USD.(2025-08-07:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯dfdce3de
Hemi published an official postmortem confirming the exploit's scope, technical root cause, and ongoing recovery efforts.(2026-09-09:hemi-genesis-drop-merklebox-exploit)event
↯17440a43
Upbit cancelled its planned HEMI listing approximately 18 minutes before the scheduled 9:30 p.m. KST opening, citing the exploit and apparent token theft.(2026-09-08:hemi-genesis-drop-merklebox-exploit)event
↯d71ba9be
06:11 UTC — Hemi team identified the root cause of the exploit. Partner outreach began at 06:20 UTC; SEAL 911 contacted at 07:57 UTC.(2026-09-07:hemi-genesis-drop-merklebox-exploit)event
↯93cdd382
Hemi mainnet launched, positioning the protocol as a Bitcoin-Ethereum supernetwork L2 built on the OP Stack.(2025-03-12:hemi-genesis-drop-merklebox-exploit)event
↯3ba9c530
All malicious subdomains from the September 14 Cloudflare Worker attack stopped resolving. Brevo's JavaScript files were confirmed clean.(2026-09-15:trezor-email-provider-breach-brevo-september-2026)event
↯81a90053
In a separate secondary attack, attackers used a hardcoded Cloudflare API key to deploy a malicious Cloudflare Worker on Brevo's domains and customer-embedded JavaScript files between approximately 16:05 and 20:13 UTC, injecting ClickFix malware and WordPress backdoor payloads across an estimated 100,000+ customer websites.(2026-09-14:trezor-email-provider-breach-brevo-september-2026)event
↯aa8427e6
Solana Mobile confirmed it had suspended its Brevo marketing email account following unauthorized access.(2026-09-13:trezor-email-provider-breach-brevo-september-2026)event
↯493daf57
Solana Mobile disclosed that its Brevo marketing email account had been accessed without authorization as part of the same Brevo incident and warned users of elevated phishing risk.(2026-09-12:trezor-email-provider-breach-brevo-september-2026)event
↯05b13917
Mailchimp, a prior Trezor email marketing provider, suffered a social engineering attack that exposed approximately 100 Trezor user accounts and enabled a targeted phishing campaign.(2022-04-01:trezor-email-provider-breach-brevo-september-2026)event
↯249b4343
Trezor updated its disclosure to confirm 347,149 total marketing contacts were affected by the Brevo breach. No confirmed cryptocurrency losses from the phishing campaign were reported as of this date.(2026-09-17:trezor-email-provider-breach-brevo-september-2026)event
↯067c2f26
TechCrunch reported that Trezor confirmed the Brevo data breach and described it as the second data breach of a Trezor third-party vendor within weeks.(2026-09-11:trezor-email-provider-breach-brevo-september-2026)event
↯e60aec0f
Brevo detected the SSO access at 6:30 AM UTC and closed the attack vector by 8:30 AM UTC. Trezor disabled the phishing domain within approximately 20 minutes of detection, by which time approximately 2,500 users had clicked the malicious link. Brevo force-signed out all platform users and deployed a permanent SSO scope-restriction fix.(2026-09-10:trezor-email-provider-breach-brevo-september-2026)event
↯fdb96113
Attackers exploited Brevo's SAML SSO misconfiguration, accessed 138 Brevo customer accounts, and sent phishing emails to approximately 347,149 Trezor newsletter subscribers. The emails used the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' and directed recipients to a malicious application requesting seed phrase entry.(2026-09-09:trezor-email-provider-breach-brevo-september-2026)event
↯80a5b8b0
Trezor updated its ShipMonk breach disclosure, with the affected customer count eventually reaching approximately 81,000.(2026-09-04:trezor-email-provider-breach-brevo-september-2026)event
↯ef1e72c7
Trezor was informed that the ShipMonk breach's scope was substantially larger than first disclosed.(2026-09-02:trezor-email-provider-breach-brevo-september-2026)event
↯06bd63b7
Trezor publicly disclosed the ShipMonk breach, initially reporting approximately 13,689 affected customers with names, emails, phone numbers, and shipping addresses exposed.(2026-08-13:trezor-email-provider-breach-brevo-september-2026)event
↯846b98a1
ShipMonk, Trezor's shipping and logistics vendor, notified Trezor that customer data was exposed via a Metabase SQL injection zero-day (CVE-2026-72898, CVSS 10.0).(2026-08-10:trezor-email-provider-breach-brevo-september-2026)event
↯9c939cf5
Cybersecurity firm Hudson Rock reported approximately 300 compromised pec.interno.it webmail credentials in its database, suggesting the attackers obtained access via infostealer-harvested credentials rather than directly targeting government employees.(2026-09-17:revolut-data-breach-fake-government-request-september-2026)event
↯3c1e685e
Additional reporting identified the compromised email account as associated with the pec.interno.it domain (Italy's Ministry of the Interior PEC system), specifically the Prefecture of Reggio Calabria. Hackers also claimed to have extracted 147GB of data from Italian law enforcement systems.(2026-09-16:revolut-data-breach-fake-government-request-september-2026)event
↯7c79d20d
Revolut publicly confirmed the breach to TechCrunch and other outlets, describing 'a sophisticated external impersonation scam' using a legitimate government agency email domain. ZachXBT flagged the customer notification on the same day and assessed it as a targeted high-net-worth operation.(2026-09-12:revolut-data-breach-fake-government-request-september-2026)event
↯ad46fdd8
Affected Revolut customers began receiving breach notification emails disclosing that their personal and financial data may have been shared with an unauthorized third party.(2026-09-11:revolut-data-breach-fake-government-request-september-2026)event
↯7362de82
Approximate start of the fraudulent data request campaign, based on reporting that the operation ran for approximately five months before discovery. The attackers allegedly used a compromised pec.interno.it email account to submit fraudulent law enforcement requests to Revolut Bank UAB.(2026-04-01:revolut-data-breach-fake-government-request-september-2026)event
↯73e83ac0
OFAC designates BitBank (also known as BitBank3), Pishtaz Simorgh Electronic Trade Company, Mohammad Mahdi Zaker Hossein, Seyed Adel Heidari, and Hossein Ali Zaker Hossein under Executive Order 13902 as part of Operation Economic Outcast.(2026-09-17:bitbank-iranian-crypto-exchange)event
↯cccaafaa
Treasury Secretary Bessent announces Operation Economic Outcast ('Economic D-Day'), a whole-of-government campaign targeting Iran's financial channels across five sectors including digital assets. OFAC issues a digital-asset sectoral determination enabling designation of any operator in Iran's crypto sector.(2026-08-24:bitbank-iranian-crypto-exchange)event
↯a87023e2
OFAC designates Hormuz Safe Marine Services Authority for operating an IRGC-backed Bitcoin-payment extortion scheme on Strait of Hormuz shipping lanes.(2026-07-29:bitbank-iranian-crypto-exchange)event
↯604bae8d
OFAC designates Dot One Value Creation Group and nine associated entities, including Zedpay, Zedx DMCC, BZ Diamond, and multiple DotOne subsidiaries, as part of Operation Economic Outcast.(2026-07-24:bitbank-iranian-crypto-exchange)event
Data refreshes within about 10 minutes · All metrics derived from Supabase