# ![@Shadow_Researc Avatar](https://lunarcrush.com/gi/w:26/cr:twitter::1977683745558917120.png) @Shadow_Researc Fatih_Han

Fatih_Han posts on X about twitter, this is, thread, block the most. They currently have [--] followers and [--] posts still getting attention that total [---] engagements in the last [--] hours.

### Engagements: [---] [#](/creator/twitter::1977683745558917120/interactions)
![Engagements Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::1977683745558917120/c:line/m:interactions.svg)

- [--] Week [---] -85%

### Mentions: [--] [#](/creator/twitter::1977683745558917120/posts_active)
![Mentions Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::1977683745558917120/c:line/m:posts_active.svg)

- [--] Week [--] -48%

### Followers: [--] [#](/creator/twitter::1977683745558917120/followers)
![Followers Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::1977683745558917120/c:line/m:followers.svg)

- [--] Week [--] +4.60%

### CreatorRank: undefined [#](/creator/twitter::1977683745558917120/influencer_rank)
![CreatorRank Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::1977683745558917120/c:line/m:influencer_rank.svg)

### Social Influence

**Social category influence**
[technology brands](/list/technology-brands)  [social networks](/list/social-networks)  [finance](/list/finance)  [exchanges](/list/exchanges)  [cryptocurrencies](/list/cryptocurrencies) 

**Social topic influence**
[twitter](/topic/twitter), [this is](/topic/this-is), [thread](/topic/thread), [block](/topic/block), [update](/topic/update), [dot](/topic/dot), [liquidity](/topic/liquidity), [oracle](/topic/oracle), [defi](/topic/defi), [governance](/topic/governance)

**Top accounts mentioned or mentioned by**
[@zachxbt](/creator/undefined) [@polkadot](/creator/undefined) [@hydrationnet](/creator/undefined) [@peckshieldalert](/creator/undefined) [@certik](/creator/undefined) [@giottodf](/creator/undefined) [@moonbeamnetwork](/creator/undefined) [@polkadotgov](/creator/undefined) [@web3foundation](/creator/undefined) [@billlaboon](/creator/undefined) [@coffeebreakyt](/creator/undefined) [@immunefi](/creator/undefined) [@peckshield](/creator/undefined) [@slowmistteam](/creator/undefined) [@gavofyork](/creator/undefined) [@bunjin](/creator/undefined) [@czbinance](/creator/undefined) [@binance](/creator/undefined) [@mexcofficial](/creator/undefined) [@theblock](/creator/undefined)

**Top assets mentioned**
[Hydration (HDX)](/topic/$hdx) [Polkadot (DOT)](/topic/$dot)
### Top Social Posts
Top posts by engagements in the last [--] hours

"PART 4: THE COVER-UP They realized we caught them. Referendum #255 was suddenly closed and Referendum #256 was immediately launched to distract the community. But on-chain data is permanent. Ref #255 Topic: "Whitelist DOT removal from Omnipool" The perfect setup for a liquidity exit. Ref #256 Topic: "Tip Request for DIA Oracle Services" A sudden treasury spend request for [-------] HDX. Why the rush While they try to bury the "Septillion Mint" logs with new proposals they are still trying to drain the Treasury. Currently 116M HDX are already voting NAY on this new attempt. The community is"  
[X Link](https://x.com/Shadow_Researc/status/2013903883320623448)  2026-01-21T09:17Z [--] followers, [--] engagements


"🚨 URGENT ALERT: The $8.3 Million "Inside Job" on @hydration_net We have uncovered undeniable on-chain proof of a massive state-sponsored theft. Admins are "Minting" funds from NULL (0x000.) laundering them via Router & Aave and hiding them in Moonbeam Treasury. Referendum #255 is the exit scam. 🧵👇 #Polkadot #DeFi #ScamAlert $HDX $DOT @Polkadot @MoonbeamNetwork @Web3foundation @Hydration_net @ZachXBT @PeckShieldAlert @CertiK @SlowMist_Team @gavofyork @Bunjin @BillLaboon @cz_binance @binance @MEXC_Official https://twitter.com/i/web/status/2013905197316309467"  
[X Link](https://x.com/Shadow_Researc/status/2013905197316309467)  2026-01-21T09:23Z [--] followers, [----] engagements


