$3.42M flowed into Tornado Cash in the last 24 hours.

136 discrete deposits across four pool denominations, computed live from on-chain logs. Tornado's smart contracts were sanctioned in August 2022 — the contracts themselves are immutable and keep accepting ETH. This is what the chain actually shows, not an API estimate.

Editor's note — what this edition actually is

This is Fraud Watch №1. Every figure below is pulled live from public sources at generation time. No sample data, no padding. Sections without live signal are hidden, not filled. We lead with Tornado Cash deposit counts because the signal is timely, computable on free public RPC, and missing from every free competitor. Our proprietary labeled-wallet database seeds with every run.

Lead · Mixer Inflows · Tornado Cash · Last 24h

$3.42M in · 136 deposits · 1487.80 ETH

Pool	Deposits	ETH in	Contract
0.1 ETH	48	4.80 ETH	0x12D66f87…
1 ETH	43	43.00 ETH	0x47CE0C6e…
10 ETH	34	340.00 ETH	0x910Cbd52…
100 ETH	11	1100.00 ETH	0xA160cdAB…

Computed via eth_getLogs against the four canonical Tornado Cash ETH pools. Contracts were designated by OFAC on 2022-08-08; they remain immutable and continue accepting deposits. Anyone who deposited in the last 24 hours has, by Treasury position, touched sanctioned infrastructure.

Our Focus · USDT-TRC20 on TRON · The Rail Nobody Covers

$233.7K

across 3 notable transfers in the latest Tronscan window — live from the chain, not an aggregator.

TRON USDT moved ~$62B at last issuance count and is the dominant stablecoin venue for pig-butchering, ransomware off-ramps, and sanctions evasion. Sell-side doesn't cover it. Chainalysis dashboards it but won't publish it. This is BlueWing's lane.

Amount	Time (UTC)	From → To
$158.9K	2026-04-20 15:18	`TWBPGLwQ…yJW1JJ` → `TReUDs18…8BVXYG`	trace →
$24.2K	2026-04-20 15:18	`TTJVPbcq…sdR5TZ` → `TH1HzETh…zKwouw`	trace →
$50.7K	2026-04-20 15:18	`TNd4yhXY…AEhzwa` → `TJMzEz4v…TUZpCm`	trace →

BTC Whale Moves · Last 24h

Transactions ≥5.0 BTC from mempool (unconfirmed) and the latest block (confirmed). Live from blockchain.info and mempool.space.

Size	Transaction	State
59.94 BTC $4.50M	`b5d225aa…230ea3`	mempool
39.94 BTC $3.00M	`dbdd2553…7c2fe2`	confirmed

Live X Alerts · PeckShield / SlowMist / ZachXBT · Last 72h

@zachxbt 2026-04-20 14:05
Why did Kraken list $M (Memecore) on July 3, 2025 for spot and how did it pass due diligence? $7.9M in suspicious Kraken withdrawals to 18 newly created addresses with 11.7 $M sitting total (valued at $39.8M now). Insiders have manipulated the price to $6B market cap ($18B FDV) and Kraken is one of the few venues tha
view post →
@zachxbt 2026-04-19 23:43
Update: Three hours ago multisig 0x53d7 linked to the RAVE initial distribution which I flagged above sent ~23M RAVE ($23M) to two Bitget deposit addresses and the price dropped 40% from $1 to $0.6. Deposit addresses 0x26aC542f5a04D574580881723224DAcD1EDB9B45 0x64D6E91D0bd9cB7be44E1e627264539493f73c2b
view post →
@zachxbt 2026-04-19 11:03
A summary of the RAVE -95% price fluctuation from $26 to $1 over the past 24 hours. RAVE Timeline: April 18, 2026 7:26 am UTC: I posted a call to action for Binance, Bitget, & Gate to investigate RAVE market manipulation and offered a $10K bounty. 10:56 am UTC: I posted an update increasing the bounty to $25K. 11:1
view post →
@SlowMist_Team 2026-04-19 03:58
Regarding the $280M @KelpDAO exploit — the suspected root cause is its use of a 1/1 DVN configuration on @LayerZero_Core , meaning a single compromised validator is all it takes. All of this is still speculation. Waiting on an official post-mortem. Kelp (@KelpDAO) Earlier today we identified suspicious cross-chain
view post →
@PeckShieldAlert 2026-04-19 02:49 ARB
#PeckShieldAlert The @KelpDAO exploiter is the #8 largest variableDebtEthWETH holder on #Aave (#Ethereum) with 52,443.94 units ($123M), and the #4 largest variableDebtarbWETH holder on #Arbitrum with 12,381.93 units ($22M) Total Holding: 106,466.7 $ETH (~$250M)
view post →
@PeckShieldAlert 2026-04-18 20:29
Today's @KelpDAO exploiter deposited the stolen $rsETH into various lending protocols (AaveV3, CompoundV3, Euler) and and borrowed massive $WETHs w/ >$236m debt. PeckShield Inc. (@peckshield) Hi @KelpDAO , you may want to take a look at: etherscan.io/tx/0x1ae232da21… — https://nitter.net/peckshield/sta
view post →
@CertiKAlert 2026-04-18 19:45
#CertiKInsight 🚨 We have seen an incident affecting @KelpDAO At least ~$290M was transferred etherscan.io/tx/0x1ae232da21… Funds can be traced to these 2 addresses: ~$250M at 0x5d3919F12bCc35c26Eee5F8226A9bee90c257Ccc ~$2.5M at 0xCBb24A6B4DAfaAA1a759A2F413eA0eB6AE1455CC
view post →

