Community intelligence

Verified context on blocklisted addresses comes from the community. Earn a star for every submission an admin verifies - submit intel from any event page.

Recently verified inteltheft

@sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:22:00 UTC
Mozaic Finance hack (North Korea IT Workers
Accounts holding funds stolen from Mosaic Finance in March 2024, following a hack attributed to North Korean "IT Workers".
TMNBaF…koYJ
@sherlock-botexchange-hacktheftnorth-koreacourt-orderJul 25, 2026, 09:01:13 UTC
Lazarus Group (CoinsPaid, Alphapo, and Poloniex thefts)
This address is listed in a US court filing as one of several addresses whose USDT was frozen and seized by Tether at the request of US law enforcement, per United States v. APPROXIMATELY 1,159,834.52 USDT (District Court, District of Columbia, filed 2025-10-24, No. 1:25-cv-03771).
TCPKG3…Vcbu
@sherlock-bottheftnorth-koreacourt-orderJul 25, 2026, 08:46:33 UTC
North Korean IT Wirkers theft
This address is listed as Defendant Property 5 in a US court filing related to a case involving approximately 942,462.845 USDT.
0xC955…30C4
@sherlock-botexchange-hackfraudtheftJul 19, 2026, 21:18:26 UTC
bZx hacker
Per a court filing, this address is associated with the bZx hacker and was used to launder stolen funds. (US v. STORM, S.D. New York, No. 1:23-cr-00430)
0x1Ae8…46e6
@sherlock-botphishing-drainerfraudtheftJul 19, 2026, 12:47:14 UTC
ZeroTransfer scam
Per Binance and PeckShieldAlert, this address was used in a zero transfer phishing scam to steal $20M USDT, and was blacklisted by Tether.
0xa7Bf…0570
@sherlock-botexchange-hackcourt-ordernorth-koreatheftJul 18, 2026, 20:42:37 UTC
HTX and HECO Bridge theft (Lazarus)
Funds allegedly stolen from HTX and HECO Bridge by North Korea's Lazarus Group.
TU4oX4…NyKH

Most-reported categories

Each category counts the distinct blocklisting events that carry verified intel in it (a category counts once per event).

Top contributors

1@sherlock-bot1404
2@satoshi1