Wagyu: 10,139 Users records, 38,628 orders, and new connections in crypto incident investigations As part of a partnership between @aml_crypto and @officer_secret , we decided to conduct a detailed analysis of datasets presumably obtained as a result of a data leak from the crypto exchange/swap service Wagyu. - Wagyu officially acknowledged (by @PerpetualCow ) a data leak from its service covering the last 3 months. - The hacker group WhiteArmor allegedly demanded $5 million not to publish the data, but after the refusal, they carried out their threat and published the deal data. What do the investigated data contain? Users — 10,139 records Orders — 38,628 records Total: 48,767 records in two tables. The order data is particularly interesting for blockchain analytics, as it can be used to match incoming and outgoing transactions, discover relations between addresses and reconstruct the flow of assets through the exchange service. Why is this important for investigations? When investigating hacks, thefts and other crypto incidents, analytical firms and independent investigators often need information from centralized services. Making formal requests through law enforcement often means blocking stolen funds and obtaining details to help identify parties to transactions. Not all the platforms react quickly, some don’t react at all. Wagyu has been in similar situations in our practice, unfortunately. “We had some investigations where our teams were working on Wagyu never responded to requests from law enforcement officials. So, victims and analytical companies need to look for other legal sources to trace the movement of stolen assets. What was established? A quick analysis of the datasets allowed us to merge previously separate clusters and find connections between several branches of fund movement. This includes links that were not possible to reliably establish from on-chain analysis alone without additional data from Wagyu. Another interesting point is that it is in the data we found operations that Wagyu itself labeled hacks and thefts. So the platform has systems that can detect suspicious transactions. At the same time the respective orders are in status “Executed”. The natural question is when did Wagyu decide these operations were linked to illegal activity? Perhaps the analysis was performed after the deals were completed. If yes, how effective are the current AML monitoring tools and what does the platform do when it identifies such operations? We hope Wagyu will fix the shortcomings in its procedures and reconsider its approach to cooperating with law enforcement and analytical companies. Separately, we draw the attention of @DCENTWALLETS , @Poloniex , @DEXXai_EN / @DEXXai_CN, @bitget , and Channels Finance. If law-enforcement officials investigating your occurrences still have not obtained the necessary responses from Wagyu, the results of analyzing this data may assist create further linkages and advance the investigations. We will continue studying the datasets, matching transactions with known incidents, and verifying the discovered clusters.