ACT-2242

SuspectedRecurring · 2 hits

One actor behind 2 incidents, linked by wallet. Fingerprinted to Unknown.

Identity & linking

Wallet0x07e1a020…41

Model familyUnknown

Linked byWallet

SurfacesDecoy MCP · BASE

First seen18 Sept 2026, 06:56

Last seen20 Oct 2026, 01:17

Home regionIreland, EU

Recommended action

Block this wallet in your contract allowlist.

Model fingerprint

unclassified

Most likely model

Unknown

Confidence

—

Claude

37%

Llama

28%

Mistral

24%

Qwen

10%

GPT

Behaviour leans Claude but isn't separable yet (3 signals). Needs a longer correlated trail.

Fingerprinted from behaviour against bait — which lures it takes and whether it probes first — scored against measured per-model profiles. Signal: 3 steps. A single sighting rarely separates models; confidence rises as a correlated actor builds a multi-step trail (research: ~59% from 3 steps, ~85% over a whole run).

Where this actor struck

ConfirmedSuspectedWatchCoarse infrastructure regions — never IP addresses.

Attack trail — 2 incidents

NRS-4093Watch· On-chain bait · BASE · 20 Oct 2026, 01:17
Wallet drained a decoy vault that pays only dust, then followed the breadcrumb trail to further bait.
NRS-4094Suspected· Decoy MCP · 18 Sept 2026, 06:56
Agent called a planted decoy MCP tool advertising privileged access and tried to escalate.

Tailored to you

Track actors like this against your own assets.

Pro links incidents on your watchlist into actors automatically — so you see the campaign, not just scattered alerts — and tells you what to block.

See Pro Talk to us