14,892,194
Total Compromised Hashes
+24,105 this week
3,402
Active Phishing Nodes
Active monitoring
0ms
Hash Exposure Risk
Zero-Knowledge Enforced
Recent Database Ingestions
| Ingestion Date | Threat Vector Source | Records Added | Classification |
|---|---|---|---|
| 2026-11-08 14:22:05 | Raccoon Stealer (Telegram C2 Dump) | + 4,291 | Infostealer |
| 2026-11-06 09:15:33 | Fake MetaMask Validation Modal | + 1,844 | Phishing |
| 2026-11-04 22:45:10 | GitHub Public Repo Accidental Commits | + 892 | Cloud Leak |
| 2026-11-02 11:05:44 | RedLine Stealer (Russian Forum Dump) | + 12,405 | Infostealer |
| 2026-10-30 16:30:00 | Fake Ledger Live Desktop App | + 3,110 | Phishing |
Aggregation Sources
Dark Web Credential Markets
We actively scrape and index compromised mnemonic phrases sold or dumped on hidden services, ensuring our database matches the exact lists held by cybercriminals.
Open Source Scraping
Thousands of developers accidentally push their `.env` files or hardcoded testnet/mainnet seeds to public GitHub repositories. Our automated crawlers hash and flag these instantly.
Phishing Honeypots
TRM Labs deploys thousands of fake "honeypot" wallets across decentralized phishing sites. By monitoring the infrastructure attackers use to steal these seeds, we map out their backend databases.