[ANN] pnwd.info — Multi-chain wallet compromise checker

[pwndinfo]

Hello community,

We're excited to announce the public beta launch of pnwd — a multi-chain security intelligence tool built for researchers, security teams, and everyday users.

What does it do right now?

-Verifies if a wallet address has been compromised or flagged as vulnerable
-Aggregates data from public sources, community reports, and on-chain analysis

Supports:
-EVM (Ethereum, Polygon, BSC, Arbitrum, Optimism)
-Bitcoin (BTC & UTXO-based chains)
-Solana
-Sui
-Tron

Our roadmap (coming soon):
    🔍 Real-time tracking of stolen funds movement across chains
    🕵️ Identification of hacker-controlled wallets
    📊 Clustering of addresses linked to the same entity
    ⚡ Automated alerts for suspicious transactions
    📈 API access for security teams

Why we built this:

The Web3 ecosystem is fragmented. Security intelligence shouldn't be. Our mission is to provide transparent, real-time security intelligence for the entire multi-chain world.
We believe that tracking hacker movements and exposing their wallet networks is the next step in making crypto safer for everyone.

Today is a test launch.

Try it out, break it, and tell us what you think.

A few answers to questions.
- Seed phrases and private keys are collected from cloud logs (these are already hacked wallets; they are needed to identify the hackers' wallets and build the subsequent chain (stage 3)).
- Some wallets were untouched and are assigned the status "vulnerable." It is assumed that access to their seed phrases or private keys was not obtained, but it is possible that this is simply a Ledger wallet.
- Three free checks are issued per IP address every day; when authorizing using Phantom Wallet, three checks are issued.


 Website: https://pwnd.info
 Twitter: https://x.com/pwnd_info
 Telegram: https://t.me/pwndinfo
 Discord: https://discord.gg/PEFtkRcSe

[hugeblack]

-Verifies if a wallet address has been compromised or flagged as vulnerable
-Aggregates data from public sources, community reports, and on-chain analysis

What do you mean by that? And what does "hacked" mean? If an address is hacked, it will be easy to identify.
Wouldn't it be better to link the verification to addresses associated with scam or dark activities?

Why are recent checks publicly available? It would be easy to record all addresses.

[macson]

I just checked your domain, and I found that it's less than a month old.



Anyone with a brain in their head wouldn't want to connect their wallet to this website, because it's so suspicious.

And also $0.20 per check? lol

[pwndinfo]

-Verifies if a wallet address has been compromised or flagged as vulnerable
-Aggregates data from public sources, community reports, and on-chain analysis

What do you mean by that? And what does "hacked" mean? If an address is hacked, it will be easy to identify.
Wouldn't it be better to link the verification to addresses associated with scam or dark activities?

Why are recent checks publicly available? It would be easy to record all addresses.

Hacked means the private key or mnemonic is publicly available. This is only the starting point for constructing chains of funds and identifying hackers' wallets.

[joniboini]

Another confusing term for me is "vulnerable". On your website it says "data available, not yet exploited". Does this mean the private key related to the address is available somewhere, but the hacker has not yet moved the funds? That sounds unlikely. Is it related to wallet exploits and whatnot? But how can you tell an address is generated by X or Y just by connecting it through a web3 dapp typing it? If you're saying the address is flagged for suspicious activity, then vulnerable isn't the right term either. CMIIW.

[pwndinfo]

Another confusing term for me is "vulnerable". On your website it says "data available, not yet exploited". Does this mean the private key related to the address is available somewhere, but the hacker has not yet moved the funds? That sounds unlikely. Is it related to wallet exploits and whatnot? But how can you tell an address is generated by X or Y just by connecting it through a web3 dapp typing it? If you're saying the address is flagged for suspicious activity, then vulnerable isn't the right term either. CMIIW.

Much data is obtained from so-called log clouds, which contain wallet files. Once decrypted, an attacker obtains the seed phrase or private key, depending on what was added to the wallet. "Vulnerable" means, for example, that your MetaMask wallet was leaked into such a database, but it couldn't be decrypted (the password wasn't cracked). Hardware wallets like Ledger that were imported into a wallet (MetaMask, etc.) but don't contain the private key or seed phrase could also end up here.

[joniboini]

"Vulnerable" means, for example, that your MetaMask wallet was leaked into such a database, but it couldn't be decrypted (the password wasn't cracked).

I think you need to put it in a faq somewhere on your website. There's a high chance someone would misunderstood if the explanation is limited to 3-4 words. I don't think making a faq is that troublesome either. If anything most modern services have them to answer most common questions nowadays. Especially when some features on your roadmap involves a lot of things that might increase users' curiosity.

[hugeblack]

Hacked means the private key or mnemonic is publicly available. This is only the starting point for constructing chains of funds and identifying hackers' wallets.

I don't know, but who uses a wallet address that was not generated locally? Or those online available? If these wallets are used, they will be emptied in seconds.

"Vulnerable" means, for example, that your MetaMask wallet was leaked into such a database, but it couldn't be decrypted (the password wasn't cracked). Hardware wallets like Ledger that were imported into a wallet (MetaMask, etc.) but don't contain the private key or seed phrase could also end up here.

Do you mean .ldb or vault.json file via "info-stealer" malware? If so, you will not have much time before withdrawing your coins. As for hacking encrypted wallet file, it is useless if it is encrypted with a strong password.

[pwndinfo]

Do you mean .ldb or vault.json file via "info-stealer" malware? If so, you will not have much time before withdrawing your coins. As for hacking encrypted wallet file, it is useless if it is encrypted with a strong password.

.ldb files
Yes, in this case, the complexity of the password and its use elsewhere plays a huge role.
The database is still being filled, not all hacked addresses have been downloaded yet.

[joniboini]

The database is still being filled, not all hacked addresses have been downloaded yet.

Does it mean it's possible for you to show the source? I've checked some addresses myself but I don't think I can found vulnerable or compromised address that easily, so I can't check the UI. If the database is publicly available, then it's possible for the users to verify it themselves. At the very least I think it's great to satisfy some curiosity.

[pwndinfo]

The database is still being filled, not all hacked addresses have been downloaded yet.

Does it mean it's possible for you to show the source? I've checked some addresses myself but I don't think I can found vulnerable or compromised address that easily, so I can't check the UI. If the database is publicly available, then it's possible for the users to verify it themselves. At the very least I think it's great to satisfy some curiosity.

Source code for what?
I'm planning to add a reporting page and live monitoring to the Solana network soon, based on a known pattern.
Please be patient.

[pwndinfo]

🚀 Update from pwnd.info!

We're making steady progress on our roadmap:

✅ Added 3.5M+ compromised wallets (from seed phrases & keys)
✅ Solana transaction analyzer now live - detects drainers in real-time
✅ Hacker wallet identification system active
✅ Scan results now published publicly
✅ Free scans increased to 50/day
✅ New submission pages for compromised addresses & drained transactions

Check out a sample report:
https://pwnd.info/report/00000000-0000-000d-bd82-391bc5dc802d

Test it out and help us make crypto safer! 🔒

[Mitchell]

Backend unavailable / Report unavailable