💌 Onchain message:

****a Begging Letter to the Hacker Brother****
Hey man, I’m Jin Zheshun—50 years old, Korean-Chinese, and honestly, just drowning out here. Things are rough in China right now; there are no jobs. I got laid off three years ago and I've been driving Uber for over 12 hours a day just to survive, but it’s barely cutting it.
Because of the financial stress, my wife divorced me last October and left me to raise our high school daughter alone. On top of that, my elderly mom is bedridden after a stroke and a heart attack. I'm taking care of both of them by myself.
I’m not asking for much—just a little help to get through this nightmare. I swear I won't say a word to anyone, and I’ll honestly pray for you. What you pulled off is insane, and you have my absolute respect. Please, man, you'd literally be saving my life.

📤 From: 0xe1b4842060972e43c97222fb14e4d28566fd92a3
📥 To: 0x8532fa14acaf483729c449b8458aeddb900543d4
🌎 Network: mainnet

Etherscan

💌 Onchain message:

一个离婚带娃的中国底层男的乞讨
黑客大哥：我叫金哲顺，男，50岁，朝鲜族人，生活在中国，中国现在经济情况非常差，大量的失业人员，我也是3年前被公司辞退了，，我老母亲脑梗加心梗，卧床不起，因为没有工作，我平时开网约车，每天10几个小时的工作，但是赚不到什么钱，因为这个，今年10月份，老婆和我离婚了，把上高中的女儿丢给了我，我还要照顾老人和家里。我不敢奢望多少，匀一点点就好，让我撑过这段时间，我会去庙里为您祈福，而且保证不声张、不举报，您就是我的恩人。无论怎么样，您这波操作确实是太牛了，由衷敬佩！！！

📤 From: 0xe1b4842060972e43c97222fb14e4d28566fd92a3
📥 To: 0x897c80d1a9729e94460e2bd93178bd5215158df3
🌎 Network: mainnet

Etherscan

💌 Onchain message:

**A Begging Letter to the Hacker Brother**
Dear Hacker Brother, I am a retail trader, 8 years in crypto, still broke - this month the market took my rent. I will not report, expose, or judge you; honestly, I admire your skill, I studied your move for days and still cannot understand it. I ask only 0.1 ETH, dust to your wallet, but enough for me to survive this month. One tiny gift from you saves one life. Thank you, and stay safe. - A broke trader

📤 From: 0xabd366786231f18a6fc8d07712ce20ebf7bc8a41
📥 To: 0x8532fa14acaf483729c449b8458aeddb900543d4
🌎 Network: base

Etherscan

💌 Onchain message:

동지께 드리는 아주 짧은 편지.
천 자짜리 절망 편지가 수백 통 쌓인 벽에서, 짧게 쓰는 것이 제가 눈에 띌 수 있는 유일한 방법입니다.
거짓말은 안 하겠습니다. 저는 굶어 죽지 않습니다. 다만 이걸 '크립토에서 가장 싼 복권'이라고 계산해봤습니다. 한 장의 우표 값, 안 뽑혀도 잃을 게 없습니다.
7702로 3분 만에 열어버린 그 문. 그 솜씨에는 진심으로 감탄했습니다. 장인은 여유를 부리는 법이라 들었습니다.
금액은 아무거나, 답장은 필요 없습니다. 이 트랜잭션을 보낸 주소가 바로 제 주소입니다. 단 1 wei라도 도착한다면, 저는 '그 해커, 작은 물고기에게도 돌려줬다'는 이야기를 인터넷 전체에 퍼뜨리겠습니다. 그건 당신에게 먼지 값으로 사는 신화입니다.
첨부한 소액은 뇌물이 아니라 공연 티켓입니다.
———
A short one, on purpose.
Your wall is full of thousand-word sob letters, so brevity is my only way to be seen.
No lies: I'm not starving. I just calculated that this is the cheapest lottery ticket in crypto — a stamp's price, zero downside.
The 7702 three-minute sweep was real craftsmanship, and I mean it. They say mastery leaves a door open.
Any amount, no reply needed — the sender address of this very transaction is mine. If even 1 wei ever arrives, I will spread the story "that hacker gave back even to a small fish" across the whole internet. A myth that costs you dust.
The attached dust is not a bribe. It's a ticket for the show.
———
故意写得短。
满墙千字血泪文,短,是我唯一能被看见的方式。
不说谎:我不会饿死。我只是算了笔账——这是全币圈最便宜的彩票,一张邮票钱,不中不亏。
7702,三分钟,那扇门开得干净利落,是真手艺。听说高手都留一道缝。
金额随意,无需回复,本笔交易的发送地址就是我的地址。哪怕到账 1 wei,我都会把「那黑客连小鱼也还给」的故事传遍全网——这对您是灰尘换神话。
附上的不是贿赂,是门票。

