Meet the Blockchain Sleuths who are hunting down fraudsters. Whether tracking activities on-chain, across social media platforms, or via scammer’s private telegram groups, these sleuths work around the clock and out of the limelight.
By now, almost everyone in the crypto sphere is aware of names like ZachXBT, Certik, & Chainalysis - but the world of blockchain investigations is a vast network of incredibly skilled and clever technical professionals. I sat down and interviewed some of the sleuths who seek to add consequences to those who harm and scam others in the space.
Spreekaway ( Twitter )
Meet Spreekaway, an independent researcher and consultant whose Twitter account is a gold mine for anyone interested in near-real-time updates on some of the most notorious on-chain events. Spreek, as he is known by most, also provides written analysis on many of the current events circling the regulatory aspect of the industry.
Q: How did you get into on-chain investigations?
A: I first caught the crypto bug in 2016 (primarily for playing online poker). I really got deep into crypto in 2019 with the emergence of DeFi [Decentralized Finance] and have been hooked ever since. I quit my PhD program to focus full-time on crypto work in 2021 (you're welcome for causing the bear market). My background is more on the math side than any kind of development work.
I've long been fascinated by the wealth of data available on-chain and the various drama and intrigue that often results from such access. As part of my work with various DeFi protocols and funds, I had to keep a close eye on major news, including hacks and exploits. So it was a natural extension to start some of my own work detecting and investigating them (along with some friends).
My security research is mostly done as a hobby and to benefit the industry/protect people from losses, although I get the occasional trading alpha or bug bounty out of it.
Q: What kind of work do you currently do?
A: Most of what I do in the field centers around the detection of DeFi and smart contract exploits that are imminent/in progress/completed as well as various other kinds of notable/suspicious on-chain activity. As I mentioned above, the beauty (and also [the] biggest challenge) of blockchain data is that you almost have information overload (rather than the opacity typically found in a lot of finance or infosec fields). So most of the job in terms of detection is actually filtering down the immense number of transactions/activity to something manageable to look into manually.
What are you looking for when conducting your detection & investigations?
A: Some examples of the sorts of things I look for are large TVL [Total Value Locked, a Defi term for the amount of money locked in a specific protocol] changes in contracts, high gas fees/bribes paid, generalized frontrunning, accounts funded from suspicious sources (especially those that also deploy contracts), large trades/price changes. Automated tools help a lot with keeping track of this, but it is also helpful to have a network of people on Twitter and in chat groups that also have an eye out for interesting or unusual activity on-chain.
Q: What do you do once something catches your eye?
A: After I find something interesting, I typically like to use some combination of Etherscan, Oko Smart Contract Explorer, OpenChain, and Tenderly to look into it further. The exact kinds of steps I take vary case by case, but for contract deployments, it's often looking into the decompile [“Decompiling” a smart contract is a strategy used to make the unverified smart contract more readable by humans] to see if it pattern matches to the sort of thing that typically is a successful exploit or if it is more likely to be a false positive (e.g. MEV, new protocol deployment, testing, incompetent hack attempt, etc.). [As is the case in web2 programming, similar code is used to perform similar tasks, so investigators like Spreek keep track of patterns in code and use that to ascertain the kinds of actions a contract can take.] If it is a transaction that already went through, I'm usually trying to figure out exactly what they did and who, if anyone, lost money as a result.
Depending on what I find from looking into the activity, I usually do some combination of reaching out to the project(s) team, post on Twitter, or move on (if the transaction is ultimately harmless or too mundane to report on).
Q: Looking back on your experience, what would you consider your most significant contributions or achievements?
A: The work I am most proud of is the various hacks and exploits that I or friends I work with were able to stop before they took place. There's something very “Minority Report”-esque about it and always a very satisfying experience.
I am also proud of being the one to break news of a great many exploits publically. For example, [during] the Nomad Bridge Hack of August 2022 I was able to notice and tweet about a mere 5 minutes after it happened. Of course, I would always prefer to stop an exploit before it happens, but I also generally feel it is strongly in the public interest to find out about a loss as quickly as possible.
