Actor Claims to Offer Lithos DEX Database with 173,146 Wallet Addresses
Summary
An actor using the handle ChimeraZ claims to sell a Lithos-associated database listing 173,146 wallet addresses and 50,239 IP addresses. Screenshots document the listing, but the dataset and its source remain unverified.
Key points
- The listing attributes the sale claim to the actor handle ChimeraZ and identifies Lithos.
- It advertises 173,146 records, including 173,146 wallet addresses, 134,325 usernames, 112,436 names and 50,239 IP addresses.
- The claimed dataset spans 142 countries and is described as a 411 MB JSONL archive covering 2025–2026.
- Screenshots document the listing and visible samples, but do not independently verify the dataset, its source, completeness or availability.
- The article says the data could enable user profiling and targeted phishing if authentic.
Article Details
- Victim Organization
- Lithos
- Victim Domain
- lithos[.]to
- Incident Type
- Unverified database sale claim involving alleged exposure of user data
- Data Types Exposed
- Wallet addresses
- Usernames
- Names
- IP addresses
- Social IDs
- Country information
- Wallet-provider fields
- Wallet-chain fields
- Referral codes
- Follow and social metadata
- Affected Records
- 173,146 records claimed; the count is unverified
- Affected Data Size
- 411 MB claimed; unverified
- Operational Impact
- No operational impact or compromise of Lithos systems is confirmed. If authentic, the data could expose user-linked wallet and account information.
- Ransom Or Extortion
- No ransom or extortion is reported. The listing reportedly offered the dataset for sale, with a make-an-offer price and XMR payment requested.
- Claim Status
- claimed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
chimeraz@xmpp[.]is | Contact identifier shown for ChimeraZ in connection with the unverified database sale claim. |