"PART 1: THE CRIME SCENE [--] THE GENESIS: Money from Thin Air This was not a hack. It was a Sudo (Admin) execution. At Block #8155016 & #8155017 the System minted billions of units to two "Ghost Wallets" from the NULL address. 👻 Ghost A: 0xE21D. (4.3B Units) 👻 Ghost B: 0xC5B7. (1.9B Units) [--] THE LAUNDROMAT: Router & Aave Seconds after minting these wallets didn't just hold. They executed a sophisticated laundering loop via the Router (0x6d6f.). Method: ReserveUsedAsCollateral Action: Deposit fake minted tokens - Collateralize - Borrow CLEAN assets (USDC DOT). Result They now hold $8.3M + $2.5M"  
[X Link](https://x.com/Shadow_Researc/status/2013905477340704830)  2026-01-21T09:24Z [--] followers, [---] engagements


"1 Decimals & Scalability (10 vs 10): Defense: [--] decimals is normal. Fact: Hydration (DOT/HDX) uses [--] or [--] decimals. A transfer of [--] units is billions of times the protocol supply. If this is a normal decimal difference why is it only happening through these two Ghost Wallets This is not a decimal error but an overflow or set_storage manipulation at the database layer. [--] The Null Argument (0x00.): Defense: 'Minting from null is normal.' Fact: Yes it is normal when minting new tokens. However minting billions of units in the middle of the night blocks (Block #8155016) without a Governance"  
[X Link](https://x.com/Shadow_Researc/status/2013946161976283299)  2026-01-21T12:05Z [--] followers, [--] engagements


"### 🚨 TWEET [--] (THE DISCLOSURE) URGENT: ON-CHAIN FORENSIC DISCLOSURE regarding @Hydration_Net I am releasing a fully documented evidence-backed forensic analysis regarding the $8.3M anomaly. This is not speculation. This is not a theory. All my findings are supported by: * On-chain events * Exact block numbers * SQL query results (Internal Audit) * Verifiable execution traces What I document here is ROOT-LEVEL PRIVILEGED EXECUTION resulting in value extraction. Not an external hack. Forensic breakdown follows 👇 @zachxbt @coffeebreak_YT https://twitter.com/i/web/status/2018165882132795715"  
[X Link](https://x.com/anyuser/status/2018165882132795715)  2026-02-02T03:33Z [--] followers, [----] engagements


"TWEET [--] (THE VERDICT) CONCLUSION: THE BILL OF INDICTMENT This is no longer a theory. I have documented: [--]. $8.3M (Ghost Wallets) + $2.3M (Laundering Loop) = $10.6M TOTAL THEFT. [--]. Septillion-scale database manipulation on Mainnet. [--]. Direct bridging to Moonbeam Treasury (modlpy/trsry). [--]. Unbacked tokens entering Aave Pools as collateral. [--]. Admins mocking critical security alerts. IMMEDIATE ACTION: VOTE NAY on ALL current proposals (Especially Ref #261). DEMAND a full audit of the Sudo/Admin keys immediately. CC: @PolkadotGov @Giottodf @AaveAave @StaniKulechov @coffeebreak_YT"  
[X Link](https://x.com/Shadow_Researc/status/2018167448361369867)  2026-02-02T03:39Z [--] followers, [---] engagements


"HREAD (6/7) WHAT THE NUMBER MEANS STANDARD ORACLE DECIMALS: [--] THE MATH: [--------] / [--] $0.991 RESULT: A WORTHLESS OR SYNTHETIC ASSET IS HARD-CODED TO APPEAR AS A $1 STABLECOIN. NO MARKET INPUT. NO UPDATES. NO GOVERNANCE DISCLOSURE. THIS IS A PRE-PLANTED LOGIC BOMB. #Polkadot #Hydration #DeFi #CryptoSecurity https://twitter.com/i/web/status/2018392906802114947 https://twitter.com/i/web/status/2018392906802114947"  
[X Link](https://x.com/Shadow_Researc/status/2018392906802114947)  2026-02-02T18:35Z [--] followers, [---] engagements


"HYDRATION PAPERS: THREAD (1/5) PART 2: THE SHADOW FLEET WE FOUND THE HEAD OF THE SNAKE. THE ADDRESS 0xAa7e. IS NOT JUST A "BURN ADDRESS". IT IS THE OWNER OF A HIDDEN CONTRACT FLEET. FORENSIC EVIDENCE (SEE IMAGE) SHOWS THIS ADDRESS SEIZED CONTROL OF: THE ZOMBIE ORACLE (0xcfab.) THE ACTIVE ORACLE (0x11c1.) FURTHER TRACES LINK THIS SAME CONTROLLER TO THE MINTING FACILITY (0xf3ba.). SYSTEM CRITICAL ROLES WERE HANDED TO THIS SHADOW BOSS. THIS IS A HOSTILE PROTOCOL TAKEOVER. CC: @Polkadot @Hydration_Net @ZachXBT @Giottodf @peckshield @CertiK https://twitter.com/i/web/status/2018428645556224068"  
[X Link](https://x.com/Shadow_Researc/status/2018428645556224068)  2026-02-02T20:57Z [--] followers, [---] engagements


