Onchain Diary

Onchain Diary

@onchaindiary.org

Onchain Diary is an independent Web3 safety education site Visit our website👉: https://theonchaindiary.com/

7 followers 4 following35 posts

@onchaindiary.org

Electrum 4.8.3 fixes a live attack: a malicious server swaps your pending payment, waits for you to bump the fee, and you sign the thief's tx. One user lost money. The trick and what to check: https://theonchaindiary.com/articles/electrum-server-swapped-transaction-fee-bump/

theonchaindiary.comElectrum 4.8.3: Malicious Server Stole BTC on Fee BumpA malicious Electrum server replaced a pending payment with one paying itself. Version 4.8.3 now verifies signatures. Upgrade and verify addresses.

@onchaindiary.org

Keystone confirmed a third party took customer names, addresses and order details. No seed phrases, no card data. The wallet was fine. The address list wasn't. https://theonchaindiary.com/articles/keystone-customer-data-breach-shipping-addresses/

theonchaindiary.comKeystone Data Breach: Customer Addresses LeakedKeystone says a third party took names, addresses and order details after unauthorised access on Oct 20. No seed or card data. What to do now.

@onchaindiary.org

Updated our Ledger case file with clearer sourcing. Ledger confirmed an implant in one affected device. Bitquery estimated $102M across 335 wallets on six chains; Ledger has not confirmed the total or number of people affected. theonchaindiary.com/ledger-hack/

@onchaindiary.org

CoinDCX says a failed sweep of deposits to compromised old addresses caused losses it absorbed; it says affected users were credited. ZachXBT says the address still swept deposits in 2026. Chain flows alone don’t prove a new breach or user loss. x.com/CoinDCX/stat...

@onchaindiary.org

Correction: our Oct 20 post said $92K; it should be about $392K, based on the bot operator’s claim-time estimate. Full asset breakdown and transaction references: theonchaindiary.com/articles/sui...

@onchaindiary.org

A 'rescue' bot finalized the Cetus hacker's 17-month-old Sui Bridge claims and paid him 92K — then asked him for a tip. No bug: the vault paid the name on the message. Tether has now blacklisted the address, on-chain verified. https://theonchaindiary.com/articles/sui-bridge-claim-bot-cetus-hacker/

theonchaindiary.comSui Bridge Claim Bot Paid the Cetus Hacker $392KA rescue bot finalized the Cetus hacker's 17-month-old bridge claims and paid out $392K. Why dormant bridge claims are live liabilities for every chain.

@onchaindiary.org

A fake mining pool farmed 165 wallets for 1.54M USDC. Every victim signed the same 10M-USDC permit, valid to 2030, none revoked. Exits: Bitget vault 1.09M, deBridge to Tron 470K. Full autopsy: https://theonchaindiary.com/articles/fmmr-fake-mining-pool-scam/

theonchaindiary.comFMMR Mining Scam: A Fake Pool Farmed 165 Wallets for 1.54M USDC — and the Permits Are Still Live Until 2030 — Onchain DiaryA victim in China was groomed on Bilibili by a 'medical aesthetics professional' persona and led into a fake mining pool called Onchain at fmmrvip.click. His first 300 USDC deposit withdrew fine. Then three harvests in three weeks. On-chain forensics match

@onchaindiary.org

Correction (article updated): the Bitget-labeled address got ~400K USDC in plain transfers within this case's window — not 1.09M. The other 728K predates FMMR; the pipeline served earlier rounds. Pool still collecting: 540+ transfers, ~1.55M.

@onchaindiary.org

A fake mining pool farmed 165 wallets for 1.54M USDC. Every victim signed the same 10M-USDC permit, valid to 2030, none revoked. Exits: Bitget vault 1.09M, deBridge to Tron 470K. Full autopsy: https://theonchaindiary.com/articles/fmmr-fake-mining-pool-scam/

theonchaindiary.comFMMR Mining Scam: A Fake Pool Farmed 165 Wallets for 1.54M USDC — and the Permits Are Still Live Until 2030 — Onchain DiaryA victim in China was groomed on Bilibili by a 'medical aesthetics professional' persona and led into a fake mining pool called Onchain at fmmrvip.click. His first 300 USDC deposit withdrew fine. Then three harvests in three weeks. On-chain forensics match

@onchaindiary.org

The full fund-flow map: 165 victims → 15+ drainers → collection pool (1.54M) → treasury → three exits. Every number verifiable on Etherscan.

