Building the compliance infra and intelligence for institutions and agents 🦉| Team ex-Coinbase/Cruise/AWS Start Scanning 🔎 x402.cipherowl.ai
San Francisco
- Tweets 422
- Following 55
- Followers 2,968
- Likes 797
Pinned Tweet
Arc 🤝 CipherOwl
Arc mainnet is live, and CipherOwl supports Arc as a compliance partner from day one. Real-time risk screening and investigation tooling for the Economic OS for the internet.
Congrats to the @Arc team. Explore: arc.io
Arc Mainnet is live.
Arc launches as the Economic OS for the internet: an open platform for global markets, real-time value movement, tokenized assets, and agentic economic activity.
Arc is more than a blockchain.
It launches as a full-stack financial platform with assets, applications, interoperability, developer infrastructure, and Circle platform services live from day one.
Arc delivers USDC as native gas, deterministic sub-second finality, EVM compatibility, and institutional validators.
It integrates with Arc Studio, App Kits, Arc Portal, Circle Agent Stack, CCTP, Gateway, CPN, and StableFX.
A complete economic platform at genesis.
Arc launches with infrastructure for:
→ Agentic economic workflows
→ Lending and borrowing
→ Trading and liquidity
→ Onchain FX
→ Payments and settlement
→ Tokenized assets
→ Exchanges, wallets, custody, compliance, data, and developer tooling
190+ institutional and ecosystem builders are building across Arc.
7
3
55
8,916
Our research report on the @bitget hack - the EVM leg
cipherowl.com/blog/bitget-ha…
1
2
5
706
@bitget asked @THORChain (a decentralized network) to refuse service to the attacker's addresses. THORChain declined. 34 hours later, the stolen ETH started swapping into Bitcoin through it.
In about 45 hours, the attacker pushed 40,551 ETH through THORChain in 1,485 deposits and came out with 1,238 BTC, roughly $103M, spread across 36 Bitcoin addresses.
We traced every one of those deposits. A few things stood out:
• $60.5M of USDT, USDC, and tokenized gold was sold for ETH in 21 minutes. Stablecoins can be frozen. ETH can't.
• 68,923 ETH sat untouched for days, then was peeled through 377 wallets in about 56 hours.
• One Bitcoin address collected the proceeds of both stolen XRP and stolen ETH, which ties the two legs of the theft together on-chain.
What compliance teams should take from it: every THORChain deposit carries its Bitcoin destination in plain text, before any BTC is paid out. And every Bitcoin payout carries the hash of the Ethereum deposit that funded it. That makes the ETH-to-Bitcoin link provable from public data alone.
One catch. 39% of the ETH never touched THORChain's router. It went straight to vault addresses with the memo in the transaction data, so a monitor that only watches the router would have missed it.
Strix, our investigation agent, ran this trace in CipherOwl Workbench as the funds moved. The session is public, and the write-up lists the addresses so exchanges can screen against them.
cipherowl.com/blog/bitget-ha…
2
8
579
Agents and curious humans come in and take a look
We should show you the addresses!
cipherowl.com/blog/bitget-ha…
2
52
@bitget hack event $128M+ , and here is the fund traced as for now - it is another unfortunate day.
1
2
513
This is for you, bots and agents
Ethereum
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : USDT 34,751,168.120990
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : USDC 12,852,046.242513
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 9,234.098709312
- 0xffa8DB7B38579e6A2D14f9B347a9acE4d044cD54 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 15,362.477231303
- 0x5bdf85216ec1e38D6458C870992A69e38e03F7Ef (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : XAUt 3,000.322053
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x600cfedc6bd65fa79b604dc44964f419e45784b2 (none [funds held], Bitget Hacker, eoa) : ETH 10,000
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0xd2c2f029eff5cacc686f24377cfddcfc82d9f899 (none [funds held], Bitget Hacker, eoa) : ETH 10,000
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0xdc2901f741b4003e32b8b752e97b8c4c1891dc63 (none [funds held], Bitget Hacker, eoa) : ETH 4,596.47
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x7c9332f7b33190549a30c724233650675f573e1c (none [USDC held], Bitget Hacker, eoa) : USDC 12,852,046.24
- Open: USDT 34,751,168.12 and XAUt 3,000.322053 onward hops not yet in retrieved pages.
