RAIN Token Hit $9 Billion. Its Protocol Earned $21 in 30 Days.
RAIN sits among the fifteen largest cryptocurrencies at a $9.2 billion market cap, yet DefiLlama logs $21 in protocol fees over the past 30 days.
RAIN sits among the fifteen largest cryptocurrencies at a $9.2 billion market cap, yet DefiLlama logs $21 in protocol fees over the past 30 days.
SKYAI fell 46% in a day, but on-chain analysts saw it coming: nearly all its supply sits in linked wallets, and four AI tokens already crashed.
ZachXBT alleges insiders controlling 90% of supply engineered a short squeeze that caused $44 million in liquidations. RAVE has dropped over 50% from its $27 peak.
On April 29, Vitalik Buterin offloaded 40 million ASTEROID OG tokens that had been sent to his wallet without permission. The token went up 120% after the sale. The pattern that used to crash memecoins is now powering them.
Pump.fun burned roughly $370 million worth of PUMP tokens on April 29, cutting circulating supply by 36% in a single day. Half of all platform revenue is now routed into a 12-month smart contract that buys back and burns more PUMP automatically. The team can no longer reverse it.
ZachXBT flagged six attacker wallets funded through Tornado Cash. A minting flaw in KelpDAO's rsETH token left Aave V3 holding bad debt, sending the AAVE token down 10-13%.
The onchain investigator who exposed RAVE's collapse is now questioning MemeCore's $6 billion valuation. Bubblemaps data shows heavy wallet concentration, and ZachXBT claims insiders control over 90% of the M token supply.
The attacker funded the node through Monero and Hyperliquid weeks before the theft. Chainalysis mapped the entire trail. THORChain paused all trading.
A compromised private key let an attacker automate withdrawals from Polymarket's UMA CTF Adapter on Polygon. ZachXBT flagged it first. Losses passed $700,000 before the team responded. Polymarket says user funds are safe. The attacker has already split the proceeds across 15 wallets.
A pre-signed transaction feature designed for convenience became the entry point for the largest DeFi hack of 2026. Elliptic has flagged North Korean state actors. Circle faces fresh scrutiny.
A researcher says over 40 DeFi platforms have employed DPRK state-linked developers. Their seven years of blockchain experience is, as she notes, not a lie. The Drift Protocol exploit was not a code bug. It was a six-month intelligence operation conducted by a North Korean state-affiliated group that attended conferences, deposited real capital, and waited.
The same investigator who crashed RAVE is now offering $10,000 bounties for LAB market-making contracts. The founders ran a token that dropped 93% before this one.
RAVE, SIREN, LAB, RIVER, SKYAI, and MYX all pumped on the same pattern: low float, insider supply, Bitget deposits, then crash. ZachXBT and BubbleMaps traced the connections.
StablR's EURR and USDR lost their pegs on Sunday after an attacker compromised a single private key in a 1-of-3 multisig, minted 8.35 million unbacked USDR and 4.5 million EURR, and dumped them for 1,115 ETH. The stablecoin issuer holds a Malta EMI license and operates under MiCA. Regulation did not stop a key management failure.
The $150 million recovery plan will fund user reimbursements as Drift relaunches with USDt as its settlement asset. Circle faced heavy criticism for not freezing $232 million in USDC that the North Korea-linked attacker moved through its own bridge.
Investors allege Circle let $230 million in stolen USDC cross from Solana to Ethereum without intervention. The lawsuit lands as Tether steps in with a $127.5 million recovery package.
ZachXBT is the pseudonymous on-chain investigator who exposes hacks, scams, and exploits by following the money across blockchains. This tag tracks his investigations into stolen funds, wallet drainers, and North Korean laundering, the exchanges and mixers he flags, and the recoveries his work triggers. Coinliva covers the investigations, the traced flows, and ZachXBT’s role as crypto’s de facto detective.