Case: Crypto Asset Recovery — recovering stolen funds for a phishing victim (DeFi)
Incident: the user signed a malicious permit signature on a phishing site (a Uniswap clone). Tokens were moved: USDT → Uniswap V3 (USDC) → Curve (3pool) → Wormhole Bridge (Ethereum → Solana) → Jupiter Aggregator (SOL) → Binance deposit.
AgentD22 Data solutions Crypto Recovery methods:
- Real-time tracing: mempool monitoring, alert on the first swap (Uniswap V3, block 19,847,231)
- Cross-chain tracking: Ethereum → Solana via Wormhole (attestation verification)
- DEX analytics: pool interaction mapping, slippage analysis, MEV bot detection
- CEX coordination: Binance KYC/AML team — freeze request under the travel rule
- Legal: police reports prepared (UK, Singapore), court order for disclosure
Outcome:
- Frozen at Binance: 620K USDT (73% of the amount) — within 4 hours of the incident
- The remaining 230K USDT: partly on DEXs (not recoverable without a CEX off-ramp), partly in SOL on a small wallet
- The victim received 620K USDT back under a court order (Singapore High Court, 3 weeks)
- IOCs shared with Chainalysis, TRM and CERT — attribution: North Korea Lazarus Group (typical: permit phishing plus cross-chain laundering)
← Back to news