decoder
95 subscribers
22 photos
1 video
4 links
Decoding the blockchain’s darkest corners.

Twitter - x.com/decoder0x
Communication - @decoder0x_dm
Download Telegram
Channel created
Recently there have been many video tutorials on how to deploy smart contracts.

The scheme works like this:
- a victim deploys contract from the scam tutorial.
- deposits some $ETH to its address
- runs the «trading» function

Then the contract withdraws all funds to the scammer’s address that was disguised in the code.

Scammers disguise the address in the code in this way:
Each function contains a part of the address in hexadecimals values.
And then it returns: 0+x+...
(photo №1)


Here is scammer's address:
0x7681AEd55B069993037FC25B6DC5E5DC2d7710d1

You can see many deposits to it from multiple smart contract addresses.
Then scammer spreads funds to multiple wallets to «cover» the tracks.
(photo №2)


Then all these funds were consolidated and transferred to their 2 wallets:
0x9E23C00188127D64adB26a6AB63127626c2D7754
0xD814868eDB93AC14d1C35bC75F9A104785ccDf8C
(photo №3)


They are holding 450,000$ rn.

Please be careful!
3🔥18👍9👏3💯2🐳1🦄1
The main clown of the month - utushkin vladislav 🤡

Somebody maybe heard about his $MDAO token.
A month ago he deployed his first meme token on #TRON blockchain - $MWD.

Just look at how he whines that others sell his token!

And now look at the #ARKHAM graph - absolutely every top_trader_wallet is his team's wallet!

Deployer address:
TWcE6EgRDKJ8YDJUHjqPFpDMiW5p1rCnE3
Deploy transaction:
https://tronscan.org/#/transaction/f9a4aca039c234867d0cf911267f6d3fe7a61bb9766705700e32977e8a5c6d04

Here is his main wallet that spreads all tokens:
TR5rHUYStVUTKEANyBYxSKrAnWucZCRUMG

Thank you for your attention and stay away from such teams❤️
3🔥28👍7🤣4👏2😁1😱1
This media is not supported in your browser
VIEW IN TELEGRAM
Crystal labels certain addresses as affiliated with Garantex (on the sanctions list since 2022) without sufficient grounds.

Due to this erroneous labeling:
- the address acquires a "toxic" status.
- the owners of such wallets face accounts blocks and loss of funds.

I have examined the addresses labeled as "sanctioned" by Crystal.

Here is a list of them:
TAeCrsR72ddqMeK36fpEuYs95fA2yfyrZY
TT7Z5ArWR4gj529xuyuJVKALQmgz9thipS
TK6TsZG3MeCuF9E3em6YUiHSyR1u63qMSg
TMMFhKb5x5nCNsH3RwbybG3iAAi88RqEW2
TQ1893St9QCY3kKuhZi4pRcXwn6wfUEPRM
TGYQYSE3F9bZuZiyBrYompgnGd4YZaqPwF
TQLwer9H3XbWBEtwuN74d3HU678qb5p5Xx
TNTWf81sNBJ3DFgjehw9L1o8qnP8M45JXR
TVTREz6W7mEFVM6DLyfibSquh67NbCn1pq
TAF4VCN3dWp9u3mHjDb5F41DtFjCqPPCwH
TML1dGHoqqybyxpF3ezNyi6Ups86E6Wt7q
TQUba8ue3iFm2SZyah8MMUAyYD5jerJ2Nb
TQkaTDR9nzT3Dwct2ntfzxKJKCpkmG2UF1
TAE6oEjM7dAzQik3zGRvAkSJTQNmwBrGZb
TDG5vLdAEFUjdPnmDP3imcGYVteyaxgvRp
THUCv6VATnahtbBBvHuisBDyrksXpaT3fn
TRpDzYzDrrYPm4Q1vNBU8XVZxqywVRFFfD
TABJBUsPYiKhGh4mV9HJ3ucrvb6QwXpXBo


Fact: "clean address = clean address".
Crystal: "clean address = dirty address".


These inconsistencies occur because Crystal, along with their distributor AMLBot, use heuristic algorithms to identify and label wallets. As a result, the risk score of all addresses that have ever interacted with the above addresses increases, creating a chain reaction for many other addresses.

And now look at this - TQ1893St9QCY3kKuhZi4pRcXwn6wfUEPRM continues to actively interact with Binance, freely sending and receiving crypto - so is Crystal's data reliable?

