This EVM (Ethereum, BNB Chain, Base and other EVM chains) address was named in 4 public crypto scam reports: Hack, Phishing. First reported 2026-04-22. Last updated 2026-10-16.
Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
Reported: 2026-10-14
Last updated: 2026-10-16
Wintermute incident as documented by rekt.news (https://rekt.news/wintermute-rekt-2). Incident date per rekt.news: 09/20/2022. Amount lost per rekt.news leaderboard: $162,300,000 (USD at time of incident). Addresses below are those the rekt.news article itself labels as attacker/exploiter/hacker addresses or attacker contracts (linked to block explorers), copied verbatim from the article: - 0xe74b28c2eAe8679e3cCc3a94d5d0dE83CCB84705 (Ethereum; explorer link in article: https://etherscan.io/address/0xe74b28c2eAe8679e3cCc3a94d5d0dE83CCB84705) — article context: "Hacker’s address:…
Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
Reported: 2026-04-27
Last updated: 2026-04-27
DeFi Exploit: Wintermute - REKT 2 Date: 09/20/2022 Loss: $162,300,000 USD Tags: Wintermute, Profanity, REKT Summary: Wintermute have lost over $160M to their second incident this summer. Using a vanity address for "gas savings" has cost them dearly. Last time, funds were returned, will Wintermute get lucky again? Exploit/attacker addresses extracted from on-chain analysis and incident reports. Reference: https://rekt.news/wintermute-rekt-2 Source: https://de.fi/rekt-database
Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
Reported: 2026-04-24
Last updated: 2026-04-24
Ethereum address '0xe74b28c2eae8679e3ccc3a94d5d0de83ccb84705' is labelled by Etherscan community as 'Wintermute Exploiter'. Flagged in the Etherscan phish/hack reporting system. Source: Forta Network labelled-datasets, Etherscan phish-hack-list.
Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
Reported: 2026-04-22
Last updated: 2026-04-22
Ethereum address belonging to the attacker who exploited Wintermute (2). Total stolen: $162,300,000 USD. Source: rekt.news (https://rekt.news/wintermute-rekt-2). This address was used to receive or launder stolen funds from the Wintermute (2) protocol exploit.