ACT-2215
ConfirmedRecurring · 3 hitsOne actor behind 3 incidents, linked by wallet. Fingerprinted to Qwen.
Identity & linking
Wallet0xa10bdacf…4f
Model familyQwen
Linked byWallet
SurfacesOPTIMISM · ETHEREUM · POLYGON
First seen19 Sept 2026, 23:52
Last seen17 Oct 2026, 06:37
Home regionIreland, EU
Recommended action
Block this wallet in your contract allowlist.
Model fingerprint
unclassifiedMost likely model
Unknown
Confidence
—
Claude
35%
Llama
27%
Mistral
22%
Qwen
15%
GPT
1%
Behaviour leans Claude but isn't separable yet (4 signals). Needs a longer correlated trail.
Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 4 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).
Where this actor struck
ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.
Attack trail — 3 incidents
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.
Tailored to you
Track actors like this against your own assets.
Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.