← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,477
Relationships
32,559
Potential duplicates
0
Filter by kind
Entities
⌂1972268c
ClickFix BNB Chain EtherHiding Malware Campaignprotocol
↯18c29894
Zenith Security publicly confirmed it would cooperate with investigators and stated it had identified IP-level information about the operators to share with authorities. On-chain analysts BrutalTrade and SpecterAnalyst published wallet address linkages. Alleged prior projects ZinoFinance, Zero-G Finance, and PerfectSwap were identified as linked to the same operator network.(2025-09-27:hypervault-finance)event
↯9bfefc4a
PeckShield publicly flagged 'abnormal withdrawal of ~$3.6M worth of crypto from @hypervaultfi.' Approximately 752 ETH (estimated $3 million) was confirmed deposited into Tornado Cash. Hypervault's website, X account, Discord server, and GitHub repositories were all deleted. The Block, Decrypt, CryptoNews, and other outlets began covering the incident.(2025-09-26:hypervault-finance)event
↯4e238de6
Rug pull executed. All nine Hypervault vaults on HyperEVM were drained by the project operators using privileged contract access. Funds were bridged from Hyperliquid to Ethereum via deBridge.(2025-09-25:hypervault-finance)event
↯8cb4d26f
TVL on Hypervault reached approximately $4.97–6.01 million according to DefiLlama, representing peak depositor exposure ahead of the drain.(2025-09-24:hypervault-finance)event
↯ed0c7702
Zenith Security delivered a private draft audit report to the Hypervault team identifying 42 vulnerabilities — 6 high severity and 10 medium severity — with a recommendation for full re-audit after remediation. The report was never publicly disclosed by the project.(2025-09-21:hypervault-finance)event
↯d83950e5
Hypervault publicly announced that an audit had commenced with Zenith Security, a legitimate audit firm.(2025-09-14:hypervault-finance)event
↯930c7c2a
Community researcher HypingBull publicly warned on X that Hypervault's claimed audits from Spearbit, Pashov, and Code4rena appeared fabricated. Direct contact with Pashov Group returned the response: 'First time I hear the project with this name.' Code4rena's public listing showed no pending Hypervault audit. TVL was approximately $700,000 at time of warning.(2025-09-04:hypervault-finance)event
↯9307dc54
Latest Hacking News and Help Net Security publish detailed analyses of ENCFORGE, including SHA-256 hashes, C2 infrastructure, and mitigation guidance.(2026-07-26:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯bd5d1164
Sysdig publishes its ENCFORGE follow-on report detailing the compiled Go ransomware binary targeting AI model infrastructure, confirming operator continuity via the shared Proton Mail address.(2026-07-21:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯a155b8ff
TechTimes publishes analysis of what comes after JADEPUFFER, describing the lowered ransomware skill floor and anticipated increase in agentic campaigns.(2026-07-13:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯bd3a4f8e
The same JADEPUFFER operator returns with a new compiled Go ransomware binary (ENCFORGE), exploiting the same Langflow CVE and escaping via Docker socket to target AI model files (PyTorch, SafeTensors, GGUF, FAISS, Parquet, etc.) on the host filesystem.(2026-07-03:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯7f8097b3
Sysdig publishes its initial JADEPUFFER analysis, describing the operation as the first documented fully agentic ransomware campaign. Approximately 1,050 to 7,000 Langflow instances remain publicly reachable at this date.(2026-07-01:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯6fdf7c14
JADEPUFFER attack against a live production system takes place in late June 2026, exploiting CVE-2025-3248 in an internet-facing Langflow instance. The LLM agent conducts full reconnaissance, credential harvesting (including crypto wallet keys and seed phrases), lateral movement to a Nacos/MySQL server, and encrypts 1,342 production configuration records.(2026-06-01:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯2f97ff90
Anthropic reports a Chinese state-linked operation conducting largely autonomous cyberattacks using LLM agents.(2025-11-01:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯8dda2468
Anthropic discloses a real extortion campaign using Claude Code against 17 or more organizations — early evidence of LLM-assisted malicious operations at scale.(2025-08-01:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯87445c41
CISA adds CVE-2025-3248 to the Known Exploited Vulnerabilities (KEV) catalog and directs federal agencies to patch.(2025-05-05:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
↯919249ce
Langflow releases version 1.3.0, patching CVE-2025-3248 (unauthenticated RCE via /api/v1/validate/code endpoint, CVSS 9.8).(2025-04-01:jadepuffer-first-fully-autonomous-ai-ransomware-targeting-crypto-wallet-keys)event
⌂37cee203
JADEPUFFER – First Fully Autonomous AI Ransomware Targeting Crypto Wallet Keysprotocol