"THREAD (3/5) THE REMOTE TRIGGER (CROSS-CHAIN) [--] DAYS AGO (BLOCK #11155822) THE SYSTEM STATE WAS ALTERED. NOT VIA A USER TRANSACTION. NOT VIA A GOVERNANCE VOTE. BUT VIA A CROSS-CHAIN SYSTEM CALL (ISMP): IsmpParachain.update_parachain_consensus THE PROTOCOL WAS STEERED FROM OUTSIDE THE CHAIN. A "REMOTE CONTROL" MECHANISM WAS USED TO FORCE A STATE UPDATE. PERFECT DISGUISE. ZERO FOOTPRINT. CC: @Polkadot @Hydration_Net @ZachXBT @PolkadotGov @Giottodf @PeckShieldAlert https://twitter.com/i/web/status/2018429077808705794 https://twitter.com/i/web/status/2018429077808705794"  
[X Link](https://x.com/anyuser/status/2018429077808705794)  2026-02-02T20:59Z [--] followers, [---] engagements


"TWEET 1: THE GHOST RETURNS THREAD (1/3) THE GHOST WALLET IS ACTIVE. BLOCKS 11211145+ REVEAL A LIVE LIQUIDITY EXTRACTION LOOP. THE "GHOST WALLET" (0xC5B7.) WE PREVIOUSLY IDENTIFIED IS CURRENTLY PUMPING ASSETS INTO THE SYSTEM ROUTER. THESE ARE NOT USER TRADES. THESE ARE SYSTEM-LEVEL TRANSFERS EXECUTED IN MINUTES. https://twitter.com/i/web/status/2018464488593543647 https://twitter.com/i/web/status/2018464488593543647"  
[X Link](https://x.com/anyuser/status/2018464488593543647)  2026-02-02T23:20Z [--] followers, [---] engagements


"THREAD (2/3) THE MECHANISM: OMNIPOOL DRAIN. THE ASSETS MOVE FROM mdlrouter DIRECTLY INTO modlomnipool. THIS CREATES A "LIQUIDITY ILLUSION" ARTIFICIALLY SHIFTING POOL RATIOS. THE RESULT A SUBSIDIARY CONTRACT (0x0263.) HAS ACCUMULATED OVER [---] MILLION DOT ($3.8M) THROUGH THIS MANIPULATED PRICE IMPACT. https://twitter.com/i/web/status/2018464763442081916 https://twitter.com/i/web/status/2018464763442081916"  
[X Link](https://x.com/anyuser/status/2018464763442081916)  2026-02-02T23:21Z [--] followers, [---] engagements


"THREAD (3/3) FINAL VERDICT: HYDRATION DOCS. I PROVED: [--]. COORDINATED BOT ARMIES. [--]. POISONED ORACLES. [--]. GHOST WALLET PUMPING OMNIPOOL. [--]. A $4 MILLION DOT STASH WAITING IN A SHADY CONTRACT. THIS IS NOT DEFI. THIS IS THE SYSTEMATIC DRAINING OF COMMUNITY ASSETS. THE EVIDENCE IS UNCHANGING. THE INVESTIGATION IS COMPLETE. THE HYDRATION FILE IS CLOSED FOR ME COMPILED AND THROWN AT YOUR FEET. KEEP SLEEPING. EVERY MINUTE THAT PASSES WITHOUT A RESPONSE FROM EVERY INSTITUTION TAGGED IN MY CHAIN-BASED INVESTIGATION MEANS THEY ARE ALSO COMPLICIT. EITHER YOU ACT TODAY OR YOU CONTINUE TO HOLD THE ENTIRE"  
[X Link](https://x.com/anyuser/status/2018465003184283703)  2026-02-02T23:22Z [--] followers, [---] engagements


"I was excluded too. They repeatedly denied my bug bounty reports. When I tried to communicate with them privately and explain they called me AI nonsense but I didn't give up. I worked on it for months and tweeted a total of [--] times consisting of four parts: 8/8-7/7-5/5 -3/3. I explained the entire chain from start to finish with evidence showing how it was done what they did and who did what where. I'm not just claiming this; the chain is there the block numbers are there Researchers like @zachxbt need to look into this and verify it. If he contacts me I'll give him all my files all the"  
[X Link](https://x.com/Shadow_Researc/status/2018720091014340641)  2026-02-03T16:15Z [--] followers, [--] engagements


