IOC Investigations

🚨 Calling All Crypto Crime Professionals! 🚨

We’re launching a 10-episode podcast series diving deep into the world of crypto crime - and we want you to be part of it.

💡 Interested in joining or nominating someone?

👉 Fill out this quick form to get started: lnkd.in/epYzEP5G

📣 Find the clues that everyone else misses🔍

Our Custom Dork Builder – designed to make advanced search simple.

✅ Choose your filters
✅ Build the query automatically
✅ Instantly search across multiple search engines

Perfect for beginners, useful for pros.

Scroll down: intelligenceonchain.com

🚨WE FOUND OUT HIS JOGGING ROUTE 🤯

In a recent IOC case, our client tasked us with finding out how much we could uncover about him following a recent targeted attack.

The attack itself? Minimal.
He wasn’t worried about his crypto…

He was worried about his identity. His mind was blown

🚨🚨 CETUS PROTOL HACKED ON SUI

Please be aware of an ongoing hack with Cetus Protocol. More details are shared here:

x.com/intell_on_ch...

🚨 Scam-a-Day Series: F is for Fake Ledger Hardware Devices In May 2021, some cryptocurrency holders found an unexpected package at their doorstep – a Ledger hardware wallet they never ordered. The box looked legitimate, complete with shrink-wrap and a Ledger ...

🚨 Fake Ledger devices are still a threat.
⬇️
📦 A Ledger shows up at your door.

Looks real. Letter says, “Replace your old one.”
You enter your seed phrase.
Your crypto’s gone.

Yes, this really happened.

🔗 How the fake Ledger scam works:
intelligenceonchain.com/news/f/%F0%9...

#Crypto

Currently in a call with the UK Government about the National Risk Assessment for the UK!

👀

Scam-A-Day | Day 1: Airdrop Fake Links
Scammers use fake “free token” links to trick you into connecting your wallet—then drain it.
Always verify airdrops, never trust random DMs, and use tools like Revoke.cash to stay safe.

Day 2 drops tomorrow. Follow to outsmart the A–Z of digital scams.

You're being targeted daily!

There are still ongoing campaigns to drain your wallet, using conference calls and/or job interviews to get you to download malicious packages.

AttackerGas Feeder:
0xB01caEa8c6C47bbf4F4b4c5080Ca642043359C2E

The clue is always in the URL > Always verify on virustotal

Another client happy to now get traction with Law Enforcement following an investigation by IOC.

Previous to our involvement, the authorities hadn’t been able to resource the investigation!

We did the hard work and put it on a plate for them.

Today, we managed to freeze the proceeds of a stolen Cryptopunk NFT, with the help of OKX.

You can read about it here:
x.com/Intell_On_Ch...

Also, could you pass me the ETH address please? My victim's assets went to a clean wallet 5 days old

Anatomy of a Crypto Scam - Thomas Harris Thomas Harris is a fraudulent YouTuber who uses fake crypto tutorials to spread malware. He artificially inflates his channel's popularity and promotes a malicious script that downloads harmful files ...

@maxpou.fr Great blog on the scam YouTube Channel!!
www.maxpou.fr/blog/crypto-...

I have a victim, unfortunately, did you put everything in the blog, or do you have any other information on top of this?

Intelligence On Chain Blockchain and OSInt Investigations

As an individual, you can open a case here 🕵️‍♂️
intelligenceonchain.com/open-a-case

As a community or group, you can report the fraud here 🕵️‍♂️🕵️‍♂️
intelligenceonchain.com/report-a-rug...

GOT RUGGED?

We might be able to help! If you are impacted in anyway, I recommend you reach out!

Degen accounts following us to see what we're saying about the 😅

BREAKING - Tornado Cash deemed not a "property" and therefore falls outside of OFAC authority.

Does this mean sanctions will be removed?

I doubt it, I believe the government will look to refresh/redefine IEEPA which was enacted in 1977.

Let's see

I prefer Aubergine 🍆

That is so true!

GM Ermmm.

What do we call this? Crypto Sky? Instead of CT?

Thoughts on @pumpdotfun.bsky.social 's statement?

👋 Hood to see you

GM Bluesky! Where the #crypto family at?

HOAXY

A powerful and free online tool to visualize the network of #BlueSky profiles mentioning a specific hashtag/keyword in posts and analyze the connections between them. For each account, you can see a list of those it has reposted or quoted.

hoaxy.osome.iu.edu

Tip by @ukosint.bsky.social

GM

@pumpdotfun.bsky.social URGENT, take down the livestream feature. People are literally going to lose their lives. It's getting out of hand

Wow and when you follow the address back, you see an automated wallet sending Lamports to hundreds if not thousands of addresses!!

Check it out: solscan.io/account/J1BGJn…

🚨 Address poisoning on Solana 🚨

4 letters at the start of the address are the same.

Actual address: A1S8pNwcXWR2KpNPSNY3MkhehVnzgAuVB3m9vPZ3Brzn

Spoofed Address: A1S8E7nkTtsL5KJgDPJScE4AYSG3AzCRZUz55Z6M8ixn

I'm pulling this one out of the history books again, but these addresses are symbiotic and appear to be some kind of exchange.

Inputs -> BfP2dBiHbiqYvsmESsgHEL8wQtZt25sbDNKnwmNRB34G

Outputs -> DQ5JWbJyWdJeyBxZuuyu36sUBud6L6wo3aN1QC1bRmsR

Some say it belongs to SwopShop