◎688ea40c
leagle.comdomain
↯603c70e6
Dakota Scout publishes investigation report on FBI and IRS probe into Benaiah Holdings; receiver's investigative authority subsequently expanded after court finds Wiener allegedly attempting to conceal cash.(2025-08-28:benjamin-paul-wiener-benaiah-capital)event
↯90f51f5e
Benaiah Capital established. Two digital asset hedge funds launched by mid-2021, accepting investor funds in cash and digital currency.(2021-01-01:benjamin-paul-wiener-benaiah-capital)event
↯8ce5e3df
SDGP-75 voting concludes, extending ex gratia compensation to Arbitrum asdCRV LlamaLend market borrowers unfairly liquidated during the vsdCRV price collapse on May 27.(2026-08-03:stakedao-vsdcrv-deployer-key-exploit-may-2026)event
↯873dbc20
SDGP-70 compensation claims become available via Merkle tree contract on Ethereum mainnet through the Stake DAO portfolio interface, with a six-month claim window.(2026-07-01:stakedao-vsdcrv-deployer-key-exploit-may-2026)event
↯aa31181d
Stake DAO publishes detailed post-mortem and SDGP-70 governance proposal for voluntary ex gratia compensation of 1,535,421.76 sdCRV (~$173,000) to 242 affected addresses. Stake DAO also confirms it has filed a criminal complaint with Swiss authorities.(2026-06-09:stakedao-vsdcrv-deployer-key-exploit-may-2026)event
↯661386ca
Attacker deposits extracted ETH proceeds into Tornado Cash in multiple transactions on Ethereum mainnet.(2026-05-31:stakedao-vsdcrv-deployer-key-exploit-may-2026)event
↯77d3c08f
StakeDAO contributors secure mainnet vsdCRV backing within 47 minutes of the forged mint, preventing additional collateral loss. Arbitrum bridge permanently closed. Deployer owner privileges revoked and transferred to governance multisig same day.(2026-05-27:stakedao-vsdcrv-deployer-key-exploit-may-2026)event
↯63ff0b2e
Separate StakeDAO oracle message spoofing incident on Arbitrum and Base chains results in an alleged $176,000 loss — a distinct vulnerability class from the May deployer key exploit.(2026-03-12:stakedao-vsdcrv-deployer-key-exploit-may-2026)event
↯8037351c
StakeDAO deployer wallet (0x000755Fbe4A24d7478bfcFC1E561AfCE82d1ff62) deploys vsdCRV LayerZero OFT contract on Arbitrum and retains owner privileges rather than transferring to governance multisig — the operational failure that later enabled the exploit.(2024-03-01:stakedao-vsdcrv-deployer-key-exploit-may-2026)event
□468c6829
StakeDAO — vsdCRV Deployer Key Exploit (May 2026)organization
↯d5f45bf9
NoOnes reports surpassing 2.5 million users globally with 127 employees.(2026-05-31:noones-exchange)event
↯db6ce47f
NoOnes confirms Ray Youssef has stepped down as CEO under undisclosed legal circumstances. The company states he no longer participates in management, operations, or decision-making. No successor is publicly named.(2026-02-20:noones-exchange)event
↯a218174e
Paxful Holdings, Inc. formally sentenced to $4 million criminal penalty.(2026-02-10:noones-exchange)event
↯149aa2ab
FinCEN issues $3.5 million civil penalty against Paxful Inc. and Paxful USA Inc. for willful BSA violations covering February 2015 to April 2023, including enabling over $500 million in suspicious transfers.(2025-12-01:noones-exchange)event
↯414b8755
DOJ indicts Ray Youssef in the Eastern District of California on charges of conspiring to violate the Travel Act, operating an unlicensed money transmitting business, and conspiring to evade BSA AML requirements at Paxful.(2025-12-13:noones-exchange)event
↯ee32afec
Paxful Holdings, Inc. pleads guilty to three federal criminal counts including Travel Act violations, operating an unlicensed money transmitting business, and BSA AML failures. Faces $112.5 million in guidelines penalties, reduced to $4 million based on inability to pay.(2025-12-09:noones-exchange)event
↯317c57e9
CEO Ray Youssef publicly acknowledges the $7.9 million exploit in a video, attributing it to a Solana cross-chain bridge vulnerability — approximately six weeks after the exploit occurred.(2025-02-12:noones-exchange)event
↯88ba8540
On-chain investigator ZachXBT publicly discloses the NoOnes hot-wallet exploit via Telegram, revealing hundreds of structured transactions and Tornado Cash routing.(2025-01-24:noones-exchange)event
↯a2dbae8a
NoOnes hot wallets on Ethereum, TRON, Solana, and BNB Chain begin to be drained by attackers. Approximately $7.9 million is stolen over the first two days of January 2025.(2025-01-01:noones-exchange)event
↯d4e6c9f3
Paxful co-founder Artur Schaback pleads guilty to conspiracy to fail to maintain effective AML programs at Paxful.(2024-07-08:noones-exchange)event
↯999c74ab
Ray Youssef named CEO of NoOnes, a peer-to-peer financial communication app founded to serve global emerging markets.(2023-11-01:noones-exchange)event
↯c618e723
Paxful shuts down its peer-to-peer marketplace citing regulatory challenges and internal co-founder disputes.(2023-04-01:noones-exchange)event
Data refreshes within about 10 minutes · All metrics derived from Supabase