"HYDRATION PAPERS&MOONBEAMBRG TWEET 1: THE LIVE SIPHON 🚨 LIVE ON-CHAIN ANOMALY DETECTED. BLOCKS 11222549+ REVEAL AN UNDISCLOSED AUTOMATED FUND FLOW. WE HAVE INTERCEPTED A HIGH-FREQUENCY EXTRACTION LOOP ACTIVE RIGHT NOW: THE FLOW: [--]. SOURCE: modlcurreser (System Currency Module) injects funds into a generic INTERMEDIARY wallet (0xecC1.). [--]. MECHANISM: The Intermediary immediately executes Utility.batch_all to split funds between: A) Router Liquidity Injection B) Cross-Chain Exit Vectors This is not a standard treasury operation. This is an automated extraction mechanism utilizing intermediary"  
[X Link](https://x.com/anyuser/status/2018756715999830217)  2026-02-03T18:41Z [--] followers, [---] engagements


"HYDRATION PAPERS&MOONBEAMBRG TWEET 2: THE DESTINATION 🚨 DATA MATCH CONFIRMED: THE DESTINATION. FORENSIC ANALYSIS OF THE LOGS HAS DECODED THE HARD-CODED DESTINATION ADDRESS. RAW HEX DATA: 0x6d6f646C70792f7472737279. DECODED STRING: = modlpy/trsry (MODULE POLKADOT TREASURY - MOONBEAM) VERIFICATION: Cross-referencing Subscan and Moonscan data confirms this address is the native Moonbeam Treasury interface. CONCLUSION: The funds are being systematically bridged out of the chain to the Moonbeam ecosystem via this hidden interface. The evidence is immutable. #Moonbeam #Polkadot #CryptoSecurity"  
[X Link](https://x.com/anyuser/status/2018757248001143061)  2026-02-03T18:43Z [--] followers, [---] engagements


"THE EVIDENCE THEY TRIED TO BURY: REPORT ID [-----] I played by the rules. I followed responsible disclosure. I gave them every chance to fix it. THE TRUTH: * REPORT ID 64277: A CRITICAL vulnerability allowing INFINITE MINTING and 100% TVL RISK was formally reported. THE BACKDOOR: I proved the use of a privileged system precompile (0x.0802) running in Dev-Mode on Mainnet. THE RESPONSE: Hydration dismissed a total collapse risk as "EXPECTED BEHAVIOR" and closed the report without a reward. THE SILENCE: Despite the escalation and proof of on-chain finality the mediation remains a wall of silence."  
[X Link](https://x.com/anyuser/status/2018862400985043185)  2026-02-04T01:41Z [--] followers, [---] engagements


"@PeckShieldAlert @CertiK"  
[X Link](https://x.com/Shadow_Researc/status/2018864148499812500)  2026-02-04T01:48Z [--] followers, [---] engagements


"@Rabasso Just hang tight everything will be revealed shortly. New findings are on the way. I'll share evidence of the exit point of the funds from the system which KYC-verified wallet address the unlimited tokens printed on the Moonbeam network were sent to"  
[X Link](https://x.com/Shadow_Researc/status/2019183256021901738)  2026-02-04T22:56Z [--] followers, [--] engagements


"TWEET 4/7 BLOCK-LEVEL VALUE SHIFT From aggregation query: precompile_0802_block_balance Example block: Block [--------] Value [------------------] At this block: - No swap event - No borrow event - No oracle update - No mint event This value appears only inside [----] traces. Accounting state changed without economic action. This is not trading. This is not DeFi. This is state relocation. CC: @coffeebreak_YT @Polkadot @chainalysis https://twitter.com/i/web/status/2019237086168248531 https://twitter.com/i/web/status/2019237086168248531"  
[X Link](https://x.com/anyuser/status/2019237086168248531)  2026-02-05T02:30Z [--] followers, [---] engagements


"TWEET 7/7 KYC BREAKPOINT Anonymity collapses at the exit. Coordinator & funding wallet exposed: 0x30C9223D9e3d23E0aF1073A38e0834B055bf68ed Historically funded from Poloniex main vaults (KYC-enforced CEX) Also linked to BtcTurk:Deprecated funding Identity IP & withdrawal records exist. This connects the full chain: - 0x0802 runtime tunnel bypasses governance - Intentional invisibility via empty batch/router logs - Repeating operator callers (controlled execution) - Non-economic block-level value shifts - Laundering layer (forward contracts + selfdestruct) - Moonbeam & Mayan exits No longer"  
[X Link](https://x.com/anyuser/status/2019256648024670286)  2026-02-05T03:47Z [--] followers, [---] engagements


