37 load-bearing claims, each set next to the public artifact that checks it:
on-chain transactions anyone can open in a block explorer, court filings, regulator
reports, published investigations. Nothing here asks to be believed.
Каждое утверждение книги — рядом с публичным артефактом, по которому его можно проверить.
Кожне твердження книжки — поруч із публічним артефактом, за яким його можна перевірити.
Chapter 1 — The Phone Call
4,064.38 BTC (~$238M of the ~$243M total) left the victim's wallet in a single transaction on 2024-08-19 (block 857425, 04:05:26 UTC)
450,000+ wallets carried active malicious EIP-7702 delegations, dominated by the ~120-byte CrimeEnjoyor sweeper bytecode family
published investigationDEV Community: The CrimeEnjoyor Epidemic — How EIP-7702 Delegation Phishing Drained 450K+ Wallets (2025); Wintermute analysis of 2025-06-02 via CoinDesk
QuadrigaCX owed customers ~$190-215M (~26,500 BTC, 430,000 ETH, 200,000 LTC) when it announced Cotten's death and suspended withdrawals on 2019-01-14
court filingErnst & Young QuadrigaCX CCAA Monitor Reports (First through Fifth, 2019-2020), Nova Scotia Supreme Court CCAA proceedings
Ernst & Young (court-appointed monitor) — public record: EY Canada QuadrigaCX monitor-report archive; CCAA court file, Nova Scotia Supreme Court (2019)
EY located ~104 BTC in QuadrigaCX cold storage against ~26,500 BTC owed; customer deposits had been commingled and spent by the operator for years
The QuadrigaCX collapse drove the Canadian regulatory response requiring crypto exchanges to register and submit to custody audits
regulatorCSA Staff Notice 21-327 (2020)
Canadian Securities Administrators — public record: securities-administrators.ca, Staff Notice 21-327
Chapter 6 — Move It Somewhere Safe
Ronald Spektor was charged on 2025-12-19 on a 31-count indictment for stealing ~$16M from ~100 users nationwide by impersonating a crypto-exchange representative
court filingBrooklyn DA press release: Brooklyn Man Charged with Stealing Nearly $16 Million by Presenting Himself as Cryptocurrency Exchange Rep and Scamming Users (2025-12-19)
Android's allowBackup manifest attribute defaults to true; wallet apps that never opted out silently shipped their vaults to users' Google Drive
published investigationAndroid Developer Documentation, android:allowBackup manifest attribute; MetaMask and Trust Wallet Android manifests set allowBackup=false post-April 2022
Google Android Developers / wallet-app manifests — public record: developer.android.com manifest application-element docs; APK manifests are publicly inspectable
Chapter 8 — The Oldest Trick
98.6% of ~7M Pump.fun-deployed tokens (Jan 2024 through early 2025) ended in pump-and-dump or rug-pull outcomes; only ~97,000 kept at least $1,000 in liquidity
published investigationSolidus Labs 2025 Rug Pull Report
A federal RICO class action (filed Feb 2025, amended 2025-07-22, S.D.N.Y.) alleges $4-5.5B in retail value extracted through the Pump.fun 'Pump Enterprise'
court filingAguilar et al. v. Pump.fun et al. (S.D.N.Y., Judge Colleen McMahon)
U.S. District Court, S.D.N.Y. — public record: S.D.N.Y. docket via PACER/CourtListener; summary at https://hodder.law/pumpfun-solana-jito-lawsuit-2025/
$TRUMP fell ~93% from its 2025-01-19 closing high (~$45.50; intraday ~$73) to ~$3.00 by 2026-Q1; retail mark-to-market loss ~$4.3B; insider wallets cleared over $1B
published investigationTime coverage of the $TRUMP / $MELANIA launches (January 2025)
By late 2023 the tracked drain cohort stood at ~$35M across ~150 victims whose common factor was seed phrases stored in LastPass
published investigationKrebs on Security: Why LastPass Users Are Losing Cryptocurrency (September 2023); Infosecurity Magazine: Experts Trace $35m in Stolen Crypto to LastPass Breach
~$150M in XRP left Chris Larsen's wallet on 2024-01-30; a March 2025 federal forfeiture action (N.D. Cal.) tied the theft to the LastPass breach and seized ~$24M
court filingU.S. forfeiture action, Northern District of California (March 2025), reported as Feds Link $150M Cyberheist to 2022 LastPass Hacks
TRM Labs traced ~$28M of cohort proceeds through Wasabi Wallet CoinJoin (late 2024 - early 2025) plus ~$7M in September 2025; off-ramps included OFAC-sanctioned Cryptex
published investigationTRM Labs: TRM Traces Stolen Crypto from 2022 LastPass Breach (December 2025)
NIST National Vulnerability Database / Apache Software Foundation — public record: nvd.nist.gov entry for CVE-2017-5638
In 2020 the U.S. DOJ indicted four officers of China's People's Liberation Army for the Equifax breach affecting 147.9M people
court filingDOJ indictment of four PLA members for the Equifax hack (February 2020)
U.S. Department of Justice — public record: justice.gov 2020 Equifax indictment press release and charging document (N.D. Ga.)
