Skip to content
Latest alertgo-ethereum v1.17.8 security release fixes p2p DoS issues and a STUN-response node crash
0xCERT
Report incident

Threat intelligence

IOC feeds, free for everyone.

Indicators from our advisories and incident response — drainer contracts, attacker addresses, phishing domains — published in machine-readable formats so wallets, RPCs, and security tools can block known threats at the edge.

Indicators
41
Addresses
29
Domains
0
Refresh
every 5 min

JSON

Full feed with labels, confidence, chain, and advisory links.

/iocs.json

STIX 2.1

Bundle of indicators for MISP, OpenCTI, and SIEM/TIP import.

/iocs.stix.json

CSV

Spreadsheet-friendly export of every active indicator.

/iocs.csv

Domain blocklist

Phishing and drainer domains + ENS names, one per line.

/iocs/domains.txt

Address blocklist

Attacker and drainer addresses across chains, one per line.

/iocs/addresses.txt

Licence: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/. Feeds are CORS-enabled and cached for 5 minutes. JSON and blocklists have detached OpenPGP signatures at the same URL + .asc (e.g. /iocs.json.asc), verifiable with our key. Report a false positive to cert@0xcert.com.

Browse

Active indicators

IndicatorTypeLabelChainAdvisoryFirst seen
0xed265fc80e4abe42d72d6bfd1623c89dd2d12f544d53d4ca2c9c3d0fefbf2810txMalicious authorization via Safe execution (GoPlus Security)Base0xCERT-2026-02302026-10-09
0xcdfe91301356da873562ef513828a60dba1f569daddressExploit contract added to vault borrow allowlist (GoPlus Security)Base0xCERT-2026-02302026-10-09
0x0b5126e1bc27c0de77e02e97945760a674edb034addressAttacker EOA (GoPlus Security; PeckShield)Base0xCERT-2026-02302026-10-09
0x557bfd0e8530fd3e089748ccaabaa7837877f7578b13a377008474f2e367ee8ctxAttack transaction, Aave redemption of 1,783.067 wstETH (GoPlus Security)Base0xCERT-2026-02302026-10-09
0x0ec75c3be1f55bb08a92421796675e051993cdb6cbc38d5e33cc2b7f6ef2f491txAttack transaction, first borrow (GoPlus Security)Base0xCERT-2026-02302026-10-09
0x5c1febd5047c2a15c37988b6abd5c8b984236dddf6fd24eed96b0f43951ad2c9txExploit transactionBase0xCERT-2026-01532026-10-08
0x772e73613ffbc845508377fc6ded1137f60ad730aecb2b7c18a2978a84a6ac1txPrice-moving buy in manipulated pool (Phalcon)Starknet0xCERT-2026-01602026-10-08
0x741af6efcc55165e89f7ef0b8ebad7e87efeaa8daa3b60dddd62d5dcacae69dtxAttacker NSTR/SolvBTC pool creation, one-sided liquidity (Phalcon)Starknet0xCERT-2026-01602026-10-08
0xa059aaab82773caf622de9d9a0f2dbf9aa7f3c37addressAttacker consolidation address for bridged funds (CertiK)Ethereum0xCERT-2026-01602026-10-08
0x06d48ef7ab62c26e3ef1987c322096cd508e9034c82048783a6b438fc1344bc3addressAttacker borrow account (CertiK, GoPlus)Starknet0xCERT-2026-01602026-10-08
0x6bc9b41bce2b6c08639c16790af064efafa15890c1ebf8cc72df99a577a1cf1txManipulated GeckoTerminal oracle price entry (Phalcon)Starknet0xCERT-2026-01602026-10-08
0x2460fde607d09f2434d1b4e6d4089c6e1f459f4ce70ba2853d3a37547cdf00etxBorrow at inflated NSTR valuation (Phalcon)Starknet0xCERT-2026-01602026-10-08
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37addressBSC theft address (ZachXBT)BNB Chain0xCERT-2026-01512026-10-08
0x9bfcca13b4ac907433ac68766e96309ac867f819addressAttacker forwarder wallet (Neutron post-mortem)Ethereum0xCERT-2026-01432026-10-08
secret1mru6cp7ft8cfasaye4g6vum52qygnkq0cgw0azaddressKey used to fund the vote purchase (Neutron post-mortem)Secret Network0xCERT-2026-01432026-10-08
0xef6c5a31df984c8569236a0abc1f27580e2a5d54addressAttacker collection wallet (Neutron post-mortem)Ethereum0xCERT-2026-01432026-10-08