"UPDATE on Hydration Papers BULGAR CONNECTIONS New traces: BtcTurk deprecated wallet (0x30C922.) leads to chains with potential Bulgarian hacker ties (via past exchange hacks). - Poloniex + BtcTurk + Bybit KYC funding - Selfdestruct contracts hiding trails - Moonbeam NFTs as disguise This is bigger than Hydration. @zachxbt @PeckShieldAlert investigate. #HydrationPapers #DeFiSecurity https://twitter.com/i/web/status/2021414087125832094 https://twitter.com/i/web/status/2021414087125832094"  
[X Link](https://x.com/anyuser/status/2021414087125832094)  2026-02-11T02:40Z [--] followers, [---] engagements


"Moonbeam bright&NFT"  
[X Link](https://x.com/anyuser/status/2021414342185660916)  2026-02-11T02:41Z [--] followers, [---] engagements


"And you know that this is actually an immense power. Currently owning a project in the DeFi/Polkadot/Web3 world is equivalent to owning a vault at the world central bank because the actions occurring in cross-chain transfers create a chain that affects not only the Web3 space its investors and community investors but the entire global economy. movement of assets hydration-Moonbeam/Astar/-Glmr/EVM chain -KYC Platform- x country's p2p x person's bank- x person's bank that started the chain. What I mean is the action taken is not just stealing the assets of investors and individuals within that"  
[X Link](https://x.com/Shadow_Researc/status/2022534882346619167)  2026-02-14T04:54Z [--] followers, [--] engagements


"### 🚨 TWEET [--] (THE DISCLOSURE) URGENT: ON-CHAIN FORENSIC DISCLOSURE regarding @Hydration_Net I am releasing a fully documented evidence-backed forensic analysis regarding the $8.3M anomaly. This is not speculation. This is not a theory. All my findings are supported by: * On-chain events * Exact block numbers * SQL query results (Internal Audit) * Verifiable execution traces What I document here is ROOT-LEVEL PRIVILEGED EXECUTION resulting in value extraction. Not an external hack. Forensic breakdown follows 👇 @zachxbt @coffeebreak_YT https://twitter.com/i/web/status/2018165882132795715"  
[X Link](https://x.com/anyuser/status/2018165882132795715)  2026-02-02T03:33Z [--] followers, [----] engagements


"UPDATE on Hydration Papers BULGAR CONNECTIONS New traces: BtcTurk deprecated wallet (0x30C922.) leads to chains with potential Bulgarian hacker ties (via past exchange hacks). - Poloniex + BtcTurk + Bybit KYC funding - Selfdestruct contracts hiding trails - Moonbeam NFTs as disguise This is bigger than Hydration. @zachxbt @PeckShieldAlert investigate. #HydrationPapers #DeFiSecurity https://twitter.com/i/web/status/2021414087125832094 https://twitter.com/i/web/status/2021414087125832094"  
[X Link](https://x.com/anyuser/status/2021414087125832094)  2026-02-11T02:40Z [--] followers, [---] engagements


"Moonbeam bright&NFT"  
[X Link](https://x.com/anyuser/status/2021414342185660916)  2026-02-11T02:41Z [--] followers, [---] engagements


"TWEET 7/7 KYC BREAKPOINT Anonymity collapses at the exit. Coordinator & funding wallet exposed: 0x30C9223D9e3d23E0aF1073A38e0834B055bf68ed Historically funded from Poloniex main vaults (KYC-enforced CEX) Also linked to BtcTurk:Deprecated funding Identity IP & withdrawal records exist. This connects the full chain: - 0x0802 runtime tunnel bypasses governance - Intentional invisibility via empty batch/router logs - Repeating operator callers (controlled execution) - Non-economic block-level value shifts - Laundering layer (forward contracts + selfdestruct) - Moonbeam & Mayan exits No longer"  
[X Link](https://x.com/anyuser/status/2019256648024670286)  2026-02-05T03:47Z [--] followers, [---] engagements


"TWEET 6/7 LAUNDERING LAYER Observed laundering patterns: - Forward-only contracts using GOLD-style logic (0xb59f313dCf8C8107AdFfEAbD0c041C896C64dfCA) - destination.transfer(msg.value); - Repeated initialize calls rotating destinations - Final SELFDESTRUCT using 0xFF Observed exit routes: - Moonbeam - Mayan Swift Purpose: - Break transaction continuity - Destroy on-chain context - Obfuscate the custody chain This is textbook financial layering. CC: @MoonbeamNetwork @MayanFinance @PeckShieldAlert @CertiK"  
[X Link](https://x.com/anyuser/status/2019237443971772812)  2026-02-05T02:31Z [--] followers, [---] engagements