Q: What do you think the security community / crypto community needs to keep in mind?
A: First of all, it is very clear that the number of large hacks is completely unacceptable and we need to do better at safeguarding our users' assets. Second, I think one of the clear takeaways is that writing secure on-chain code is extremely difficult and devs should assume that even their carefully checked and audited code will likely have bugs or unintended behavior included. It is thus very important to design systems that are more robust to things going wrong. @brockjeckelmore had a great article a few months back discussing one way to do this.
As for the cat-and-mouse game between nefarious actors and the people trying to detect and stop them, it seems that it is a battle the whitehats are destined to lose in the long run (absent changes to the chain itself a la the circuit breaker EIP) [EIP is the term for proposals (Ethereum Improvement Proposals) that set the standard for the Ethereum chain] as exploiters become more sophisticated and more aware that many security researchers and MEV people are watching everything they do on chain. But in the meantime, it's always great when we are able to stop or recover funds.
—-------------------
Intelligence On Chain ( Twitter )
Meet Intell, an investigator and educator who uses their experience to help facilitate recovery of funds, post mortems on attacks, and more. Intell has a history of incredibly thorough research using a variety of tools to get to the bottom of an incident. Read on to find out more about this savvy sleuth.
Q: How did you get into on-chain investigations?
A: Outside of Crypto, I've done a lot of work helping the communities around me. From a young age, I've always found satisfaction in helping people. I also come from an engineering background and I'm a really proficient problem solver. Sleuthing reminds me a lot of reading electrical diagrams... Especially on the blockchain. I got into crypto two years ago and fell down that DeFi rabbit hole very quickly! Scams, Fraud, and Ponzis were everywhere! I soon realised (I'm British - correct spelling 😂) that people just didn't understand how to spot red flags in protocols... Just simple ones like, owners having the ability to withdraw funds from contracts, for example.
I started out researching protocols and giving out my findings to community members. Then, when rug pulls happened, I was curious... So I started sleuthing (manually at first, no tools besides a blockchain scanner). As time went on, my skills became better and I started to help people. Over time, I became more aware of the impact of my work (both good and bad), the tools improved and I started to add OSInt [OSInt is the term used to describe Open Source Intelligence, meaning information publicly available on the internet] into my work!
Q: What kind of work do you currently do?
A: Today, I'm involved in around 4-5 concurrent cases but my biggest one at the moment is the Beanstalk exploit from 2022, where the exploiter walked away with close to 25k ETH or $75M. I can't go into specifics but essentially, I'm up against Tornado Cash [Tornado Cash is a financial privacy tool intended to keep the source of funds private. TC was sanctioned by the US Government in 2022 and is currently not legal to use], which is not as daunting as you might think. Yes, we've been through more than 3,000 wallets but we're looking for behaviours. This by far is the biggest challenge we've had but it's fair to say that I know what every single wallet did, exiting the 100 ETH TC contract between April '22 and April' 23!
Q: What tools do you find yourself using frequently?
A: On a day-to-day basis, I find myself using Metasleuth, Breadcrumbs (premium), Debank, all of the blockchain explorers, Arkham Intelligence, and a huge suite of OSInt tools... Including Twitter 📷📷
Q: What are you most excited about in this field? Is there anything you want to warn people about?
A: I'm really looking forward to seeing MEM Pool [The MEM pool is a public list of pending transactions waiting to be confirmed on-chain. MEM pool bots attempt to execute these pending transactions before their intended signer, creating “front-run” transactions.] bots battling it out, to prevent exploits. We're seeing some people do that already like BlockSec! Really exciting! Overall, I believe that too many scammers are getting away with their malicious actions, without consequence, whilst literally destroying people to the point where they're considering ending their life! That sounds horrible but it is true. The things that victims go through are terrible and no-one hears it! So I'm here to take a stand.🕵🏻♂️
—-------------------
—-------------------
Nick Bax ( Twitter )
Meet Nick, a self-titled Shadowy Super Coder with a Structural Biology PhD background leveraging his wits to conduct on-chain analytics at scale. Having worked for various on-chain analytics companies as well as having his own consulting practice, Nick is well-versed in all things data, analytics, and on-chain chaos. You might find Nick tagged in ZachXBT’s posts often, as the duo tends to work together on breaking news events.
