← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,379
Relationships
32,479
Potential duplicates
0
Filter by kind
Entities
↯2da308bc
Galaxy Research reports no confirmed attacker activity after this date. Approximately 1,531 BTC remains unmoved in attacker-controlled addresses.(2026-08-06:coldcard-wallet-coinkite-firmware-exploit)event
↯705bbaca
Galaxy Research identifies at least 15 independent attackers. TechCrunch reports losses exceeding $130 million across more than 7,700 addresses. TRM Labs publishes full analysis characterizing the event as the largest hardware wallet exploit on record and the third-largest crypto hack of 2026.(2026-08-04:coldcard-wallet-coinkite-firmware-exploit)event
↯1d4a7b38
Galaxy Research identifies approximately 1,367 BTC drained across 4,585 addresses. Class-action threats against Coinkite reported by Bitcoin.com News. Attack spreads reported by CoinDesk.(2026-08-02:coldcard-wallet-coinkite-firmware-exploit)event
↯b5829071
CoinDesk reports total losses at approximately $38 million with the exploit still ongoing. Coinkite confirms patched firmware versions available (Mk4/Mk5: 5.6.0+; Q: 1.5.0Q+; Mk3: 4.2.0+). Self-custody debate begins publicly.(2026-07-31:coldcard-wallet-coinkite-firmware-exploit)event
↯7082273e
First wave of exploitation begins. Approximately 1,082.65 BTC (~$70.2 million) drained from 1,196 addresses in roughly 41 minutes. Coinkite publishes security advisory the same day acknowledging the vulnerability and releasing initial patched firmware.(2026-07-30:coldcard-wallet-coinkite-firmware-exploit)event
↯7bee23d6
Coldcard firmware version 4.0.0 (followed shortly by 4.0.1) released, introducing the libngu library integration error that caused seed generation to fall back to the Yasmarang software PRNG instead of the STM32 hardware RNG. Bug lay dormant in open-source code.(2021-03-17:coldcard-wallet-coinkite-firmware-exploit)event
♦ef9f6696
Coldcard Wallet (Coinkite Firmware Exploit)token
↯e540f20e
Haruko publicly confirms a targeted cyberattack affecting 15 institutional clients. Attackers exploited a server-side process vulnerability to extract access tokens, gaining read-only API access to client exchange credentials and trading data. A small but confirmed amount of client funds was stolen. Co-founder and CTO Adam Carlile states the vulnerability has been patched and server-side secrets rotated. A technical post-mortem is announced as forthcoming.(2026-09-18:haruko)event
↯0b78f3e3
Haruko announces $6 million Series A funding round co-led by White Star Capital and MMC Ventures, bringing total funding to approximately $16 million, and announces expansion into Southeast Asia with a Singapore office.(2024-07-15:haruko)event
↯b2beae61
Haruko founded in London as a digital asset portfolio management and infrastructure platform.(2021-03-01:haruko)event
↯d13387bf
TRM Labs published its investigation into fake AI trading bot drainers, documenting the nine-video "Claude-built arbitrage bot" YouTube cluster, victim count, total ETH drained, and fund movement patterns. Nine videos had accumulated 310,474 combined views as of publication.(2026-09-01:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯31dc6ced
Earliest YouTube video in the nine-video "Claude AI arbitrage bot" cluster identified by TRM Labs was posted, approximately.(2026-04-01:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯74afda31
YouTube channel @Jazz_Braze published "How to Create Passive Income MEV Bot on Ethereum," an early iteration of the drainer-as-trading-bot pattern documented by SentinelOne. The video accumulated over 387,000 views before SentinelOne's report. A "free offer" urgency window (June 6-30, 2024) was used as a persuasion tactic.(2024-06-06:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯d6bcd58c
The nine tracked videos remain live on YouTube and have accumulated a combined 310,474 views since the campaign began.(2026-09:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯9b1da354
TRM Labs publishes its blog post "Fake AI Trading Bots Are Getting Victims to Build Their Own Drainers," detailing the campaign, its scale, and its mechanics.(2026-09-14:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯b3964559
Latest victim transaction in TRM Labs' tracked window. By this date, 224 victims had lost 274.60 ETH (~$517,205 USD) across 234 deployed contracts, all funds flowing to six shared operator collection addresses.(2026-08-11:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯636e34bc
Earliest victim transaction in the TRM Labs-tracked cluster of "Claude-built arbitrage bot" YouTube tutorial drainers, based on on-chain data analysis.(2026-02-12:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯a32e3c76
The earliest of the nine tracked "Claude-built" arbitrage bot tutorial videos in this campaign is posted to YouTube.(2026-04:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
↯7899bec2