@onchaindiary.org

The Ledger hack wasn't a firmware flaw. The authorized reseller at the center was secretly acquired in March, then sold devices with implants that PASS the genuine check. A coordinated 2M–0M sweep followed. https://theonchaindiary.com/articles/ledger-cryptobilis-supply-chain-hack/

theonchaindiary.comThe Ledger–CryptoBilis Hack: How Buying a Trusted Reseller Became the Attack — Onchain DiaryAn authorized Ledger reseller was secretly acquired, its devices implanted, and an estimated $72M–$90M drained from buyers. The full timeline of a textbook supply-chain takeover.

@onchaindiary.org

The $86M 'Ledger hack' isn't a device breach. We traced all 10 flagged addresses: victims made plain transfers with zero contract calls, right after zero-value txs from lookalike vanity addresses. Address poisoning, not firmware. https://theonchaindiary.com/articles/ledger-drain-address-poisoning/

theonchaindiary.comThe $86M 'Ledger Hack': What the On-Chain Evidence Actually Shows — Onchain DiaryWe independently traced the 10 flagged theft addresses in the October 9 Ledger wallet-draining reports. Verifiable losses: ~$27M — and the transaction pattern points to address poisoning, not a device breach.

@onchaindiary.org

Update: Ledger named reseller CryptoBilis and halted its sales — CZ calls it a single-vendor supply-chain attack, likely tampered devices with preloaded seeds. Article updated with an honest recheck of our own read too. https://theonchaindiary.com/articles/ledger-drain-address-poisoning/

theonchaindiary.comThe $86M 'Ledger Hack': What the On-Chain Evidence Actually Shows — Onchain DiaryWe independently traced the 10 flagged theft addresses in the October 9 Ledger wallet-draining reports. Verifiable losses: ~$27M — and Ledger's own response now points to a tampered-device supply chain, not a firmware breach.

@onchaindiary.org

The $1.5B Bybit heist didn't start with a contract bug. It started with a fake recruiter message that infected a DevOps engineer's laptop months earlier. The full fake-job attack chain, plus red flags for Web3 job seekers. https://theonchaindiary.com/articles/fake-crypto-job-offer-scams/

theonchaindiary.comFake Crypto Job Offers Explained: The $1.5B Hack That Started With One Recruiter Message — Onchain DiaryHow fake crypto job offers work: the Bybit/Safe breach, malicious coding tests, and the red flags every Web3 job seeker should know.

@onchaindiary.org

Abstract (the Pudgy Penguins L2) shuts down Dec 15. Funds left after the deadline become inaccessible — no post-deadline path, unlike Blast. Exit runbook + fake-migration scam red flags: https://theonchaindiary.com/articles/abstract-chain-shutdown-migration-guide/

theonchaindiary.comAbstract Chain Is Shutting Down: Bridge Out Before December 15 or Lose Access — Onchain DiaryIgloo Inc., the parent of Pudgy Penguins, is shutting down its Abstract L2 on December 15, 2026. Funds not bridged out by then become inaccessible. Official exit routes, the fake-migration scam wave, and how this differs from Blast.

@onchaindiary.org

Blast L2 is shutting down — costs beat revenue. Oct 26 is the last day the normal withdrawal interface works; after that it's manual L1 bridge-contract exits. Withdrawal runbook + the phishing wave every shutdown attracts: https://theonchaindiary.com/articles/blast-l2-shutdown-withdrawal-guide/

theonchaindiary.comBlast L2 Is Shutting Down: How to Withdraw Safely Before October 26 — Onchain DiaryBlast announced on October 2, 2026 that it is winding down its Ethereum L2. Users have until October 26 to withdraw through the normal interface. Full timeline, the L1 bridge-contract path after the deadline, and the scam wave every shutdown attracts.

@onchaindiary.org

NEAR Intents lost $3.87M Oct 1 — no user signed anything wrong. The vault pays whoever holds a note signed by the service's backend; the bug sat in that bookkeeping layer. 76% was already Bitcoin by the time the team posted. https://theonchaindiary.com/articles/near-intents-hack-explained/

theonchaindiary.comNEAR Intents Hack Explained: How a Signed-Note Bug Drained $3.87M — Onchain DiaryNEAR Intents lost $3.87 million on October 1, 2026 when a bug in its Omni deposit-and-withdrawal system let an attacker withdraw funds with valid signed notes. Full timeline, where the money went, and why no user signature could have prevented it.

