14400 TXN & 78000 RBL

We decided to publish the wallet addresses of the thieves

14400 Transactions & 78000 RBL

These are terrible numbers recorded over just the past 10 days!

This reflects the grim reality caused by thieves on our network. Although very distressing, we choose not to ignore it but rather to be fully transparent with the entire community.

≈ 14400 Transactions

This is an alarming number of transfer orders executed by thieves, from September 30 to October 10.

≈ 78000 RBL

This is the total amount of RBL they have stolen from thousands of miners worldwide. If you are also a victim, please send us your feedback right below this article.

Phishing actors are returning to harvest

THE THEFTS ARE STILL ONGOING

The thefts have not stopped yet. As I am writing this announcement, malicious appropriation activities continue, so the figures above are not yet final.

These haunting statistics are merely preliminary observations recorded as of 13:30 UTC on October 10.

It is unfortunate that we cannot predict who the thieves are, when they will strike, or whose accounts they will target. We can only identify them once the signs of theft are clear, which means the theft has already occurred.

Instead of empty warnings, the most direct action – we have decided to publish the wallet addresses of the thieves. The wallets in this list have been accurately verified by the system as perpetrators of theft.

Below is the detailed statistical image:

• Stolen wallet: The wallet address used by thieves to gather RBL stolen from miners.
• TXN count: The number of theft transactions transferred to each wallet.
• RBL Stolen: The total amount of RBL they successfully appropriated into each wallet.

OLD THIEVES RETURN

This theft appears to be carried out by the very same entities responsible for the 2025 attack. They are holding a list of victims who were successfully phished previously. We believe this may be several individual groups linked together, exchanging and sharing the list of victims they have lured.

Their behavioral pattern is basically as follows:

They use the login information of compromised accounts, initialize a new wallet, and execute the migration of your mined RBL in just a few seconds. Immediately afterward, they transfer the stolen balance to a storage wallet, then proceed to the next stage of liquidating the stolen assets onto the market.

Their operational speed is extremely fast, so we suspect these actors are using automated tools (bots/tools) to support batch logins and asset withdrawals from victim accounts.

WARNING FOR MERCHANTS PURCHASING FROM THIEVES

This is an appeal from the Rubimily community to anyone participating in global P2P trading. We respect you, and trading rights are the personal freedom of every individual.

However, please conduct business responsibly toward the community. Never abet or become a driving force encouraging thieves to continue illegal behavior.

We know that in P2P trading, buyers always work directly with sellers. With business acumen, you can completely distinguish who the thief is among those offering unusually cheap RBL.

We urge merchants: "Resolutely refuse supply from thieves".

You need to understand that blockchain is an environment of truth, and truth can always be traced.

We are a community of millions of global users, and this is a huge potential market for your long-term business. Do not sacrifice your business ethics and sustainable growth potential with the network for a small immediate profit from cheap supplies provided by wrongdoers.

Once again, always remember:

Blockchain is an open ledger publicly recording all transaction data, so the system can always accurately trace the wallet addresses behind the consumption chain.

SANCTIONS FOR VIOLATING WALLETS

Since October 3, when detecting multiple accounts logging in repeatedly and continuously initializing new wallets, we suspected this was the action of phishing actors and immediately updated marking tools to monitor and trace.

Nevertheless, tracing cannot guarantee that thieves will stop automatically. Therefore, we decided to flag the wallets used by thieves and submit the list to the ledger to reject transactions.

Specifically, the measures applied are as follows:

1. For direct thieves:
As soon as the stolen wallet address is identified, we will flag and reject all transactions originating from these wallets.

2. For buyers dealing directly with thieves:
We observe that some traders are continuously taking advantage of cheap supplies from wrongdoers. This inadvertently abets and provides liquidity for theft. Buyer accounts executing 3 or more transactions with thief wallets will be flagged by the system. We will investigate according to community rules and regulations against money laundering (AML) and terrorist financing.

3. For buyers purchasing from merchants:
For buyers acquiring for personal storage or investment purposes, we currently do not apply any sanctions. However, we recommend that you ask sellers to commit to a fully "clean" supply. This will protect the Rubi miner community and help your held assets grow sustainably in value.

CONTINGENCY SCENARIO FOR WORSE CASES

Honestly, even I cannot predict how high the damage figures might rise in the coming days, as phishing actors show no signs of stopping their harvesting of victims.

We have tried to prepare contingency plans, but frankly, the development team is always in a passive position. We can only chase after incidents to react, meaning we only have grounds to act after a theft has occurred.

We are like firefighters, only able to put out fires once they have broken out.

However, we understand clearly that if we always act after the fact, the community will face very regrettable consequences. Therefore, we have decided to set limit thresholds to prioritize maximum protection for the miner community.

SECURITY LIMIT THRESHOLDS:
We have agreed on October 15 as the time to synthesize a comprehensive report on this attack wave.

If damages exceed 100,000 RBL:
The planned expansion of the migration limit on October 15 will be canceled. The migration limit will remain unchanged as it is now until the Face Verif feature is officially deployed.

If damages exceed 200,000 RBL:
To protect assets for miners who have not been harvested, the migration portal will be closed once again until thorough security measures are put into operation.

MINERS MUST PROTECT THEMSELVES

The Rubi Network is currently in a period similar to the upcoming "Rubi Pizza" event about to take place.

Miners who have spent time and effort seriously participating in this network, please proactively protect your own assets and accounts.

We have witnessed the lesson of "undervaluing potential assets" many times in the past, and every time it leaves regret later. Why not try to fix it today with Rubi Network?

Because we are standing right before the turning point of "Rubi Pizza"!
What more can I say if you remain indifferent to protecting the RBL you have perseveringly mined every day?

If you continue to downplay the assets accumulated from Rubi Network, you will very easily miss major opportunities in the future.

The development team is working hard every day to add tools to fight against attackers. But we cannot guarantee that we can protect you when you do not even wish for it yourselves.

Therefore, I urge all miners to secure their accounts immediately – absolutely do not give phishing actors any opportunity to access them.

.⚠︎. WARNING: Never use strange applications to scan Rubi wallet private key QR codes, because those apps can silently take photos and steal your security information.

A CALL TO ACTION FOR THE MINER COMMUNITY

Ensuring safety for the entire network requires joint action from all miners.

If there are only isolated efforts from developers, all endeavors will not be thorough. On behalf of the development team, I call on the community to join us in taking decisive actions to fight against attackers and protect our shared network.

Remember: Thieves are targeting you because you hold assets of immense potential value!

2 THINGS YOU NEED TO DO RIGHT NOW:

1 ) - Protect your personal account information
Protect your account and wallet in the best way possible: Change your password, enable 2FA authentication, and treasure the fruits of your own labor.

2 ) - Report the thieves
As soon as you have evidence of their crime: Anything you can post in the comments of this article, we can use to review as evidence against them.

ANDY & TEAM

Donate to the article #26374 (Rubi wallet only)