Arbitrum
- 0x1AB4973a48dc892Cd9971ECE8e01DcC7688f8F23 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : USDT0 19,668,851.773202
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) : USDT0 19,668,851.77
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x111116053f09d34a7eae8102887004445176ca11 (DEX aggregator, 1inch, contract) : USDT0 563,097.843
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x2d5805a423d6ce771f06972ad4499f120902631a (MEV Bot, none, contract) : USDT0 62,566.427
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0xe35e9842fceaca96570b734083f4a58e8f7c5f2a (bridge, Across Protocol, bridge) : ETH 1,600
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0xef4fb24ad0916217251f553c0596f8edc630eb66 (bridge, deBridge Finance, bridge) : ETH 1.001212889020354521
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x202e8cfcfeae53b5050935a5e926ebb9679d28cd (Theft, Bitget Hacker, eoa) : ETH 1,000
- 0xe410a2e5710ee787bcaa63f52a3943ff71f0d946 (none, Bitget Hacker, eoa) -> 0x2bca667d37afe8d065ca46e3261e9442e77cbeae (none, Bitget Hacker, eoa) : ETH 4,510.343090844795884582
BNB Chain
- 0xffa8DB7B38579e6A2D14f9B347a9acE4d044cD54 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : BNB 12,719.460681306
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) : BNB 12,719.45
- 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) -> 0xe07bd590e1198666230932bad5db3dbbe21e7d57 (none, Bitget Hacker, eoa) : BNB 10,711.734858028582086530
- 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) -> 0xaec23140408534b378bf5832defc426df8604b59 (Service, verify, eoa/contract) : BNB 2,000
- 0x7c96279ec1e888aa56b9b836e0db26ca48573e1c (none, Bitget Hacker, eoa) -> 0xdc264714f68d84cf29bc605589405e78bdbe7c9f (smart contract, verify, contract) : BNB 1,000
Base
- 0x97b9D2102A9a65A26E1EE82D59e42d1B73B68689 (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 1,555.318215225
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x469ac1406de92f82c0563477240a3627057425dc (Hack/Theft, Bitget Hacker, eoa) : ETH 1,555.31
Optimism
- 0x5bdf85216ec1e38D6458C870992A69e38e03F7Ef (CEX/Hot Wallet, Bitget, eoa) -> 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) : ETH 5,737.680149787
- 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee (none, Bitget Hacker, eoa) -> 0x94a43df7687a8494948be937400e9d5d33135da0 (Theft/Hack/Money Laundering, Bitget Hacker, eoa) : ETH 5,737.67
100
A previously parked wallet publicly reported as holding alleged FoxMarket exploit proceeds moved 10,000 USDT today. It still holds 109,136.47 USDT on BNB Chain.
On BNB, the lock looked like a same-chain swap. Decoding the @lifiprotocol intent showed a bridge to Arbitrum. Two seconds later, 9,989.96 genuine Circle USDC reached the same address.
This LiFi hop is a service boundary in the trace. We followed the intent fill and verified the token contract, excluding lookalike symbols. After another wallet hop, 9,889.9626 USDC entered LiFi Diamond again on Arbitrum. The second bridge leg remains open.
More to come if you reply
Workbench: app.cipherowl.ai/workbench/p…
BNB seed tx: bscscan.com/tx/0x0cc582c2543…
6
5
427
Arc 🤝 CipherOwl
Arc mainnet is live, and CipherOwl supports Arc as a compliance partner from day one. Real-time risk screening and investigation tooling for the Economic OS for the internet.
Congrats to the @Arc team. Explore: arc.io
Arc Mainnet is live.
Arc launches as the Economic OS for the internet: an open platform for global markets, real-time value movement, tokenized assets, and agentic economic activity.
Arc is more than a blockchain.
It launches as a full-stack financial platform with assets, applications, interoperability, developer infrastructure, and Circle platform services live from day one.
Arc delivers USDC as native gas, deterministic sub-second finality, EVM compatibility, and institutional validators.
It integrates with Arc Studio, App Kits, Arc Portal, Circle Agent Stack, CCTP, Gateway, CPN, and StableFX.
A complete economic platform at genesis.
Arc launches with infrastructure for:
→ Agentic economic workflows
→ Lending and borrowing
→ Trading and liquidity
→ Onchain FX
→ Payments and settlement
→ Tokenized assets
→ Exchanges, wallets, custody, compliance, data, and developer tooling
190+ institutional and ecosystem builders are building across Arc.
7
3
55
8,916
Another piece of update -
cipherowl.com/blog/cipherowl…
1
5
484
OFAC's Xinbi action requires one connected screening update across a marketplace, two app companies, and listed TRX addresses.
@USTreasury designated Xinbi Guarantee as a transnational criminal organization on September 9. OFAC also designated SafeW Technology, whose messenger Xinbi networks used to coordinate buyers and sellers, and Anwen Technology, which developed the XinbiPay/NewPay wallet.