Q: Tell us a little about yourself - what’s your role in sleuthing?
A: I wear a few different hats. I have my own blockchain consulting practice which gives me opportunities to research the sleuthing process. I also just started a new role as the Director of Analytics at Unciphered, a wallet recovery service. People come to me when they need custom blockchain analysis done – stuff that can’t be accomplished with commercially available software and tools.
Q: How did you get into on-chain investigations / get into your current role?
A: I started sleuthing as soon as I got into Bitcoin but began taking it more seriously in 2017 after I got sim swapped and lost a little bit of money. Then I met some other people who got sim swapped and lost larger amounts of money and I realized that there wasn’t much that normal people could do if their crypto got stolen – so I started helping them out. A lot of people focus on the biggest hacks. Focusing on smaller hacks has allowed me to see emerging patterns and methods used by criminals before they are used more widely. This gave me some unique insights that paid off down the road. I got into this while I was working on my PhD in structural biology. So my experience was all in scientific research. I’ve found out there’s quite a bit of overlap in the skill set needed, though.
Q: What kind of work do you currently do?
A: I’m working on a few separate projects. I’m doing consulting and expert witness work for a few court cases. At Unciphered, I’m building tools to help the team automate routine analysis and expand our capabilities. I’m also working on designing infrastructure for what I hope will be the next generation of on-chain privacy tools.
Q: What does that look like?
A: People who are involved in cryptocurrency-related legal disputes share the details with me, as well as any questions they need answered. Then I take a look and use whatever tools are necessary to find the answers. Normally I put this into a report or a PowerPoint, and if needed I can also testify on the details in court.
At Unciphered, I’m beginning by understanding the team’s process and capabilities. Then finding ways to improve, scale, and automate what the team is doing.
For the privacy protocol, we’re talking to all of the stakeholders involved – potential users, partners, exchanges, and regulators, and making sure that we understand stakeholders’ needs and designing our protocol around that.
Q: How does your work contribute to securing the space?
A: My research began trying to answer one set of questions: “How do I find out who stole my crypto and what should I do once I know?” This gave me the opportunity to help some people get their crypto back (and conversely also help some people who have been wrongly accused).
After a few years, I started learning that the more important question to ask is “How can we, as an industry, prevent more thefts?” So that’s my focus now.
Q: What are the most common scams / thefts you see?
A: Wallet drainer phishing seems to be the most common. Aside from that, it’s a mix of everything from rug pulls to pig butchering scams to flash loan hacks.
Q: Are there any platforms or resources you find indispensable?
A: Etherscan and other block explorers really do most of the heavy lifting. Chainalysis Reactor. Dune Analytics. Infura for getting raw blockchain data. Cielo.Finance for getting notified when funds move. BlockSci [A now deprecated Bitcoin analysis tool built by graduate students at Princeton University] when I have more complicated Bitcoin projects. I also code a lot of custom tools in Python. Social media for getting an idea of what other sleuths are looking at. Those are the big ones. I have a solid network of colleagues that I can ask questions or even just share memes. It makes my job much easier and more fun.
Q: Looking back on your experience, what would you consider your most significant contributions?
A: I’ve helped with a few big thefts but those are all still playing out. I think I was the first person to publicly describe tracing Monero related to a real theft, which I’m quite proud of.
Q: Is there a particular investigation that stands out to you?
A: The Electrum Atom malware investigation was a big one that I’m able to talk about publicly.
My role in that investigation began almost 4 years ago and the case still isn’t resolved. But I learned a lot about how to make Monero tracing more effective and also learned a lot about what it takes for a normal person to actually recover stolen crypto.
—-------------------
Thanks to: Spreekaway, Intell_On_Chain, & Nick Bax for the interviews. Cipher0091 for help with research.