🚨 The Fake Ledger That Stole Everything (1/8) James* thought he was safe. He used a Ledger hardware wallet, kept his 24 words private, and followed every crypto security tip out there. Then one day… a package arrived. 🧵👇

Omg, my wall is full of content I actually want to see now! It worked!

I’m such a geek! 6.5MB of data downloaded, queries built and now executing analysis using AI! Looking forward to seeing the results

One thing I always look for with a new crypto fraud case is: is it still happening? If the answer is yes, that can make the investigation really interesting. The funds might still be moving, new wallets might be appearing, or we might see interactions with services that give us somewhere else to look. This is also where OSINT can become really useful. We might start with nothing more than a transaction hash or wallet address, but that can lead us somewhere else. Perhaps we find a username, an email address, a domain, a social account, or simply something that gives us another direction to investigate. This is exactly the kind of thing we're looking for when someone submits a case through IOC Support. We'll take an initial look at the case for free, do some basic tracing where appropriate, and help you understand what we've found and what your next steps could be. Where it's useful, we'll also provide a simple tracing chart that you can share with law enforcement. There are obviously limits to what we can do as part of a free assessment, but sometimes you just need someone to take that first look and help you understand what you're dealing with. That's what I want IOC Support to be there for. Terms, conditions and scope apply.

One of the biggest mistakes in crypto investigations is assuming that a line on a tracing chart proves a relationship. It doesn’t. A transaction can represent: → A genuine transfer between two people → Exchange infrastructure → A smart contract interaction → Address poisoning → Zero-value spam → Automated routing → Something completely unrelated to your hypothesis The further you investigate, the more dangerous simplistic heuristics become. Try to disprove your own connections. That’s an important distinction.

AI shouldn't tell you who owns a wallet. It should help you build the tools to investigate it. That's where AI is getting really interesting for investigators. I’m using it to help me: → Build investigative tools → Interact with blockchain APIs → Process huge transaction datasets → Identify patterns worth investigating → Automate repetitive analysis → Test hypotheses faster But here's the important bit: You still need to understand the evidence. You need to verify the output. And ultimately, you need to defend the conclusion. AI shouldn't replace the investigator. It should give the investigator leverage. Earlier this year, we ran How to Build Crypto Investigation Tools Using AI and had a brilliant response. I'm considering running it again - but only if there's genuine demand. Interested? Comment below with one problem you'd like to use AI to solve in your investigations. I'll use the responses to help shape the next course...

If someone in your community gets scammed, hacked, or drained, send them our way. We’ll take a look for free: what happened, where the funds went, and whether it’s worth investigating further. Tracing, OSINT, or both. Best fit: community owners, mods, founders, investigators, and Web3 security teams. Not in scope: @pumpfun and similar launchpad rugs. Too many, too fast, and not something we can take on properly. No recovery promises. Honest assessment only. Run a community? Drop it below.

One of the cases we took in recently was a really good example of why blockchain analysis and OSINT work so well together. We started with nothing more than the transactions. From there, we followed the funds through wallets, transactions and services until the trail eventually reached Tornado Cash. At that point, the on-chain side of the investigation paused. Everything up to there had been done as part of our free initial assessment, but we knew the case wasn't necessarily finished. Once we started looking at the wider OSINT picture, a completely different footprint began to appear. We found smart contract deployments across multiple blockchains, links to other scams showing similar behaviour, and additional data points that gave us more context around the use of mixing services. That changed the direction of the investigation.

This is worth looking into if you have a an iPhone

You can now check if your account has been shadow banned yourself, through this self-service option by X nitter.net/i/under_the_hood

My X wall is so bad right now! Mass unfollowing incoming! I only want to connect with those who add value. Who do you recommend I follow to keep up with CT, OSInt and fraud related topics?

Fake investment red flags we keep seeing. Different websites but really the same scam. This week we reviewed a fresh batch of crypto cases. Every one of them got a free initial assessment. About 85% were fake investment platforms. The pattern: 🚩 Someone reaches out, out of nowhere with an investment opportunity. 🚩 The dashboard shows profits you cannot actually withdraw 🚩 A tax, fee, or deposit is required before funds can be released 🚩 The “advisor” keeps pushing you to put more in 🚩 The moment you try to cash out, the rules change A polished dashboard is not proof the platform is real. If it feels off, stop sending money and get it looked at first. What other red flags are you seeing?

We should do a sweepstake on how soon Asange will release his token, backed by $LAPTOP, to help those who lost $TRUMP. Only in this space, could this actually happen!

Is there a tool similar to Spiderfoot on the market yet?

Don’t we have enough blockchains already? @arc will surely just be in the “other” category?

What are your thoughts on the @arc blockchain? Is it worth exploring?

People need to use @bubblemaps otherwise they're going to be holding the bag

Looks like P&Ds are leading the race at the moment, closely followed by fake investments.

What is actually catching people this week? Not a poll for fun. I am trying to decide what to break down properly.