← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,428
Relationships
32,520
Potential duplicates
2
Filter by kind
Potential Duplicates
Entities with similar names that may refer to the same thing. Use the merge API to combine them.
substring match↯ Trezor, BitBox, and CoinTracking publicly warn customers of the phishing emails; mainstream outlets including TechCrunch, SecurityWeek, BleepingComputer, and Cointelegraph report on the breach and its impact on crypto users. Solana Mobile also issues a precautionary phishing warning to its users.↔↯ Trezor, BitBox, CoinTracking, and Solana Mobile publicly warn their users of the phishing incident. SecurityWeek, CoinTelegraph, Crypto Briefing, BleepingComputer, and Malwarebytes report on the breach.70f72b40 / ba8d339e
substring match↯ Brevo posts a public statement on X confirming an attacker accessed 120 (later revised to 138) customer accounts and used the access to send phishing emails; Brevo states the unauthorized access was closed as of 11:30 AM CEST.↔↯ Brevo publishes a full post-mortem confirming 138 accounts were compromised (6 used for phishing campaigns, 43 had contacts exported, 93 with no meaningful activity), acknowledges the flaw, and states a legal complaint was filed.2256e354 / 32646045
Merge instructions
curl -X POST /api/graph/merge \
-H "Authorization: Bearer $ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d '{"keepId": "<entity-to-keep>", "mergeId": "<entity-to-remove>"}'Entities
↯47d4061a
Reports emerge, citing Bitcoin Magazine and WuBlockchain, that the FBI may have identified alleged first-wave attackers using logs from a paid blockchain analytics provider. No arrest, charge, or named suspect has been publicly confirmed as of this writing.(2026-08-19:coldcard-coinkite-firmware-exploit)event
↯b08dde43
CoinDesk publishes a detailed investigation into how the bug went unnoticed for years, including reporting on the May 2025 O'Beirne warning and Coinkite's response at that time.(2026-08-17:coldcard-coinkite-firmware-exploit)event
↯b6e7b1a7
Reports indicate approximately 1,596 BTC confirmed stolen from approximately 7,300 addresses, with a potential fourth wave that could bring total to roughly 2,055 BTC (~$130 million).(2026-08-07:coldcard-coinkite-firmware-exploit)event
↯ae47da5e
TechCrunch publishes a report citing blockchain-monitoring firms confirming over $130 million in losses. Galaxy Research documents losses reaching approximately $100 million at this date.(2026-08-04:coldcard-coinkite-firmware-exploit)event
↯96aff6fc
Coinkite updates its security advisory with additional model-specific firmware version information and user guidance.(2026-08-01:coldcard-coinkite-firmware-exploit)event
↯5642984c
Coinkite issues emergency firmware patches for all affected models and publishes a security advisory advising all users who generated seeds between March 2021 and July 2026 to migrate to a new seed immediately.(2026-07-31:coldcard-coinkite-firmware-exploit)event
↯16406775
Exploitation begins. Wave 1: approximately 594–1,082 BTC drained from roughly 500–1,196 addresses in 25–41 minutes (figures vary by source). Attackers used reconstructed private keys derived from the weak PRNG output without physical device access.(2026-07-30:coldcard-coinkite-firmware-exploit)event
↯011cf961
Bitcoin developer James O'Beirne reportedly flagged the randomness code issue to Coinkite. Coinkite's response was characterized as an argument from absence — that the flaw would likely have shown up in real-world losses already if it were genuine — rather than a technical rebuttal.(2025-05-01:coldcard-coinkite-firmware-exploit)event
↯61c32809
Coldcard firmware v4.0.1 released. A build configuration error — MICROPY_HW_ENABLE_RNG set to zero with a #ifndef guard that does not check the macro's value — caused seed generation to route through the Yasmarang software PRNG instead of the STM32 hardware RNG. Effective entropy reduced to approximately 40 bits on Mk2/Mk3 devices.(2021-03-01:coldcard-coinkite-firmware-exploit)event
