AMLBot News

🆕 AMLBot KYT Now Supports Hyperliquid Monitoring

Hyperliquid is one of the fastest-growing decentralized trading environments — processing billions in daily trading volume.

But there’s an important architectural nuance.
Most tools monitor HyperEVM (the application layer).

⚡We indexes HyperCore. the settlement layer where value transfer occurs, and monitors the Arbitrum bridge used to move USDC in and out of the ecosystem.

❗For compliance teams this means visibility into:
— Deposits Entering Hyperliquid
— Internal Value Transfers
— Dithdrawals Back to Arbitrum

Request Access to Hypertliquid KYT Monitoring: https://hubs.li/Q045LVXs0

⚡Aperture Finance Exploit: Traced On-chain

Two protocols were compromised through unlimited token approvals. Only Aperture Finance publicly acknowledged the issue and initiated on-chain communication with the attacker.

❗On-chain tracing shows ~$13M in stolen assets. About $3M in USDC remains untouched, while other assets were swapped into ETH — with ~540 ETH still sitting at the original address.

Funds followed a standard cross-chain laundering path via Relay and Superbridge. We completed full cross-chain tracing, including post-bridge dispersion on Ethereum. These wallets are currently dormant.

👉A second exploiter was identified. One address — originally funded via Tornado Cash, using the same infinite-approval vulnerability hours after the initial exploit.

Most funds remain traceable and inactive.

📌A Case Study On Trust

Trove Markets entered the market with an ambitious RWA narrative and raised ~$11.5M via ICO. Days before completion, the team abruptly abandoned its original HyperEVM roadmap and announced a migration to Solana.

❗The result was a ~98% price collapse.

On-chain data shows ICO funds consolidated under team-controlled wallets, with a portion already moved to centralized exchanges.

At the same time, undisclosed influencer promotions, shifting timelines, and anonymous governance amplified market concern.

Check the slides for case details 👆

Channel photo updated

WE ANALYZED 2,500+ REAL CASES FROM POST-INCIDENT CRYPTO INVESTIGATIONS. HERE’S WHAT WE LEARNED 👇🏻

This report is built ENTIRELY on our own investigation practice in 2025 — real cases we handled after the incident had already occurred. We translated this hands-on investigative work into numbers, not to retell how attacks happen, but to answer the harder questions:

• what actually happens after the attack is discovered?
• which attack types look “minor” by frequency but drive the largest financial damage in practice?
• when does freezing actually work, and when is it already too late to matter?
• why do many “technical” incidents turn out to be human or operational failures upstream?
• why do low-frequency events (CEX Breaches, Access Compromise) dominate total losses despite being rare?

👉 Get Early Access to the Full Report