She opened a fresh terminal and ran a WHOIS on the IP. Nothing remarkable. Then she cross-referenced it against known OANDA login IPs from her account’s security log. Three matches over the past two weeks. Each one preceded by a Coinpass login from a different IP—but the same ASN.
Maya plugged the drive into her air-gapped laptop, the one she kept offline for moments exactly like this. The drive had appeared taped to the underside of her usual coffee shop table, wrapped in a napkin with her handle— @ghost_tracer —scribbled in shaky handwriting.
She hadn’t touched that order. Her bot had been offline that night. oanda+coinpass+compromised
But the message writer said “they’re going to kill me.” That wasn’t a threat from a hacker. That was a threat from someone inside the operation.
She looked at the timestamp on the photo. It was from 36 hours before the drive appeared. She opened a fresh terminal and ran a WHOIS on the IP
The subject line was the only thing on the flash drive: oanda+coinpass+compromised . No file name, no folder. Just a single, nameless .txt file waiting inside.
She grabbed her jacket and her lockpicks. The 6 a.m. deadline didn’t leave time to be right. Only time to move. Three matches over the past two weeks
Coinpass next. Login. Withdrawal addresses. A new whitelist entry dated 46 days ago: 0x3F9...aE7 . Labeled “Savings 2.” She’d never labeled anything “Savings 2.” She clicked through the edit history. IP address: 185.165.29.101 . Not her home. Not her VPN. A known residential proxy from Eastern Europe.
She opened a fresh terminal and ran a WHOIS on the IP. Nothing remarkable. Then she cross-referenced it against known OANDA login IPs from her account’s security log. Three matches over the past two weeks. Each one preceded by a Coinpass login from a different IP—but the same ASN.
Maya plugged the drive into her air-gapped laptop, the one she kept offline for moments exactly like this. The drive had appeared taped to the underside of her usual coffee shop table, wrapped in a napkin with her handle— @ghost_tracer —scribbled in shaky handwriting.
She hadn’t touched that order. Her bot had been offline that night.
But the message writer said “they’re going to kill me.” That wasn’t a threat from a hacker. That was a threat from someone inside the operation.
She looked at the timestamp on the photo. It was from 36 hours before the drive appeared.
The subject line was the only thing on the flash drive: oanda+coinpass+compromised . No file name, no folder. Just a single, nameless .txt file waiting inside.
She grabbed her jacket and her lockpicks. The 6 a.m. deadline didn’t leave time to be right. Only time to move.
Coinpass next. Login. Withdrawal addresses. A new whitelist entry dated 46 days ago: 0x3F9...aE7 . Labeled “Savings 2.” She’d never labeled anything “Savings 2.” She clicked through the edit history. IP address: 185.165.29.101 . Not her home. Not her VPN. A known residential proxy from Eastern Europe.