↯6df5c7aa
MicroPython's Yasmarang PRNG entered the MicroPython codebase. It would later become the inadvertent fallback for Coldcard seed generation.(2018-05-01:coldcard-coinkite-firmware-exploit)event
↯97fa8a4f
AVOID.NET investigation conducted. No indexed public web presence found. No regulatory actions identified. Domain remains active and resolves via Cloudflare infrastructure.(2026-09-12:trusteplusglobal-com)event
↯be9e5b67
WHOIS record for trusteplusglobal.com last updated, with no change to registrant privacy status.(2025-11-26:trusteplusglobal-com)event
↯75460957
trusteplusglobal.com domain registered via Tucows Domains Inc. with WHOIS privacy protection active.(2025-10-14:trusteplusglobal-com)event
↯70f72b40
Trezor, BitBox, and CoinTracking publicly warn customers of the phishing emails; mainstream outlets including TechCrunch, SecurityWeek, BleepingComputer, and Cointelegraph report on the breach and its impact on crypto users. Solana Mobile also issues a precautionary phishing warning to its users.(2026-09-11:brevo-email-marketing-platform-used-by-trezor-bitbox-cointracking-solana-mobile)event
↯2256e354
Brevo posts a public statement on X confirming an attacker accessed 120 (later revised to 138) customer accounts and used the access to send phishing emails; Brevo states the unauthorized access was closed as of 11:30 AM CEST.(2026-09-10:brevo-email-marketing-platform-used-by-trezor-bitbox-cointracking-solana-mobile)event
↯bf4d7e3e
Phishing emails are sent from 6 compromised Brevo accounts, including Trezor's, BitBox's, and CoinTracking's, to their real subscriber lists; Trezor's email (subject referencing an 'STM32 Entropy' vulnerability) reaches roughly 347,000 addresses. The malicious site is taken down at the DNS level roughly 20 minutes after detection, by which point about 2,500 recipients had clicked the link.(2026-09:brevo-email-marketing-platform-used-by-trezor-bitbox-cointracking-solana-mobile)event
↯5ac630ae
Trezor states, in its own official blog post, that Brevo suffered the security incident affecting 120 Brevo accounts (later revised by Brevo to 138).(2026-09-09:brevo-email-marketing-platform-used-by-trezor-bitbox-cointracking-solana-mobile)event
♦2568870f
Brevo (email marketing platform used by Trezor, BitBox, CoinTracking, Solana Mobile)token
◎7a98c5d5
status.brevo.comdomain
↯ba8d339e
Trezor, BitBox, CoinTracking, and Solana Mobile publicly warn their users of the phishing incident. SecurityWeek, CoinTelegraph, Crypto Briefing, BleepingComputer, and Malwarebytes report on the breach.(2026-09-11:brevo)event
↯32646045
Brevo publishes a full post-mortem confirming 138 accounts were compromised (6 used for phishing campaigns, 43 had contacts exported, 93 with no meaningful activity), acknowledges the flaw, and states a legal complaint was filed.(2026-09-10:brevo)event
↯05536080
Sendinblue rebrands to Brevo, reflecting expansion into CRM, SMS, and CDP services.(2023-01-01:brevo)event
↯bf239043
Brevo founded in Paris, France as Sendinblue by Armand Thiberge.(2012-01-01:brevo)event
↯b9946365
The CFTC files a civil enforcement complaint (Case No. 4:25-cv-00687) against Travis Ford and Wolf Capital Crypto Trading LLC in the U.S. District Court for the Northern District of Oklahoma, alleging the scheme ran from October 2022 through at least December 2024 and collected over $10 million from more than 3,000 investors.(2025-12-19:wolf-capital-crypto-trading-llc)event
↯62743d8d
Travis Ford pleads guilty to one count of conspiracy to commit wire fraud. In his plea, Ford admits he did not believe the promised investment returns were possible to achieve consistently.(2025-01-10:wolf-capital-crypto-trading-llc)event
↯7a812fcf