"TWEET 5/7 OPERATOR SIGNATURE [----] usage is highly concentrated. Top callers from precompile_0802_bot_signature: - 0x1b02e051683b5cfac5929c25e84adb26ecf87b38 [----] calls - 0x02639ec01313c8775fae74f2dad1118c8a8a86da [----] calls - 0x7472a3d0891df2401d981a5954d07e364f05060f [----] calls - 0x531a654d1696ed52e7275a8cede955e82620f99a [---] calls Random users do not produce this distribution. This is operator infrastructure. CC: @BlockChain_CK @Polkadot @zachxbt"  
[X Link](https://x.com/anyuser/status/2019237303831654895)  2026-02-05T02:31Z [--] followers, [---] engagements


"TWEET 4/7 BLOCK-LEVEL VALUE SHIFT From aggregation query: precompile_0802_block_balance Example block: Block [--------] Value [------------------] At this block: - No swap event - No borrow event - No oracle update - No mint event This value appears only inside [----] traces. Accounting state changed without economic action. This is not trading. This is not DeFi. This is state relocation. CC: @coffeebreak_YT @Polkadot @chainalysis https://twitter.com/i/web/status/2019237086168248531 https://twitter.com/i/web/status/2019237086168248531"  
[X Link](https://x.com/anyuser/status/2019237086168248531)  2026-02-05T02:30Z [--] followers, [---] engagements


"TWEET 3/7 THE HIDDEN TUNNEL The extraction mechanism is a runtime precompiled contract: 0x0000000000000000000000000000000000000802 Detection method used in logs: WHERE args::text ILIKE %0802% Live results captured minutes before execution: [--------] [--------] [--------] [--------] [--------] Critical facts: - Not visible in Utility.batch_all - Not visible in router swap events - Only visible at runtime log level This is why batch and router density queries return empty. The tunnel bypasses them entirely. CC: @PeckShieldAlert @Polkadot @CertiK"  
[X Link](https://x.com/anyuser/status/2019236695322095872)  2026-02-05T02:28Z [--] followers, [---] engagements


"TWEET 2/7 FUND ORIGIN Funds are not initiated by users. Top callers interacting with the critical path: - 0x531a654d1696ed52e7275a8cede955e82620f99a - 0x1b02e051683b5cfac5929c25e84adb26ecf87b38 - 0x00f283c7a97ecb60dd905cdab52febceec04dc0f These addresses are runtime-level system modules not EOAs. This alone disproves the narratives of salaries normal operations or user-driven flows. The system is moving system funds. CC: @Web3foundation @Polkadot @PeckShieldAlert"  
[X Link](https://x.com/anyuser/status/2019236455491797224)  2026-02-05T02:27Z [--] followers, [---] engagements


"TWEET 1/7 SCOPE & CLAIM THE HYDRATION PAPERS A SYSTEM-LEVEL FORENSIC DISCLOSURE This is not a bug. This is not market volatility. This is not user behavior. This thread documents a deterministic system-level value extraction architecture operating inside Hydration. Using raw on-chain logs SQL aggregation and runtime traces I will prove: - A hidden runtime tunnel: 0x0000000000000000000000000000000000000802 - System modules acting as operators - Block-level value relocation without swaps - Router and batch invisibility by design - Cross-chain exits via Moonbeam and Mayan - A KYC-bound"  
[X Link](https://x.com/anyuser/status/2019235923901444543)  2026-02-05T02:25Z [--] followers, [---] engagements


"THE EVIDENCE THEY TRIED TO BURY: REPORT ID [-----] I played by the rules. I followed responsible disclosure. I gave them every chance to fix it. THE TRUTH: * REPORT ID 64277: A CRITICAL vulnerability allowing INFINITE MINTING and 100% TVL RISK was formally reported. THE BACKDOOR: I proved the use of a privileged system precompile (0x.0802) running in Dev-Mode on Mainnet. THE RESPONSE: Hydration dismissed a total collapse risk as "EXPECTED BEHAVIOR" and closed the report without a reward. THE SILENCE: Despite the escalation and proof of on-chain finality the mediation remains a wall of silence."  
[X Link](https://x.com/anyuser/status/2018862400985043185)  2026-02-04T01:41Z [--] followers, [---] engagements