neutron1dd25c4sshelrpfs0433apg24c5phrhk8l6n605addressAttacker wallet (Neutron post-mortem)Neutron0xCERT-2026-01432026-10-08
noble1dd25c4sshelrpfs0433apg24c5phrhk8nx0sdaaddressAttacker wallet (Neutron post-mortem)Noble0xCERT-2026-01432026-10-08
cosmos1dd25c4sshelrpfs0433apg24c5phrhk8m96c4naddressAttacker wallet (Neutron post-mortem)Cosmos Hub0xCERT-2026-01432026-10-08
osmo1dd25c4sshelrpfs0433apg24c5phrhk8n7fgrpaddressAttacker wallet (Neutron post-mortem)Osmosis0xCERT-2026-01432026-10-08
axelar1dd25c4sshelrpfs0433apg24c5phrhk8ltvs7jaddressAttacker wallet (Neutron post-mortem)Axelar0xCERT-2026-01432026-10-08
dydx1dd25c4sshelrpfs0433apg24c5phrhk8ju5u4yaddressAttacker wallet (Neutron post-mortem)dYdX0xCERT-2026-01432026-10-08
neutron1ekgfga6vv4zdrrjn3dux6f62fuzektfndgaehmaddressAttacker voting wallet (Neutron post-mortem)Neutron0xCERT-2026-01432026-10-08
noble1ekgfga6vv4zdrrjn3dux6f62fuzektfnp5pn4jaddressAttacker voting wallet (Neutron post-mortem)Noble0xCERT-2026-01432026-10-08
cosmos1ekgfga6vv4zdrrjn3dux6f62fuzektfnfh5mduaddressAttacker voting wallet (Neutron post-mortem)Cosmos Hub0xCERT-2026-01432026-10-08
osmo1erq7tre6nk0jfx203z8ey75g4m7yfrckl3qx87addressAttacker key used to sell THORChain refund (Neutron post-mortem)Osmosis0xCERT-2026-01432026-10-08
cosmos1erq7tre6nk0jfx203z8ey75g4m7yfrckh2nk3vaddressAttacker key used to sell THORChain refund (Neutron post-mortem)Cosmos Hub0xCERT-2026-01432026-10-08
0xe149310eb8b1b3d9c471ccd81819d393621fba5caddressAttacker working wallet (Neutron post-mortem)Ethereum0xCERT-2026-01432026-10-08
TAvraZZFCZbDSZoyqWWRRsBkFgZqKaCGbKaddressHacker address (Scam Sniffer)Tron0xCERT-2026-01482026-10-08
0xa77e24fe29d16e051e487ef4ea7b056cb05aef76addressHacker address, EVM (Scam Sniffer)Ethereum0xCERT-2026-01482026-10-08
TBWNguTTgezw9dVorX441C6nDrZpRxYwKDaddressPrimary attacker-controlled receiving address (Bitget)Tron0xCERT-2026-01472026-10-08
t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVGaddressPrimary attacker-controlled receiving address (Bitget)Zcash0xCERT-2026-01472026-10-08
rwNhefsz1UQEusxhCvHip3RANinWi4CTckaddressPrimary attacker-controlled receiving address (Bitget)XRP Ledger0xCERT-2026-01472026-10-08
0x770b10b273fc44fe9197d6bf20f145c2e98463eeaddressPrimary attacker-controlled receiving address, EVM (Bitget)Ethereum0xCERT-2026-01472026-10-08
0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5faaddressAttacker EOA (CertiK)Ethereum0xCERT-2026-01542026-10-08
0xec997d2ad033277913d6002277353368e8321dcfaddressAttack contract (CertiK)Ethereum0xCERT-2026-01542026-10-08
0xb8ecff9c129d8d9331c85558eaeddff29a38c4c16b71a40986acbf8f6febefebtxFirst Tornado Cash deposit of proceeds (CertiK)Ethereum0xCERT-2026-01542026-10-08
0xd4c0b18a058e7f0a12855f30174f4cb1e973c15c886063deab97e1a21f048ac6txAttacker funding via Tornado Cash withdrawal (CertiK)Ethereum0xCERT-2026-01542026-10-08
0x4a587af4213cc345c4c109fbf5fec46f9643183f91a9edf60305380f31ad1167txAttack contract deployment (CertiK)Ethereum0xCERT-2026-01542026-10-08
0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88ctxExploit transaction (CertiK)Ethereum0xCERT-2026-01542026-10-08
0xf09a13072ed939b79bc25b66aa3a836ea6dcc170addressMalicious adapter module used in exploit (CertiK)Ethereum0xCERT-2026-01542026-10-08

Integrate

Two lines to block known threats.

Pull the domain blocklist
curl -s https://www.0xcert.com/iocs/domains.txt | grep -v '^#'
Check an address with jq
curl -s https://www.0xcert.com/iocs.json \
  | jq '.indicators[] | select(.value == "0x…")'