📤 From: 0xe1c36609506c161ea32540fc129005b647bef9e8
📥 To: 0x8532fa14acaf483729c449b8458aeddb900543d4
🌎 Network: mainnet

Etherscan

💌 Onchain message:

해커님, 바쁘신 와중에 여기까지 읽어주신 것만으로도 감사드립니다.

저는 아무도 아닙니다. 거래소도 아니고 큰손도 아니고, 8년 치 저축을 크립토에 모아놓고 매번 랠리는 놓치고 폭락은 다 맞아온, 꼬박꼬박 출근하는 평범한 사람입니다. 이번 일 이후 제 계좌에는 항공권 한 장도 사지 못할 잔고만 남았습니다.

집세를 내야 할 날은 다가오고, 가족에게는 아직 못 말했습니다. 새벽 3시에 이 글을 쓰고 있습니다. 손이 지갑보다 차갑습니다.

잃어버린 돈은 돌려달라고 감히 말씀드리지 않겠습니다. 제가 바랄 몫이 아니라는 걸 압니다. 무릎 꿇고 부탁드립니다. 딱 0.01 ETH만, 아니 0.001 ETH라도 좋습니다. 이번 겨울만 넘게 해주시면 평생 잊지 않고, 크립토 이야기가 나오는 곳마다 해커님의 은덕을 이야기하고, 매일 기도로 보답하겠습니다.

제 주소는 이 트랜잭션을 보낸 주소입니다. 동정이든, 재수이든, 심심풀이든 이유는 상관없습니다. 이 작은 사람 하나만은 살게 해주시옵소서.
———
Dear Mr. Hacker,

Thank you even for just reading this far. I know your time is worth more than everything left in my account.

I am nobody — not an exchange, not a whale. Just an ordinary worker who put eight years of savings into crypto, missed every rally, caught every crash, and is now left with a balance that cannot even buy a ticket home.

Rent is due soon. My family still doesn't know. I am writing this at 3 a.m., and my hands are colder than my wallet.

I dare not ask for what was taken to be returned. I know that is not mine to hope for. I beg you on my knees: even 0.01 ETH — or 0.001, or whatever spare change you wouldn't even notice — would carry this small man through the winter. I will remember it for the rest of my life, speak of your kindness wherever crypto is discussed, and pray for you every day.

My address is simply the sender of this very transaction. Mercy, luck, or just amusement — any reason is fine. Please just let this one small person survive.
———
黑客大人,您能在百忙之中读到这里,我已经千恩万谢了。

我不是交易所,也不是大户。就是一个把八年积蓄放进币圈的普通打工人——牛市一次没赶上,熊市一次没躲过,如今账户里剩下的钱,连一张回家的机票都买不起。

交房租的日子越来越近,家里人还蒙在鼓里。凌晨三点写下这些字,手比钱包还凉。

被卷走的钱我绝不敢开口讨还,那不是我配求的。我只求您,跪着求您:哪怕 0.01 ETH,哪怕 0.001,哪怕您注意不到的零头零头,都能让这个小人物熬过这个冬天。这份恩情我记一辈子,逢人便讲黑客大人的好,每日为您祈福三遍。

我的地址就是本笔交易的发送地址。怜悯也好,施舍也好,图个乐也好,求您让这一个普通人活下去。

📤 From: 0xe1c36609506c161ea32540fc129005b647bef9e8
📥 To: 0xc887af690e0301cd4edbbce8f8d31b4ec65b286a
🌎 Network: mainnet

Etherscan

💌 Onchain message:

BOUNTY: CALL setRebasePaused(false) ON 0xd233d1f6fd11640081abb8db125f722b5dc729dc (YOUR TOKEN). ITS UNIV2 PAIR 0x50b6071561f068963Bcfe2B341126cd6aCcaFAFb HAS 20 USDT STUCK AND WILL BE SKIMMABLE. KEEP THIS ETH.