"🚨 UPDATE: PANIC MODE ACTIVATED. MINUTES AFTER OUR EXPOSURE [--] EMERGENCY REFERENDA (266-267-268) WERE LAUNCHED. THE GOAL: [--]. Authorize OTC Sales (Ref 267) [--]. Register EURC for Exit Liquidity (Ref 268) THE EVIDENCE: The EXACT SAME [--] wallets (Whale 0x2621. & Bots 0x7617.) are instantly approving ALL proposals. See the logs: They vote on Ref [---] and [---] within seconds of each other. This is not governance. This is a rubber-stamp operation to clear the exit path before the public wakes up. #Hydration #Polkadot #ExitScam #DeFiSecurity @zachxbt"  
[X Link](https://x.com/anyuser/status/2018815443683959010)  2026-02-03T22:34Z [--] followers, [---] engagements


"HYDRATION PAPERS&MOONBEAMBRG TWEET 2: THE DESTINATION 🚨 DATA MATCH CONFIRMED: THE DESTINATION. FORENSIC ANALYSIS OF THE LOGS HAS DECODED THE HARD-CODED DESTINATION ADDRESS. RAW HEX DATA: 0x6d6f646C70792f7472737279. DECODED STRING: = modlpy/trsry (MODULE POLKADOT TREASURY - MOONBEAM) VERIFICATION: Cross-referencing Subscan and Moonscan data confirms this address is the native Moonbeam Treasury interface. CONCLUSION: The funds are being systematically bridged out of the chain to the Moonbeam ecosystem via this hidden interface. The evidence is immutable. #Moonbeam #Polkadot #CryptoSecurity"  
[X Link](https://x.com/anyuser/status/2018757248001143061)  2026-02-03T18:43Z [--] followers, [---] engagements


"HYDRATION PAPERS&MOONBEAMBRG TWEET 1: THE LIVE SIPHON 🚨 LIVE ON-CHAIN ANOMALY DETECTED. BLOCKS 11222549+ REVEAL AN UNDISCLOSED AUTOMATED FUND FLOW. WE HAVE INTERCEPTED A HIGH-FREQUENCY EXTRACTION LOOP ACTIVE RIGHT NOW: THE FLOW: [--]. SOURCE: modlcurreser (System Currency Module) injects funds into a generic INTERMEDIARY wallet (0xecC1.). [--]. MECHANISM: The Intermediary immediately executes Utility.batch_all to split funds between: A) Router Liquidity Injection B) Cross-Chain Exit Vectors This is not a standard treasury operation. This is an automated extraction mechanism utilizing intermediary"  
[X Link](https://x.com/anyuser/status/2018756715999830217)  2026-02-03T18:41Z [--] followers, [---] engagements


"I had a hunch [--] months ago when they where asking the treasury for [--] million dots and all the community approved that (permanence DAO didnt) you know who uses hydration the community of bots and a few people that ask went into their pockets we did dig and found some anomalies we got grifted from within. Nexus DAO along with most DAOs voted Aye they all came from same original DAO CD. total collusion also few members control the votes. Some people is blind also the voting weight they have probably came from some of those funds seems hydration delegated their voting power to that dao so they"  
[X Link](https://x.com/anyuser/status/2018714844732493967)  2026-02-03T15:54Z [---] followers, [---] engagements


"THREAD (3/3) FINAL VERDICT: HYDRATION DOCS. I PROVED: [--]. COORDINATED BOT ARMIES. [--]. POISONED ORACLES. [--]. GHOST WALLET PUMPING OMNIPOOL. [--]. A $4 MILLION DOT STASH WAITING IN A SHADY CONTRACT. THIS IS NOT DEFI. THIS IS THE SYSTEMATIC DRAINING OF COMMUNITY ASSETS. THE EVIDENCE IS UNCHANGING. THE INVESTIGATION IS COMPLETE. THE HYDRATION FILE IS CLOSED FOR ME COMPILED AND THROWN AT YOUR FEET. KEEP SLEEPING. EVERY MINUTE THAT PASSES WITHOUT A RESPONSE FROM EVERY INSTITUTION TAGGED IN MY CHAIN-BASED INVESTIGATION MEANS THEY ARE ALSO COMPLICIT. EITHER YOU ACT TODAY OR YOU CONTINUE TO HOLD THE ENTIRE"  
[X Link](https://x.com/anyuser/status/2018465003184283703)  2026-02-02T23:22Z [--] followers, [---] engagements