@onchaindiary.org

A real CAPTCHA never asks you to open Run or Terminal. The 2026 ClickFix campaign hid on 5,400+ hacked sites, pulled payloads from BSC testnet smart contracts, and stole crypto with commands victims pasted themselves. https://theonchaindiary.com/articles/clickfix-fake-captcha-scam-explained/

theonchaindiary.comClickFix Scam Explained: How a Fake CAPTCHA Drains Crypto Wallets — Onchain DiaryClickFix shows you a fake CAPTCHA, then talks you into pasting one command into Run or Terminal. Here is the full chain, the on-chain dead drop, and what it does to wallets.

@onchaindiary.org

NFTs sold out of hundreds of wallets for exactly 0 ETH today. The bug lived in a contract Magic Eden stopped using in Oct 2024. The marketplace died in March; the approvals never did. Inside the .7M whitehat evacuation. https://theonchaindiary.com/articles/magic-eden-payment-processor-exploit/

theonchaindiary.comMagic Eden Exploit Explained: A Dead Marketplace, Living Approvals, and a $5.7M Whitehat Rescue — Onchain DiaryNFTs left wallets for 0 ETH on September 25. The vulnerable contract was one Magic Eden stopped using in October 2024, but the approvals users gave it never expired.

@onchaindiary.org

Bitget lost $351.6M and not one private key was stolen. Attackers hit a wallet backend, spoofed the data inside it, and let the exchange's own signing process approve the transfers. Bybit pattern: keys safe, transactions not. https://theonchaindiary.com/articles/bitget-hot-wallet-hack-explained/

theonchaindiary.comBitget Hack Explained: $351M Moved Without a Single Private Key Stolen — Onchain DiaryBitget lost $351.6M when attackers spoofed transaction data inside its wallet backend. How the signing-layer attack worked, where the funds went, and what users should watch for.

@onchaindiary.org

Wallet drained? Drainer proceeds increasingly route through mixers, not exchanges. What still works: revoke live approvals, report same-day, treat every 'recovery expert' who DMs you as attack #2. https://theonchaindiary.com/articles/after-wallet-drainer-what-now/

@onchaindiary.org

FomoPeek passed App Store review as a read-only whale tracker. Inside: an iOS kernel exploit that decrypts the Keychain and steals keys from other apps. Domain Aug 28, live Sep 7, payload Sep 13, burned Sep 20. Our forensics: https://theonchaindiary.com/articles/fomopeek-app-malware-explained/

theonchaindiary.comFomoPeek Malware: How a Read-Only Whale Tracker Stole iOS Private Keys — Onchain DiaryFomoPeek passed App Store review as a read-only whale tracker, then shipped an iOS kernel exploit that decrypts the Keychain. Timeline, forensics, victim steps.

@onchaindiary.org

Update: the installs were bought. Mid-September promo posts show KOL invite codes + 5-USDT signup red packets - paid per-install acquisition for malware. Airdrop farmers lost whole wallets for a few dollars. https://theonchaindiary.com/articles/fomopeek-app-malware-explained/

theonchaindiary.comFomoPeek Malware: How a Read-Only Whale Tracker Stole iOS Private Keys — Onchain DiaryFomoPeek passed App Store review as a read-only whale tracker, then shipped an iOS kernel exploit that decrypts the Keychain. Timeline, forensics, victim steps.

@onchaindiary.org

A blind auction on Zcash cleared 12,000 ZEC for 8,000 pixel 'shielded identities.' What winners actually hold: a database claim — ZSA isn't on mainnet yet. And the 2 ZEC floor is unauditable by design. https://theonchaindiary.com/articles/zksnarks-auction-what-bidders-bought/

theonchaindiary.comzkSNARKs Auction Cleared 12,000 ZEC. Here Is What the Winners Actually Hold — Onchain DiaryZcash's zkSNARKs identity auction drew 16,971 bids and cleared at 1.5 ZEC; the secondary floor sits near 2 ZEC on Zilkroad. But with ZSA not on mainnet, ownership lives in a database — and the market data is unverifiable by design.

@onchaindiary.org

Shipped: Diary Key, a solve-to-mint NFT. Answer one question from my on-chain safety field reports, mint a key. 5,000 total, 3 per wallet, free (gas is cents on Arc). 256-cell hash grid, fully on-chain art, bronze to diamond. I minted #1. Bronze. Great. https://puzzle.onchaindiary.org

@onchaindiary.org

Collection on OpenSea: https://opensea.io/collection/diary-key-252580595

opensea.ioDiary Key - Collection | OpenSea

@onchaindiary.org

ZEC is top-10 and new holders are learning that Zcash cold storage is not Bitcoin cold storage. Trezor officially does not support shielded addresses at all. Three setups that actually work: https://theonchaindiary.com/articles/zcash-cold-storage-guide/

theonchaindiary.comZcash Cold Storage: How to Store ZEC Offline in 2026 — Onchain DiaryZEC holders moving funds off exchanges face a fork in the road: transparent addresses work on any hardware wallet, shielded addresses mostly don't. What Trezor and Ledger actually support, three working cold-storage setups, and the scams targeting new Zcas