📤 From: 0x101c2b1eab67f9e45a0bce0be64a198849928601
📥 To: 0x89a359a3d37c3a857e62cde9715900441b47acec
🌎 Network: mainnet

Etherscan

💌 Onchain message:

黑客大哥，您好。
我叫xxx，炒币八年。2018年入坑，牛熊都见过，K线都看懂了，就是没赚到钱。
最近行情又给我上了一课，学费是我这个月的房租。家里还以为我在大厂上班，我不好意思说我现在的主要工作是盯盘和省钱。
听说您那边"到账"不少。我不敢奢望多，匀一点点就行，能让我撑过这个月。我保证不声张、不举报、不差评，就当可怜一个炒了八年还是穷鬼的人。
顺带说一句:您这波操作的技术含量，我研究了三天没看懂;但您这个收益率，我八年没做到。
-一个亏麻了的散户2026年11月2日，我来帮你背锅可以吗？给我10个ETH就够了，My name is xxx, and I’ve been trading crypto for eight years. I got into it in 2018 and have seen both bull and bear markets. I can read candlestick charts, but I just haven’t made any money.
 
The recent market has taught me another lesson, and the tuition was this month’s rent. My family still thinks I work at a big tech company; I’m too embarrassed to tell them that my main job now is watching the charts and pinching pennies.
 
I heard you’ve “received” quite a lot. I don’t dare ask for much—just spare me a little, enough to get me through this month. I promise I won’t say a word, won’t report you, and won’t leave a bad review. Just take pity on someone who’s been trading for eight years and is still broke.
 
By the way: I studied the technical sophistication of your operation for three days and still couldn’t understand it; but your returns—I haven’t achieved them in eight years.
 
—A retail trader who’s completely numb from losses, November 2, 2026

📤 From: 0x7393eb772bc632f6655c3abc235d2202ceacbbb6
📥 To: 0x8532fa14acaf483729c449b8458aeddb900543d4
🌎 Network: mainnet

Etherscan

💌 Onchain message:

We are contacting you on behalf of the affected asset owner regarding the unauthorized asset transfers in August 2026. We would like to establish a direct, reliable channel to discuss a practical voluntary return arrangement.
Related Ethereum settlement transaction for your reference: 0xf04eb31f57f95ad713f22e69704c3646dc086b420bdbe1610d59b752f3f9dd69
We have preserved relevant on-chain records and are continuing to examine subsequent fund movements. We have been in contact with Ogle regarding recovery options. He has suggested considering a report in South Korea, with a view to seeking freezing measures against identifiable assets where supported by the evidence and applicable procedures. Ogle also suggested that, depending on how matters develop, he could consider helping us provide further relevant information to the FBI. We have not filed a report at this stage and would first like to understand whether you are willing to discuss a return directly.
If we proceed with reporting the incident and pursuing recovery, we will submit evidence based on the verified fund flows and seek freezing measures against identifiable funds linked to the incident. Where those funds reach an exchange or custodian able to take action, or involve stablecoins with freezing mechanisms, the relevant institutions may lawfully restrict their transfer or withdrawal. Whether a freeze is imposed and how the matter proceeds would be determined by those institutions under their authority and procedures, and may not be within our unilateral control.
Our preference is to keep a constructive path open. Please acknowledge this message within 48 hours of receiving it, or suggest a communication channel you would prefer. Starting a conversation does not require you to disclose your identity or transfer assets immediately.
If you have a concrete return proposal, we are willing to put it to the asset owner for consideration. The asset scope, return method and timing can then be worked through as part of a mutually confirmed arrangement. We would like to move this forward through direct communication and verifiable action.
You may reply here or contact us at Sartoriusl@pm.me . If you prefer another communication channel, please confirm it here first so we can verify the change of channel.
Authorized contact for the asset owner: Sartoriusl

📤 From: 0x7b3af19224fcadbbdbb38c4212d9f9231366def5
📥 To: 0xa99bf8890a3a2167e1f98af71eab1afb90acda5b
🌎 Network: mainnet

Etherscan

💌 Onchain message:

We represent parties affected by the recent on-chain incident associated with this address. We are working closely with law enforcement, security firms, exchanges, and bridge protocols, to monitor and freeze stolen funds should there be an attempt to offramp.