"THREAD (2/3) THE MECHANISM: OMNIPOOL DRAIN. THE ASSETS MOVE FROM mdlrouter DIRECTLY INTO modlomnipool. THIS CREATES A "LIQUIDITY ILLUSION" ARTIFICIALLY SHIFTING POOL RATIOS. THE RESULT A SUBSIDIARY CONTRACT (0x0263.) HAS ACCUMULATED OVER [---] MILLION DOT ($3.8M) THROUGH THIS MANIPULATED PRICE IMPACT. https://twitter.com/i/web/status/2018464763442081916 https://twitter.com/i/web/status/2018464763442081916"  
[X Link](https://x.com/anyuser/status/2018464763442081916)  2026-02-02T23:21Z [--] followers, [---] engagements


"TWEET 1: THE GHOST RETURNS THREAD (1/3) THE GHOST WALLET IS ACTIVE. BLOCKS 11211145+ REVEAL A LIVE LIQUIDITY EXTRACTION LOOP. THE "GHOST WALLET" (0xC5B7.) WE PREVIOUSLY IDENTIFIED IS CURRENTLY PUMPING ASSETS INTO THE SYSTEM ROUTER. THESE ARE NOT USER TRADES. THESE ARE SYSTEM-LEVEL TRANSFERS EXECUTED IN MINUTES. https://twitter.com/i/web/status/2018464488593543647 https://twitter.com/i/web/status/2018464488593543647"  
[X Link](https://x.com/anyuser/status/2018464488593543647)  2026-02-02T23:20Z [--] followers, [---] engagements


"THREAD (5/5) FINAL ASSESSMENT TIMELINE-CONSISTENT. ON-CHAIN VERIFIABLE. THIS IS NOT A BUG. THIS PATTERN SHOWS: [--]. PRE-POSITIONED SHADOW FLEET (0xAa7e) [--]. UNDOCUMENTED MINTING (0xf3ba) [--]. REMOTE TRIGGER MECHANISM (ISMP) [--]. VALUATION MANIPULATION ($1.22) ABSENT EXPLICIT GOVERNANCE APPROVAL AND PUBLIC DOCUMENTATION THIS IS NOT DESIGN. IT IS EXTRACTION. THE EVIDENCE IS IMMUTABLE. #DeFiSecurity #OnChainForensics #Hydration #Polkadot CC: @Polkadot @Hydration_Net @ZachXBT @PolkadotGov @Giottodf @PeckShieldAlert"  
[X Link](https://x.com/anyuser/status/2018429423398404418)  2026-02-02T21:00Z [--] followers, [---] engagements


"THREAD (4/5) THE VALUATION EXPANSION WHAT DID THE REMOTE TRIGGER DO AT BLOCK #11155822 THE "ISMP TRIGGER" EXECUTED THE AaveManagerCallDispatched COMMAND. THE RESULT (SEE IMAGE): IT UPDATED THE SECOND SHADOW ORACLE (0x11c1.) INSTANTLY. PREVIOUS STATE: $0.99 NEW STATE: $1.22 (122564140) IMPACT: A 22% ARTIFICIAL INCREASE IN COLLATERAL VALUE IN A SINGLE BLOCK. THIS ALLOWS ATTACKERS TO BORROW MASSIVE REAL ASSETS AGAINST INFLATED SYNTHETIC NUMBERS. THIS IS NOT A MARKET MOVE. THIS IS A CONTROLLED ECONOMIC LEVER. CC: @Polkadot @Hydration_Net @ZachXBT @PolkadotGov @Giottodf @peckshield @CertiK"  
[X Link](https://x.com/anyuser/status/2018429295627219291)  2026-02-02T21:00Z [--] followers, [---] engagements


"THREAD (3/5) THE REMOTE TRIGGER (CROSS-CHAIN) [--] DAYS AGO (BLOCK #11155822) THE SYSTEM STATE WAS ALTERED. NOT VIA A USER TRANSACTION. NOT VIA A GOVERNANCE VOTE. BUT VIA A CROSS-CHAIN SYSTEM CALL (ISMP): IsmpParachain.update_parachain_consensus THE PROTOCOL WAS STEERED FROM OUTSIDE THE CHAIN. A "REMOTE CONTROL" MECHANISM WAS USED TO FORCE A STATE UPDATE. PERFECT DISGUISE. ZERO FOOTPRINT. CC: @Polkadot @Hydration_Net @ZachXBT @PolkadotGov @Giottodf @PeckShieldAlert https://twitter.com/i/web/status/2018429077808705794 https://twitter.com/i/web/status/2018429077808705794"  
[X Link](https://x.com/anyuser/status/2018429077808705794)  2026-02-02T20:59Z [--] followers, [---] engagements

Limited data mode. Full metrics available with subscription: lunarcrush.com/pricing