WE ANALYZED 2,500+ REAL CASES FROM POST-INCIDENT CRYPTO INVESTIGATIONS. HERE’S WHAT WE LEARNED 👇🏻
This report is built ENTIRELY on our own investigation practice in 2025 — real cases we handled after the incident had already occurred. We translated this hands-on investigative work into numbers, not to retell how attacks happen, but to answer the harder questions:
• what actually happens after the attack is discovered?
• which attack types look “minor” by frequency but drive the largest financial damage in practice?
• when does freezing actually work, and when is it already too late to matter?
• why do many “technical” incidents turn out to be human or operational failures upstream?
• why do low-frequency events (CEX Breaches, Access Compromise) dominate total losses despite being rare?
👉 Get Early Access to the Full Report
This report is built ENTIRELY on our own investigation practice in 2025 — real cases we handled after the incident had already occurred. We translated this hands-on investigative work into numbers, not to retell how attacks happen, but to answer the harder questions:
• what actually happens after the attack is discovered?
• which attack types look “minor” by frequency but drive the largest financial damage in practice?
• when does freezing actually work, and when is it already too late to matter?
• why do many “technical” incidents turn out to be human or operational failures upstream?
• why do low-frequency events (CEX Breaches, Access Compromise) dominate total losses despite being rare?
👉 Get Early Access to the Full Report
🔥5
📌A Case Study On Trust
Trove Markets entered the market with an ambitious RWA narrative and raised ~$11.5M via ICO. Days before completion, the team abruptly abandoned its original HyperEVM roadmap and announced a migration to Solana.
❗The result was a ~98% price collapse.
On-chain data shows ICO funds consolidated under team-controlled wallets, with a portion already moved to centralized exchanges.
At the same time, undisclosed influencer promotions, shifting timelines, and anonymous governance amplified market concern.
Check the slides for case details 👆
Trove Markets entered the market with an ambitious RWA narrative and raised ~$11.5M via ICO. Days before completion, the team abruptly abandoned its original HyperEVM roadmap and announced a migration to Solana.
❗The result was a ~98% price collapse.
On-chain data shows ICO funds consolidated under team-controlled wallets, with a portion already moved to centralized exchanges.
At the same time, undisclosed influencer promotions, shifting timelines, and anonymous governance amplified market concern.
Check the slides for case details 👆
⚡Aperture Finance Exploit: Traced On-chain
Two protocols were compromised through unlimited token approvals. Only Aperture Finance publicly acknowledged the issue and initiated on-chain communication with the attacker.
❗On-chain tracing shows ~$13M in stolen assets. About $3M in USDC remains untouched, while other assets were swapped into ETH — with ~540 ETH still sitting at the original address.
Funds followed a standard cross-chain laundering path via Relay and Superbridge. We completed full cross-chain tracing, including post-bridge dispersion on Ethereum. These wallets are currently dormant.
👉A second exploiter was identified. One address — originally funded via Tornado Cash, using the same infinite-approval vulnerability hours after the initial exploit.
Most funds remain traceable and inactive.
Two protocols were compromised through unlimited token approvals. Only Aperture Finance publicly acknowledged the issue and initiated on-chain communication with the attacker.
❗On-chain tracing shows ~$13M in stolen assets. About $3M in USDC remains untouched, while other assets were swapped into ETH — with ~540 ETH still sitting at the original address.
Funds followed a standard cross-chain laundering path via Relay and Superbridge. We completed full cross-chain tracing, including post-bridge dispersion on Ethereum. These wallets are currently dormant.
👉A second exploiter was identified. One address — originally funded via Tornado Cash, using the same infinite-approval vulnerability hours after the initial exploit.
Most funds remain traceable and inactive.
❤2
🆕 AMLBot KYT Now Supports Hyperliquid Monitoring
Hyperliquid is one of the fastest-growing decentralized trading environments — processing billions in daily trading volume.
But there’s an important architectural nuance.
Most tools monitor HyperEVM (the application layer).
⚡We indexes HyperCore. the settlement layer where value transfer occurs, and monitors the Arbitrum bridge used to move USDC in and out of the ecosystem.
❗For compliance teams this means visibility into:
— Deposits Entering Hyperliquid
— Internal Value Transfers
— Dithdrawals Back to Arbitrum
Request Access to Hypertliquid KYT Monitoring: https://hubs.li/Q045LVXs0
Hyperliquid is one of the fastest-growing decentralized trading environments — processing billions in daily trading volume.
But there’s an important architectural nuance.
Most tools monitor HyperEVM (the application layer).
⚡We indexes HyperCore. the settlement layer where value transfer occurs, and monitors the Arbitrum bridge used to move USDC in and out of the ecosystem.
❗For compliance teams this means visibility into:
— Deposits Entering Hyperliquid
— Internal Value Transfers
— Dithdrawals Back to Arbitrum
Request Access to Hypertliquid KYT Monitoring: https://hubs.li/Q045LVXs0
🆕 The Next Step In Crypto Compliance Is Detecting Illicit Intent
Transaction monitoring already flags risky transfers in real time.
But INTENT rarely appears in a single transaction.
❗Illicit activity is structured:
- Split across deposits
- Timed to stay below thresholds
- Individually acceptable yet collectively suspicious
⚡We added Behavioral Alerts to AMLBot’s KYT Dashboard. This allows for evaluating activity cumulatively across time and risk categories.
Instead of manually piecing together transfers, the system automatically detects patterns.
Not just detecting risk — detecting intent.
START DETECTING INTENT: https://hubs.li/Q045y3WK0
Transaction monitoring already flags risky transfers in real time.
But INTENT rarely appears in a single transaction.
❗Illicit activity is structured:
- Split across deposits
- Timed to stay below thresholds
- Individually acceptable yet collectively suspicious
⚡We added Behavioral Alerts to AMLBot’s KYT Dashboard. This allows for evaluating activity cumulatively across time and risk categories.
Instead of manually piecing together transfers, the system automatically detects patterns.
Not just detecting risk — detecting intent.
START DETECTING INTENT: https://hubs.li/Q045y3WK0