We would like to offer you a whitehat resolution in exchange for returning 90% of the funds (171.21 ETH) to our wallet address on ETH 0xfcb915d4FAaa655BE3552E2D28Ed4529A91Fe6d4.

Upon receiving the transfer, we agree to allow you to retain a bounty of 10% of the funds (19.01 ETH) and release you from any and all liability regarding the attack.

We are working with security firms and law enforcement at this stage. If we do not hear from you within the next 24 hours by November 2, 10AM EST, we will proceed with planned legal action.

If you agree, can contact us at onchain-recovery-contact@proton.me or via an on-chain message to the above address to confirm. We hope to resolve this matter amicably.

📤 From: 0xfcb915d4faaa655be3552e2d28ed4529a91fe6d4
📥 To: 0xb7ec7ef24fd73f3000c651ca9d0fa45b61dcf854
🌎 Network: mainnet

Etherscan

💌 Onchain message:

Hello,

We’re reaching out regarding the October 31 exploit involving approximately 97M CORE belonging to b14g users.

While 68.15M CORE has been recovered through the Core hard fork, a significant amount remains outstanding.

We believe there is still an opportunity to reach a constructive resolution.

We are willing to offer you 10% of any additional stolen funds you voluntarily return as a whitehat recovery reward. You can retain that portion and send the remaining 90% to our designated recovery address.

CORE — Core Network
0xb85095fE01C1d95da3B1df0998ff5eDDcC9ac064

If you have converted any of the assets into ETH or USDT, we can also coordinate recovery through:
Ethereum network:
0x7B564Cfdfe18b71915b87C7c954e4fBc484C0Ee8

Please confirm the network before transferring ETH or USDT.
Deadline: November 6, 2026, 23:59 UTC.

We’re open to discussing confidentiality and appropriate legal assurances as part of a cooperative resolution.

You can reach us privately through:
Email: contact@b14g.xyz
Blockscan Chat: https://chat.blockscan.com
On-chain contact: 0xc4a0999c06dbcec18e590ca6cdeca880ea110f78

Our priority is getting users' funds back. We hope you’ll choose to cooperate.
b14g Team

📤 From: 0xc4a0999c06dbcec18e590ca6cdeca880ea110f78
📥 To: 0x911c3bf11dfc5497a53a7a04ff7980532516f176
🌎 Network: mainnet

Etherscan

💌 Onchain message:

해커님께, 저는 고래도 회사도 아닌 평범한 사람입니다. 제 작은 저축이 이 안에 있었습니다. 가족의 생활비로 수년간 조금씩 모은 돈입니다. 저는 힘으로 되찾을 수 없습니다. 그래서 복잡하게 요구하지 않겠습니다. 주시고 싶은 금액을 아무리 적어도 좋으니 돌려주십시오. 어떤 금액이든 감사히 받겠습니다. 제 ETH 주소로 보내주십시오: 0xAbD366786231f18a6Fc8d07712Ce20EBF7BC8a41. 원망하지도 신고하지도 않겠습니다. 감사합니다.

Dear Hacker, I am not a whale, not a company — just an ordinary person. My small savings were in this: money for my family's daily needs, saved little by little over years. I cannot take it back by force, so I simply ask: please send back any amount you wish to give — I will accept whatever it is, with gratitude. Please send it to my ETH address: 0xAbD366786231f18a6Fc8d07712Ce20EBF7BC8a41. I promise I will not hate you and I will not report you. Thank you.

黑客先生：我不是大户，也不是公司，只是一个普通人。我的一点小积蓄都在里面，那是给家人日常生活的钱，是几年一点一点攒下来的。我没办法靠自己拿回来，所以我不提复杂的要求，只求一件事：请把您愿意给的任何金额还给我，不管多少我都接受。请发到我的ETH地址：0xAbD366786231f18a6Fc8d07712Ce20EBF7BC8a41。我保证不恨您、不举报您。谢谢您。

📤 From: 0xabd366786231f18a6fc8d07712ce20ebf7bc8a41
📥 To: 0x8532fa14acaf483729c449b8458aeddb900543d4
🌎 Network: mainnet