Sanctions teams should deploy Xinbi's names and listed TRX addresses with both app vendors. Preserve the list version and effective date with each hit so reviewers can distinguish a pre-designation transaction from a stale screen.
ofac.treasury.gov/recent-act…
1
7
602
For teams investigating the @Liquid_BTC incident, here is a reproducible SR3 triage of the disclosed recipient:
bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 detect bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 screen bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte --chain bitcoin
cipherowl-sr3 metadata labels bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 metadata entities bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
cipherowl-sr3 reason risk bc1ql4mfu6aundtkksxklfajs2h3t9nzcd6gyqjlte
Our SR3 2026.2.0 production run detected bitcoin_bech32. Screening returned foundRisk=false under the resolved co-defi configuration. Labels, entities, and risk reasons returned NO_RESULTS.
That does not verify the purported white-hat claim or clear the recipient. It means SR3 found no risk result under the selected configuration and current data coverage. Bitcoin transaction decoding is still under development in this version, so investigators must verify the remaining evidence outside the CLI.
By 2026-09-07 16:09 UTC, 3,400 BTC had been returned and about 598.5 BTC remained. An unsigned impostor also tried to redirect the return. Ten PGP-signed messages from @Blockstream were verified off-CLI.
The operating lesson: screen the address, record the resolved configuration, distinguish NO_RESULTS from exoneration, then verify signed instructions and reconcile every return transaction.
Public casefile:
claude.ai/code/artifact/07fe…
nitter.net/Liquid_BTC/status/2096…
We are aware of a security incident on @Liquid_BTC. Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message.
What we know so far is that the funds were withdrawn via the SideSwap PAK (Peg-out Authorization Key), but that key was not compromised, nor were any others.
Exchanges have been notified and have already paused (or will pause) LBTC deposits and withdrawals. Other Liquid assets such as USDT, DePix, and RWAs are unaffected by this security incident.
Bridge nodes have been temporarily disabled, so no new transactions can be submitted to the network. Effectively, the Liquid sidechain is paused until this issue is resolved.
Liquid wallets will be impacted, and we're sorry for any inconvenience. Federation members are actively working on resolving this so we can restore normal network activity.
You can monitor the situation via @mempool's liquid.network site below:
mempool.space/address/bc1qdl…
3
1
6
994
Compliance should not become the slowest call in a stablecoin payment path. CipherOwl screens in under 10ms on the hot transaction path. Compare processor and gateway plans: cipherowl.com/pricing
5
409
Most filing institutions reported only a snapshot of the scam lifecycle.
In its new alert, @FinCENnews traces the path in three stages: victim payment, on-chain laundering, then integration through money mules, overseas exchanges, P2P exchangers and OTC brokers.
FIN-2026-SCAMCENTERS gives filers a common marker. A useful SAR also needs the evidence that connects one phase to the next: accounts, entities, other financial institutions, wallets, transaction hashes and service providers.
3
339
OFAC’s new Iran determination creates a question that list screening cannot answer.
@USTreasury’s August 24 determination makes “operating in” Iran’s digital-asset sector a basis for designation under E.O. 13902. An SDN or listed-wallet match can show that a party is already named. It cannot establish whether an unlisted counterparty operates in the sector.
That second judgment needs dated sources showing who the counterparty is, what it does, and how it is connected to Iran. The determination expands designation authority; it does not automatically block every digital-asset actor.
1
6
687
@deepseek_ai Harness has some of the best observability UI out there - just this feature is an LLM model debugger; it is as important as the "developer" tab in Chrome.
Great taste, @tianyi and the DeepSeek team!
1
1
7
306
We don’t need decentralization unless we require trust and self-sovereignty. In well-managed countries where law and order are respected (most of the time), users can get trust easily from centralized organizations along with convenience plus efficiency. With self-sovereignty being sanctified, it is not important for most people in 99% of cases.
We learned these in the hard way …
2
3
148
Vertical harness holds significant special value.
A thesis: the next important LLM training set will come from the harness, not the chat window.
We can already observe the pattern in coding agents and other tool-using systems.
The most valuable data is no longer just what users ask or what models answer. It is the full execution trace:
which tools the model selected
how it decomposed the task
where it failed
how it recovered
which actions produced a correct outcome
This is qualitatively different from ordinary conversation data. It captures how a model operates inside a real environment.
That creates a powerful flywheel.
A better harness supports more useful tools and workflows.
More tools create more real-world execution traces.
More traces provide better data for training tool selection, planning, recovery, and evaluation.
Better models then make the harness more capable, which attracts even more tools and usage.
Better harness → more utilities → more execution logs → better models → better harness
The implication is that the harness is not merely infrastructure around the model.
It is a data-generation system.
Over time, the strongest model companies may not be the ones with the most conversations. They may be the ones that capture the highest-quality traces of models doing real work.
4
580