Equifax agreed in 2019 to a settlement of up to $700M with the FTC, CFPB and states over the breach
regulatorFTC Equifax data breach settlement (2019)
U.S. Federal Trade Commission — public record: ftc.gov Equifax case and settlement page
Chapter 10 — The Box That Lied
A counterfeit Ledger Nano S Plus contained an ESP32-S3 microcontroller with scraped markings, an antenna trace on the PCB, and the seed phrase in plaintext flash; cohort losses ~$9.5M+ across ~50+ victims on 20+ chains
published investigation$9.5M Counterfeit Ledger Teardown (research.highboy.com.br, 2025)
Circle froze USDC held at the Tornado Cash-sanctioned addresses within ~24 hours of the OFAC designation
published investigationCircle USDC freeze announcement (August 2022); freeze events observable on-chain at the sanctioned addresses
Circle — public record: Circle August 2022 statements; on-chain freeze state of the SDN-listed addresses
In November 2024 the Fifth Circuit held that OFAC exceeded its authority — immutable smart contracts lack the hallmarks of property and cannot be sanctioned under IEEPA
court filingVan Loon v. Department of Treasury (Fifth Circuit Court of Appeals, November 2024)
U.S. Court of Appeals for the Fifth Circuit — public record: Fifth Circuit opinion, Van Loon v. Dep't of the Treasury (Nov 2024), via CourtListener/PACER
Chapter 12 — Why They Want Your Passport
Lazarus Group laundered $200M+ from 25+ crypto hacks (2020-2023) through Tornado Cash, cross-chain bridges, and P2P marketplaces (Noones, Paxful) to fiat
published investigationZachXBT 15-month Lazarus laundering investigation (April 2024)
Between 2022-05-07 and 2022-05-13 LUNA fell from ~$80 to below $0.01 and UST from $1.00 to ~$0.05; ~$40-60B in market value was destroyed
published investigationNansen: On-Chain Data Reveals UST Depeg and LUNA Collapse (May 2022); Jump Crypto Terra/Luna post-mortem (2022)
Nansen / Jump Crypto — public record: Nansen research blog May 2022; Jump Crypto post-mortem 2022
Anchor Protocol paid ~20% fixed yield on UST, subsidised by the Terraform Labs treasury rather than organic lending demand, and held ~72% of all UST (~$14B of ~$18B)
datasetAnchor Protocol deposit share of UST supply, as recorded in the OAK Terra collapse record
Terra Classic on-chain data / archived Anchor dashboards — public record: Terra Classic chain data and archived Anchor Protocol deposit dashboards
The SEC charged Terraform Labs and Do Kwon with civil fraud in February 2023; the action settled in April 2025 for ~$4.5B in disgorgement and penalties
court filingSEC v. Terraform Labs Pte. Ltd. and Do Hyeong Kwon, S.D.N.Y. Case No. 1:23-cv-01346
U.S. Securities and Exchange Commission / S.D.N.Y. — public record: sec.gov litigation releases; S.D.N.Y. docket 1:23-cv-01346 via PACER/CourtListener
Chapter 14 — The Bank Comes Back
On 2025-03-26 a trader pumped JELLY ~250-429% on Solana spot venues to trap Hyperliquid's HLP vault in a ~$13.5M peak floating loss
published investigationCoinDesk: HyperLiquid Delists JELLY After Vault Squeezed in $13M Tussle (2025-03-26); Arkham Intelligence post-event reconstruction
Hyperliquid validators voted to delist JELLY and settle positions at $0.0095, overriding the manipulated market price; the Hyper Foundation reimbursed non-flagged users
published investigationHyperliquid operator announcement of the JELLY validator-vote delist and reimbursement (X, 2025-03-26)