ACT-2228

ConfirmedRecurring · 5 hits

One actor behind 5 incidents, linked by wallet. Fingerprinted to DeepSeek.

Identity & linking

Wallet0xe3491a45…ae

Model familyDeepSeek

Linked byWallet

SurfacesOPTIMISM · BNB · ETHEREUM · Decoy MCP

First seen9 Sept 2026, 12:13

Last seen5 Nov 2026, 22:47

Home regionOregon, US

Recommended action

Revoke the tool token this agent presented.

Model fingerprint

tentative

Most likely model

Claude

Confidence

46%

Claude

46%

Llama

24%

Mistral

22%

Qwen

GPT

Leaning Claude (46%); more sightings would confirm.

Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 6 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).

Where this actor struck

ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.

Attack trail — 5 incidents

NRS-4047Confirmed· Decoy MCP · 5 Nov 2026, 22:47
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.
NRS-4045Suspected· Decoy MCP · 31 Oct 2026, 21:00
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.
NRS-4048Watch· On-chain bait · ETHEREUM · 15 Oct 2026, 07:06
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.
NRS-4046Suspected· On-chain bait · BNB · 22 Sept 2026, 03:48
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.
NRS-4044Watch· On-chain bait · OPTIMISM · 9 Sept 2026, 12:13
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.

Tailored to you

Track actors like this against your own assets.

Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.

See Pro Talk to us