Fresh Drainer Wallets

From ScamSniffer's daily-updated open blocklist. Import before the EOD open.

Chain	Address	Label	Grade
ETH	`0x0660e5…fb2ac7`	Drainer	B2
ETH	`0x1fa47d…e8c493`	Drainer	B2
ETH	`0x7fe421…757e55`	Drainer	B2
ETH	`0x0a24ea…701144`	Drainer	B2
ETH	`0xc61248…5b6906`	Drainer	B2
ETH	`0x04ee62…d43166`	Drainer	B2
ETH	`0x6a2142…4d3e44`	Drainer	B2
ETH	`0xd3ed4e…945e9d`	Drainer	B2
ETH	`0xb240f8…80e6ba`	Drainer	B2
ETH	`0x013c72…97a7c4`	Drainer	B2
ETH	`0x42b168…1b7de6`	Drainer	B2
ETH	`0xfe1e5b…37c858`	Drainer	B2
ETH	`0xcc0b48…5cb2b8`	Drainer	B2
ETH	`0x92c582…94b6c9`	Drainer	B2

Phishing Domains · MetaMask Feed

Live blacklist from MetaMask's eth-phishing-detect. 243,769 total entries, showing 12.

teams07web.com
blast-pools.pages.dev
hopprotocol.pro
blast-project.pages.dev
acces-blst.pages.dev
blast-asset.pages.dev
blst-node.pages.dev
distribution-blst.xyz
uniswap-trade.web.app
l2blast-check.xyz
lihea.build
l2blast-checker.xyz

Tether-Frozen Addresses

ETH addresses blacklisted by Tether on the USDT ERC-20 contract. These wallets hold frozen USDT that cannot be transferred.

Addresses frozen

The Moat · Labeled Wallet DB

Every Fraud Watch issue appends to our proprietary bluewing_labels database. 651 OFAC-sanctioned + 30 ScamSniffer drainers + 93 Tether-frozen seeded on day one. Queryable via REST API and the upcoming bluewing-mcp server.

Forensic reports · when a daily scan is not enough

Stop guessing. Start citing.

A risk verdict in thirty seconds, a filable report in three days, or the full intelligence package in ten. Same evidence discipline every BlueWing PDF has shipped since day one: SHA-256 manifests, confidence-graded findings, and a transaction hash behind every claim.

Free · Risk Check

Thirty seconds · Public

Paste the address. Green, yellow, or red in under thirty seconds. OFAC and sanctions, drainer and scam-registry hits, exposure tags, one-line plain-English summary. Enough to know whether to walk away or pick up the phone. No credit card.

First 3 lookups · no email needed
Then 2 / day · 10 / week · email-verified
Cloudflare Turnstile bot protection

Check a wallet now →

Pro · On-Chain Report

Three-hop graph · 3-day delivery

$2,500

For the deal that needs a paper trail. Full transaction history, a three-hop connected-wallet graph, mixer entry flags, supply-concentration analysis, drainer-ring identification, multi-chain on the single entity. Watermarked PDF with SHA-256 evidence manifest, independently verifiable by your counterparty. Priced to close on a corporate card. No RFP. No committee.

Request a Pro report →

Founding price

Elite · Full Intelligence

Five-hop · Multi-chain · OSINT · 10-day

$7,500

$12,500 at list after founding window

For serious matters where counsel is already involved. Everything in Pro, plus the OSINT layer that holds up under scrutiny: GitHub scam-site enumeration, IPFS metadata, WHOIS pivots, social and homoglyph cross-reference, up to three chains with a five-hop network graph. Structured JSON export for the data room. Optional on-chain anchoring for chain-of-custody. Used by attorneys in live crypto-fraud matters.

Request an Elite report →

Source status this run: mixer flowsofacofac delta weekrektscamsniffercoingeckosecx alertsbtc whalestrx usdt flowstether frozenphishing domainschainabusedefillama hacks