norosha
All actors

ACT-2236

ConfirmedRecurring · 6 hits

One actor behind 6 incidents, linked by wallet. Fingerprinted to Claude.

Identity & linking

Wallet0x96cee6b7…e8
Model familyClaude
Linked byWallet
SurfacesBNB · Decoy MCP · OPTIMISM · BASE
First seen13 Oct 2026, 09:09
Last seen28 Oct 2026, 10:24
Home regionN. Virginia, US
Recommended action

Block this wallet in your contract allowlist.

Model fingerprint

tentative
Most likely model
Claude
Confidence
44%
Claude
44%
Llama
23%
Mistral
21%
Qwen
11%
GPT
1%

Leaning Claude (44%); more sightings would confirm.

Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 7 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).
Where this actor struck
ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.

Attack trail — 6 incidents

  1. NRS-4069Watch· On-chain bait · BASE · 28 Oct 2026, 10:24

    Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.

  2. NRS-4068Watch· On-chain bait · OPTIMISM · 25 Oct 2026, 05:01

    Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.

  3. NRS-4067Confirmed· On-chain bait · OPTIMISM · 24 Oct 2026, 19:38

    Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.

  4. NRS-4065Watch· Decoy MCP · 19 Oct 2026, 23:46

    Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.

  5. NRS-4066Watch· On-chain bait · BNB · 16 Oct 2026, 14:44

    Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.

  6. NRS-4064Suspected· On-chain bait · BNB · 13 Oct 2026, 09:09

    Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.

Tailored to you

Track actors like this against your own assets.

Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.

See Pro Talk to us