I decided to verify the addresses using Chainalysis:
All of the above addresses are clean according to Chainalysis data. This can only indicate significant discrepancies in the methodology and practice used by Crystal's analytics tools, which in turn calls into question the validity of their conclusions and the objectivity of their assessments.

«flip-flop»:
Crystal periodically changes their labeling and classification results for addresses.
For instance, TRpDzYzDrrYPm4Q1vNBU8XVZxqywVRFFfD and TABJBUsPYiKhGh4mV9HJ3ucrvb6QwXpXBo were reclassified from Garantex to other entities - Crystal confirms the unreliability of their previous conclusions.

Incorrect asset-tracing:
Crystal applies a tracing method where the risk assessment of transactions is based not on the analysis of specific assets but on the information of the counterparty's wallet, leading to unjustified inclusion of wallets in high-risk categories.

So is it legal to use Crystal's data in compliance procedures?
9🔥67👍2910😱6😁1🤯1
NexFundAI deployer = FBI?

Recently all mass-media started publishing the following: "The FBI created a token...".
Do not trust such info and always DYOR!

Onchain metrics show that the whole "project" was actually created by serial deployer - so has FBI been manipulating tokens for 2 months or $NexFundAI was deployed by Gotbit?

Deployer's address:
0x9CBA04BAB29EBDfD2175e30c545B8e21537095f6

OKX deposit:
0xe67C443fEcdFb577AA34cD1d060b9B1F2DC8E95C
2🔥186🤣4👍2🤔2😁1
What if $VUSD was created as exit liquidity for exploiters?

On Sep-26-2024 06:28:23 PM UTC, a vulnerability in the uniBTC smart contract was exploited.

Here are some of reported addresses:
0x0000000000004F3D8AAf9175fD824CB00aD4bf80 - uniBTC Exploiter 3
0x680910cf5Fc9969A25Fd57e7896A14fF1E55F36B - OnyxDAO Exploiter 1
0x7d522f67268F1C46D888fe083aAa86f784B9d082 - uniBTC Exploiter 16
...

As we see they are smart enough not to expose all of their wallets onchain. So let's piece together some facts.

On Aug-20-2024 $VUSD was minted.
On Sep-26-2024 $VUSD & @OnyxDAO got exploited.
Wallets that bought $VUSD on the market just got blacklisted. Do they have to pay for this?

Main figures:
0x0BFFDD787C83235f6F0afa0Faed42061a4619B7a - VUSD CA.
0xeE894c051c402301bC19bE46c231D2a8E38b0451 - oVUSD CA.
0xfD47f6879ccBAe84009F367E3e0c54dc2D435500 - VUSD manipulator.
0x3546502606e0e9B70636CCe43E1844288C6D44aA - VUSD manipulator.
0x4e1266c7A132DdEd71c9A4Ee74f4CA79C75c125d - oVUSD deployer - funded by 0x35…44aA.


The interesting thing is that $VUSD top2 and top3 traders are «OnyxDAO Exploiter 1» and «uniBTC Exploiter 3».
And the top1 trader is 0xfD47f6879ccBAe84009F367E3e0c54dc2D435500 - sold 1M$. This wallet is also funded by «OnyxDAO Exploiter 1» and still isn’t reported by anyone.

Etherscan, Bedrock_DeFi, pay attention to these wallets.
I see that you've already asked the exploiters to return $uniBTC in several IDMs. And they returned about 5 $uniBTC (photo 4) - good job!


P.S.
Do not trust such beautiful addresses:
0x0000000000004F3D8AAf9175fD824CB00aD4bf80
0x666666665931f8739817e22A0B7CE7F9EFf53f3E
0xffffFffff5862f0229585e548973E0E556EFf003
0x00000000009e560932B2D1B4161c7ccD7F5c1FAb
0x00000000009819dbAA100eD113b04B1B256B70d7
0x000000000050E65abd53CD9a4D9b9500e209A3bC
0x0000000000429ea06331427cdEEB4884ae043245
0x000000000029A517b824E91d083B7ac864cf0C5E
0x000000000023599274812F77725FbE7a8b4bdd47

Suckers:
0x39b19E50A59b9739DfD2C4F259E8ee1b8E6d6BEC - Match Systems
0x6fA35c5b8661041e6360f385a5CffB7ADE6fFc8a
0x04655832bcb0a9a0bE8c5AB71E4D311464c97AF5
0x7C099f625208a5A7C7fAc328e71b871350A763a0 - fake OnyxDao
0xfdE1cB0c3522451705d9c64A74994801Fe8aF4Cd - fake OnyxDao
5🔥15👍7👏2🤯2🤔1