The primary scheme period identified in the DOJ criminal case begins. Ford and co-conspirators solicit approximately 2,800 investors and raise $9.4 million while promising 1-2% daily returns.(2023-01-01:wolf-capital-crypto-trading-llc)event
↯9919b3b8
As of this date, no technical post-mortem has been published and no fund recovery has been confirmed by any public source.(2026-09-04:aquifer-solana-amm)event
◎8ca988ff
financialservicesperspectives.comdomain
↯0c09f5be
FinCEN issued a notice of proposed rulemaking to expand the definition of Huione Group under the Section 311 rule to include H-Pay Service PLC, a newly operational component assessed to have assumed Huione Pay PLC's business role.(2026-06-25:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
↯bcca81d7
The United Kingdom became the first country to impose sanctions on Xinbi Guarantee, the Telegram-based illicit marketplace that emerged as a successor to Huione Guarantee.(2026-03-01:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
↯6028e80a
Federal Register published FinCEN's imposition of a Section 311 special measure designating Huione Group as a foreign financial institution of primary money laundering concern, effective November 17, 2025.(2025-10-16:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
↯1c006642
DOJ unsealed indictment of Prince Holding Group chairman Chen Zhi on wire fraud and money laundering conspiracy charges related to Cambodian forced-labor scam compounds. DOJ simultaneously announced approximately 127,271 Bitcoin (~$15 billion) seizure — the largest forfeiture in DOJ history. OFAC and UK FCDO imposed coordinated sanctions.(2025-10-14:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
↯49df8d49
Legal, compliance, and crypto trade press (National Law Review, Cryptopolitan, CryptoTimes, COINOTAG, and others) publish analyses of the alert, adding context on growth rates, dominant assets, and bank compliance obligations.(2026-09:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
↯f1117e9f
Contemporaneous with FIN-2026-Alert005, DOJ announced disruption of Xinbi Guarantee including seizure of Telegram channels and freezing of approximately $52.8 million in USDT across 52 wallets. OFAC sanctioned associated entities.(2026-09-03:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
↯5fda65e5
End of the review period covered by FinCEN's 2026 financial trend analysis of BSA reports linked to suspected digital asset investment scams.(2025-12:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
↯4ba38363
FinCEN issued FIN-2023-Alert005, the first pig-butchering-specific BSA alert, establishing the reporting baseline that FIN-2026-Alert005 would later analyze.(2023-09-08:fincen-fin-2026-alert005-overseas-scam-centers-12-7b)event
♦e420c63d
FinCEN FIN-2026-Alert005 (Overseas Scam Centers — $12.7B)token
↯7497a31c
Decrypt published detailed account of wallet-draining mechanism: test transaction approval triggered embedded drainer code; servers traced to the Netherlands; victim data including passports and passwords harvested during registration.(2026-09-06:ukrainian-fake-crypto-investment-ring-kyiv-2026)event
↯4caf34b6
crypto.news, Crypto Times, and CoinSpectator published reporting on the raid; figure of 34 total searches, 62 victims, and $1 million monthly turnover cited.(2026-09-03:ukrainian-fake-crypto-investment-ring-kyiv-2026)event
↯db95d959
Euromaidan Press published early English-language coverage of the operation, citing SBU statement that the network targeted EU citizens.(2026-09-02:ukrainian-fake-crypto-investment-ring-kyiv-2026)event
↯3b952333
Ukrainian SBU and National Police began raids; dev.ua reports 23 searches at that stage. Network's fake investment sites and offices in Kyiv and surrounding region targeted.(2026-09-01:ukrainian-fake-crypto-investment-ring-kyiv-2026)event
□fafca29f
Ukrainian Fake Crypto Investment Ring (Kyiv, 2026)organization
Data refreshes within about 10 minutes · All metrics derived from Supabase