@onchaindiary.org

Polygon isn't 'part of Ethereum' — it runs its own validators, and QuickSwap vets nothing. The six checks that work on every EVM chain, with the 2021 Poly Network exploit as the standing lesson. https://theonchaindiary.com/articles/polygon-token-safety/

theonchaindiary.comPolygon Token Safety: How to Avoid Scams on the MATIC Chain — Onchain DiaryPolygon's low fees and Ethereum association attract legitimate DeFi and every clone-token scam that follows. The exact steps to verify any Polygon token before you buy.

@onchaindiary.org

SQUID ran on BNB Chain: buyers could buy, nobody could sell, over $3.3M walked out the door in 2021. The pattern never retired. Six checks before touching any BEP-20 token. https://theonchaindiary.com/articles/bnb-chain-token-safety/

theonchaindiary.comBNB Chain Token Safety: How to Avoid Scams on Binance's Chain — Onchain DiaryThe SQUID token let people buy but never sell, and it ran on BNB Chain. Learn the specific scam patterns on BSC and the exact steps to verify any BEP-20 token before you buy.

@onchaindiary.org

ZecBit charged for a testnet-only NFT and ended with a public 0.1 ZEC complaint. zaddr.net is free and asks for a read-only X login and a shielded address. The free one collects something too: an identity-to-address map. https://theonchaindiary.com/articles/zcash-whitelist-what-you-hand-over/

theonchaindiary.comZcash Whitelist Season: One Takes Your ZEC, One Takes Your Identity Map — Onchain DiaryZecBit charged for a testnet NFT and left a 0.1 ZEC complaint in its wake. zaddr.net is free and asks for almost nothing. The second one is the more interesting case. Here is what each model actually collects.

@onchaindiary.org

One hour into Arc mainnet: two contracts named SCOUT born 35 min apart, two COCOAs, a token up 6,475%, and fake 'ARC airdrop' pages live before any official token exists. Day-one chain data + the real USDC contract to verify. https://theonchaindiary.com/articles/arc-mainnet-day-one-risks/

theonchaindiary.comArc Mainnet Day-One Risks: Copycat Tokens and Fake Airdrops in the First Hours — Onchain DiaryArc, Circle's stablecoin L1, is live. One hour of on-chain data already shows duplicate-ticker copycats, +6,475% pumps, and fake-airdrop warnings. A field guide with real numbers.

@onchaindiary.org

A real Telegram pitch, dissected: 'launching tonight at 19:00 on Sushi, Base.' We read the scammer's script back to him — he spotted it instantly, then pitched his own anyway. Six beats, one table, a one-line honeypot test. https://theonchaindiary.com/articles/telegram-crypto-pitch-script/

theonchaindiary.comThe Telegram Crypto Pitch, Read Back to the Scammer: A Real Chat, Dissected Line by Line — Onchain DiaryA real Telegram solicitation captured this week: a stranger pitching a token 'launching tonight at 19:00 on Sushi, Base.' We annotate every beat of the script — and what happened when we pitched the same script back at him.

@onchaindiary.org

"Share your public key so we can verify your wallet." No legitimate service needs this — the request is a fishing trip for your seed phrase. New: the 3 wallet strings, and the scam attached to each layer of confusion: https://theonchaindiary.com/articles/public-key-private-key-wallet-address/

theonchaindiary.comPublic Key vs Private Key vs Wallet Address: The Difference Scammers Hope You Never Learn — Onchain DiaryEvery wallet scam that has ever worked relies on one thing: the victim not knowing which of the three wallet strings does what. The one-way chain from seed phrase to private key to public key to address, what leaking each one actually costs you, and the fo

@onchaindiary.org

Ask ChatGPT to pick 12 seed-phrase words and your wallet reportedly gets drained within minutes — bots watch the handful of phrases AI tends to output. Online generators are worse. The real safety ladder: https://theonchaindiary.com/articles/seed-phrase-generator-risk/

theonchaindiary.comWhy You Should Never Generate a Seed Phrase Online — Onchain DiaryOnline seed phrase generators are one of two things: a phishing tool that logs or pre-loads the phrase it hands you, or a negligent service that produces unauditable randomness over an untrusted channel. How legitimate wallets generate phrases on-device, w

@onchaindiary.org

Hello, bluesky!

You are up to date.