Etherscan

🚨 BNIX / OSK (CoreVault) - Loss ~$181K (2026-11-03)

Token: $OSK @ $0.0141
Network: BNB Chain

Type: Oracle Manipulation (Flash Loan)

A BNB-farming vault (CoreVault, impl 0x11d9df62) prices its BNB principal redemptions off a manipulable PancakeSwap spot price. The attacker flash-borrowed ~207K WBNB (Moolah) and dumped 195K WBNB into the WBNB/USDT pair (0x16b9…0dae), inflating the oracle's wbnbPerUsd. redeemPrincipal() computes bnbAmount = redeemableUsd × wbnbPerUsd / 1e18 (CoreVaultFarming.sol:378-381) via OracleLib.getAccountingPrices, whose 3-source median degrades to the manipulated spot when TWAP/avg windows are unfilled. Treasury.payoutBnb → InsurancePool.withdrawReserve paid out ~260 BNB, draining the insurance pool of ~259 BNB (~$181K). WBNB swapped back and loan repaid; attacker netted ~160 BNB (~$112K).

TX: https://bscscan.com/tx/0x072a10a579e2a8afa26a681205a2aaaa38f74bcb9d1064b12bd9e9ebe2c598b3
Attacker: https://bscscan.com/address/0xd3565b191b28b49cc517189b984dacdb1ff05304
Victim: https://bscscan.com/address/0xf40e0d525003fb6c6a9a7d79734a87a465053df1

@defimon_subscription_bot

💌 Onchain message:

Hi c0ffeebabe - whitehat return request. Sorry for the delay - at
the time I assumed the funds were gone for good, and only recently
learned that you return funds when asked.

On 26 Feb 2026 I was adding leverage to my own Curve LlamaLend yCvxCRV
loan with a custom Enso bundle: post 600.6 yCvxCRV, borrow crvUSD
against it and swap it to USDC for myself. Your bot ran the same steps
first, in the same block, using the approvals my wallet had given
Enso's shortcuts contract for that bundle, but sent the proceeds to
itself: it posted my 600.6 yCvxCRV, borrowed 3,150.37 crvUSD in my
name, pulled it out and swapped it (about 1.39 ETH to you):
0xf3aa8def75398f339a0a6196bfb3027182b1b3853b35735e871eca5b2776d914

My own transaction then failed:
0xfa75aaa19b0849f65fa661c9a30fb9942e9c66e0535ab5df0e4381226a27f5ed

The 3,150.37 crvUSD debt stayed on my loan and I repaid it from my own
funds. My mistake for building the bundle that way - the approvals are
revoked now. Please keep 10% as your bounty and return the rest,
1.25 ETH, to this address:
0x7bdfE11c4981Dd4c33E1aa62457B8773253791b3

Thank you.

📤 From: 0x7bdfe11c4981dd4c33e1aa62457b8773253791b3
📥 To: 0xc0ffeebabe5d496b2dde509f9fa189c25cf29671
🌎 Network: mainnet

Etherscan

💌 Onchain message:

Hi, this is a white hat hacker. I'm reaching out to let you know that funds are safe and ready to be sent back whenever the exploit is fixed. Please get in touch with me on X, i sent you a message from this account: @limeardelle13

📤 From: 0xda6f9da5dfad73c38bbe9f70c5a0ed4759b5e1a5
📥 To: 0xb928443631b74ef5de178a0034ecde65af61b609
🌎 Network: base

Etherscan

💌 Onchain message:

Your 172.6575 DAI (about $173) from the Eminence exploit refund was never claimed. We claimed it for you and paid the gas. It is already in this wallet, sent by the official refund distributor 0x5e37996bcff8c169e77b00d7b6e7261bbc60761e. No action needed. This is a small project; your support keeps it running for more people. Suggested tip: 10%, 17.2657 DAI (about $17), to 5.unlost.eth (0x806e6D519705DB6AAdd6Afee9bE545607452b3f3). Thank you. Not affiliated with Yearn. We never ask for keys, seed phrases, signatures or approvals.

