HOP 1/4 · SOURCE
Trace
Start at the exploit. Follow every hop, not just the big ones.
01 / ABOUT
Hello
Onchain Risk Analyst at Bybit, focused on blockchain forensics, DPRK/Lazarus Group attribution, and exploit response. I was part of the team responding to the $1.46B Bybit hack in Feb 2025.
Day to day I trace funds across BTC, ETH, TRON, SOL and BSC, and build the monitoring tools my team relies on: cross-chain bridge reconciliation, token supply checks and smart contract anomaly detection. I also build a lot of internal AI tooling for investigation work, including custom MCP servers and agent skills.
// CS grad · speaker · builder · occasional shitposter
INVESTIGATINGOnchain risk at Bybit
BUILDINGTraceOps Labs agent & MCP servers
LANGUAGESEnglish · Mandarin · Malay
SKILLS
FORENSICS & INTEL
ChainalysisTRM LabsEllipticAMLBot TracerArkham IntelligenceExplorers (EVM, Solana, TRON, HyperEVM)
CHAINS
EthereumBitcoinTRONSolanaBSCHyperEVMArbitrumEVM L2s
TECHNIQUES
Peel chain tracingMixer demixing (Wasabi CoinJoin, Tornado Cash)Cross-chain bridge analysisDEX swap & liquidity flow tracingEntity clustering & attributionWallet behaviour analysis
ENGINEERING
PythonSQLFastAPIReactSQLiteGitHub ActionsDune AnalyticsMCP serversLiteLLMCloudflare WorkersGoogle Apps Script
EDUCATION
BSc Computer Science · Asia Pacific University of Technology & Innovation · CGPA 3.3
Foundation in Computing Technology · Asia Pacific University of Technology & Innovation · CGPA 3.92
02 / INVESTIGATIONS
Investigations
Fund tracing, attribution and freeze requests across BTC, ETH, TRON, SOL and BSC.
HOP 2/4 · PEEL
Cluster
Group addresses by timing, behaviour and shared control until the noise becomes a shape.
HOP 3/4 · BRIDGE
Cross
Resolve bridges and swaps so a change of chain doesn’t end the trail.
HOP 4/4 · OFF-RAMP
Attribute
Land on the exchange, the deposit address and the freeze request.
WORK IN THIS AREA
BYBIT · FEB 2025
$1.46B Bybit hack response
Part of the onchain forensic response, tracing funds across Ethereum, Bitcoin and TRON and writing freeze request reports for exchanges, stablecoin issuers and law enforcement.
DPRK · LAZARUS GROUP
Laundering pattern analysis
Wasabi CoinJoin demixing, Tornado Cash deposit and withdrawal correlation, and tracking how funds bounce across bridges to break attribution.
FREEZES · POST-MORTEMS
Freeze requests & exploit post-mortems
Filed freeze requests across multiple chains with Tether, CEX compliance teams and bridge operators, and wrote post-mortems on major exploits as a team reference.
WORKED WITH · AMLBot Tracer · Chainalysis · TRM Labs · Elliptic · Arkham Intelligence
03 / PROJECTS
Things I’ve built
01 · AI · INVESTIGATIONS
TraceOps Labs Agent
Agent-driven Telegram bot for onchain investigations. Uses MCP tooling to handle fund tracing, attribution and forensic report writing for internal risk work.
TelegramMCPAgents
02 · MONITORING · BRIDGES
Cross-Chain Bridge Reconciliation Monitor
Production monitor that catches supply invariant violations across LayerZero OFT and bidirectional adapter pairs (wBTC OFT mesh included). Runs on GitHub Actions with Lark alerts.
LayerZero OFTGitHub ActionsLark
03 · AI · TOOLING
Custom MCP Servers & Investigation Skills
A growing library of MCP servers and reusable agent skills for onchain forensics, monitoring and analysis. Used across Claude Code, Codex CLI and internal agents to take the manual grind out of daily investigation work.
MCPAgent skillsClaude CodeCodex CLI
04 · AI · EVALUATION
LLM Forensics Benchmark Harness
Evaluation harness that scores LLMs on MCP-driven forensic tasks against real exploit cases as ground truth.
GPTDeepSeekQwenKimi
04 / EXPERIENCE
Where I’ve worked
| Dates | Role | Org | Description |
|---|---|---|---|
| DEC 2024 – PRESENT | Onchain Risk Analyst | Bybit · Kuala Lumpur | INVESTIGATIONS & FUND RECOVERY
ONCHAIN MONITORING
AI TOOLING
|
| NOV 2023 – JUN 2024 | Product Assistant | CoinGecko · Kuala Lumpur | Led the API documentation migration from Swagger to Readme.io, lifting developer onboarding efficiency by around 30% and cutting API-related support tickets by 20%. Rebuilt the OpenAPI spec with proper examples, interactive calls and consistent schemas, and handled technical support on Twitter and Discord. |
| APR – AUG 2023 | Operations Intern | CoinGecko · Kuala Lumpur | Ran backend data analytics for token listings, market mappings and circulating supply updates, and cleaned up the stablecoin classification system and category naming. |
05 / COMMUNITY
Community
| Dates | Role | Org | Description |
|---|---|---|---|
| AUG 2024 – JUN 2025 | DevRel & Partnerships | Superteam Malaysia | Wrote technical content and gave talks on Solana to developer and student audiences. Ran academic partnerships connecting universities with the Solana ecosystem, and mentored students through hackathons. |
| OCT 2023 – JUN 2024 | Ambassador | Arbitrum Foundation | Ran educational meetups and hands-on coding sessions on Arbitrum, L2 architecture and DApp development. |
| SEP 2021 – JUN 2024 | External Relations / Research / Community Lead | APU Blockchain & Cryptocurrency Club | Brought in partnerships with 5+ industry players (Starknet, Ethereum Foundation / Devcon, Pendle, Mantle) and landed grants including Road to Devcon and the Arbitrum Ambassador program. Ran research and content, hosted AMAs and built the Discord community from nothing. |
06 / CONTACT
Let’s talk
Open to research collabs & consulting.