SentinelOne published research documenting Ethereum drainers posing as MEV and trading bot tutorials on YouTube, identifying specific channels, wallet addresses, and obfuscation techniques. The most active identified address had received over $900,000 USD.(2025-08-07:claude-ai-crypto-arbitrage-bot-youtube-tutorial-scam)event
□afdcb9fb
"Claude AI" Crypto Arbitrage Bot YouTube Tutorial Scamorganization
□c3d4709a
Hemi (Genesis Drop / MerkleBox Exploit)organization
↯dfdce3de
Hemi published an official postmortem confirming the exploit's scope, technical root cause, and ongoing recovery efforts.(2026-09-09:hemi-genesis-drop-merklebox-exploit)event
↯17440a43
Upbit cancelled its planned HEMI listing approximately 18 minutes before the scheduled 9:30 p.m. KST opening, citing the exploit and apparent token theft.(2026-09-08:hemi-genesis-drop-merklebox-exploit)event
↯d71ba9be
06:11 UTC — Hemi team identified the root cause of the exploit. Partner outreach began at 06:20 UTC; SEAL 911 contacted at 07:57 UTC.(2026-09-07:hemi-genesis-drop-merklebox-exploit)event
↯93cdd382
Hemi mainnet launched, positioning the protocol as a Bitcoin-Ethereum supernetwork L2 built on the OP Stack.(2025-03-12:hemi-genesis-drop-merklebox-exploit)event
□4ab6ae33
Hemi (Genesis Drop / MerkleBox exploit)organization
↯3ba9c530
All malicious subdomains from the September 14 Cloudflare Worker attack stopped resolving. Brevo's JavaScript files were confirmed clean.(2026-09-15:trezor-email-provider-breach-brevo-september-2026)event
↯81a90053
In a separate secondary attack, attackers used a hardcoded Cloudflare API key to deploy a malicious Cloudflare Worker on Brevo's domains and customer-embedded JavaScript files between approximately 16:05 and 20:13 UTC, injecting ClickFix malware and WordPress backdoor payloads across an estimated 100,000+ customer websites.(2026-09-14:trezor-email-provider-breach-brevo-september-2026)event
↯aa8427e6
Solana Mobile confirmed it had suspended its Brevo marketing email account following unauthorized access.(2026-09-13:trezor-email-provider-breach-brevo-september-2026)event
↯493daf57
Solana Mobile disclosed that its Brevo marketing email account had been accessed without authorization as part of the same Brevo incident and warned users of elevated phishing risk.(2026-09-12:trezor-email-provider-breach-brevo-september-2026)event
↯05b13917
Mailchimp, a prior Trezor email marketing provider, suffered a social engineering attack that exposed approximately 100 Trezor user accounts and enabled a targeted phishing campaign.(2022-04-01:trezor-email-provider-breach-brevo-september-2026)event
↯249b4343
Trezor updated its disclosure to confirm 347,149 total marketing contacts were affected by the Brevo breach. No confirmed cryptocurrency losses from the phishing campaign were reported as of this date.(2026-09-17:trezor-email-provider-breach-brevo-september-2026)event
↯067c2f26
TechCrunch reported that Trezor confirmed the Brevo data breach and described it as the second data breach of a Trezor third-party vendor within weeks.(2026-09-11:trezor-email-provider-breach-brevo-september-2026)event
↯e60aec0f
Brevo detected the SSO access at 6:30 AM UTC and closed the attack vector by 8:30 AM UTC. Trezor disabled the phishing domain within approximately 20 minutes of detection, by which time approximately 2,500 users had clicked the malicious link. Brevo force-signed out all platform users and deployed a permanent SSO scope-restriction fix.(2026-09-10:trezor-email-provider-breach-brevo-september-2026)event
↯fdb96113
Attackers exploited Brevo's SAML SSO misconfiguration, accessed 138 Brevo customer accounts, and sent phishing emails to approximately 347,149 Trezor newsletter subscribers. The emails used the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' and directed recipients to a malicious application requesting seed phrase entry.(2026-09-09:trezor-email-provider-breach-brevo-september-2026)event
↯80a5b8b0
Trezor updated its ShipMonk breach disclosure, with the affected customer count eventually reaching approximately 81,000.(2026-09-04:trezor-email-provider-breach-brevo-september-2026)event
↯ef1e72c7
Trezor was informed that the ShipMonk breach's scope was substantially larger than first disclosed.(2026-09-02:trezor-email-provider-breach-brevo-september-2026)event
↯06bd63b7
Trezor publicly disclosed the ShipMonk breach, initially reporting approximately 13,689 affected customers with names, emails, phone numbers, and shipping addresses exposed.(2026-08-13:trezor-email-provider-breach-brevo-september-2026)event
↯846b98a1
ShipMonk, Trezor's shipping and logistics vendor, notified Trezor that customer data was exposed via a Metabase SQL injection zero-day (CVE-2026-72898, CVSS 10.0).(2026-08-10:trezor-email-provider-breach-brevo-september-2026)event
□29fb5713
Trezor Email Provider Breach (Brevo, September 2026)organization
Data refreshes within about 10 minutes · All metrics derived from Supabase