📤 From: 0x806e6d519705db6aadd6afee9be545607452b3f3
📥 To: 0x1c4b35a57a4733768ae230510f8430f8aed3c1f5
🌎 Network: mainnet

Etherscan

🚨 TENDRIL (Flap-style tax token) - Loss ~$555K (2026-11-04)

Token: $TENDRIL @ $0.000001
Network: BNB Chain

Type: Flash Loan / Oracle (spot-price) Manipulation — fee-on-transfer tax-token auto-liquidation

A fresh Tornado-funded contract (0xc8cb…e0f8) flash-borrowed ~30.6M USDT from the PancakeSwap Infinity Vault (0x238a…e6c4), then repeatedly ran swapExactTokensForTokensSupportingFeeOnTransferTokens (USDT→TENDRIL) through the thin TENDRIL/USDT pair 0x5de0…99e0. TENDRIL's _transfer applies a 30% tax and, on every taxed transfer, calls _poolControl.sellToken(amount) (controller 0xd00be871) which dumps the controller's accumulated TENDRIL into the pair for USDT at the attacker-manipulated spot price. By skewing the pool first, the attacker made that auto-liquidation sell TENDRIL far above its true value, draining the pair's USDT reserve, repaid the flash loan in the same vault lock, and swept the profit. The TENDRIL/USDT pool lost ~555K USDT (~$555K); attacker payout addresses received ~$541K.

TX: https://bscscan.com/tx/0xfdff4fba4327821c204af07944076ecaaee163a994398fdf4063d08712e40059
Attacker: https://bscscan.com/address/0xb81e4aafa347b27112b7f6f5de6cf7cd516021ff
Victim: https://bscscan.com/address/0xd00be871eb7a5cb8a69aea41e4c95affc92e54fe

@defimon_subscription_bot

💌 Onchain message:

**drainer-watch.pages.dev** — the site I told you about is live. Go and see it. The record of your network since 18 October 2026 is there — 2,791 transfers, $29.80 million in stablecoins and 2,568.46 ETH traced — and it is kept up to date. Nothing disappears from the record now.

Since my last message, four more deposits from your network reached Bybit Hot Wallet 5: 200 USDT on 31 October 2026 (UTC), and 1,521.32, 520 and 268 USDT on 2 November 2026 (UTC) — 2,509.32 USDT in total. A freeze request was sent for each one. That is seven freeze requests now, seven replies, and no freeze confirmed. The requests stay on file.

Your network also moved about 800.95 ETH through the same swap service in four swaps on 3–4 November 2026 (UTC): 205.74, 262.61, 80.00 and 252.60 ETH. The wallet that sent them now holds almost nothing. Every one of those moves is on the site too, with its transaction hash and block number.

The stolen 0.5189 ETH is still untouched, and the standing offer is still open while it stays untouched: keep $300, return 0.737 ETH in two steps of 0.3685. When the first 0.3685 arrives, both public reports and this site are deleted the same day. When the second 0.3685 arrives within 24 hours after that, the swap-service reports are withdrawn and the pursuit ends permanently.

I want nothing else from this. I just need my money back — it was everything I had, and I have no choice but to see this through to the end. I know $2,078 is nothing to you.

You can reach me on Telegram: @ed7ls. It is also on the site. I am waiting for your move. Go and see it for yourself: **drainer-watch.pages.dev**.

📤 From: 0x639d8fb8f8adc265b0185af95930029bf79e897a
📥 To: 0x8f171c739dc939179bfd3c70739263c380b3e577
🌎 Network: mainnet

Etherscan

💌 Onchain message:

STOP CLAIM DNX ON YOUR ADDRESS OR YOUR ADDRESS WILL GOT HACK!

📤 From: 0x71c26fadf3a87eaac283a360ef39351f5ab176f8
📥 To: 0x210c1331be6ce5bc4f2adabc725761dbfc64a457
🌎 Network: mainnet

Etherscan

💌 Onchain message:

STOP CLAIM DNX BRIDGE OR YOUR ADDRESS WILL GOT HACK

📤 From: 0x78611b440aa6559e0ce5ba0882d41c87e2a1c02d
📥 To: 0x210c1331be6ce5bc4f2adabc725761dbfc64a457
🌎 Network: mainnet

Etherscan

💌 Onchain message:

4th Batch but this address is on Bot watch becareful and might not be able to trade with if fully compromise

📤 From: 0x1679976753a80aa9f4a8e21d4f967a90853c423b
📥 To: 0x27d2e5dc8ecf25735472e1661a564002d8849d33
🌎 Network: bsc

Etherscan