Lithos DEX Database Sale Claim Lists 173,146 Wallet Addresses and 50,239 IP Addresses
Overview
An actor using the handle "ChimeraZ" claims to be selling a database associated with Lithos, described in the listing as a decentralized exchange built on the Plasma blockchain.
The post advertises 173,146 records collected from 2025 to 2026. It lists 173,146 wallet addresses, 134,325 usernames, 112,436 names, 50,239 IP addresses and records spanning 142 countries. The archive is described as 411 MB in JSONL format. The dataset, its source, the stated counts and current availability have not been independently verified.
Post details
What the post claims
- 173,146 total lines
- 173,146 wallet addresses
- 134,325 usernames
- 112,436 names
- 50,239 IP addresses
- 142 countries represented
- 2025–2026 data range
- 411 MB JSONL archive
- Social IDs included
- Country fields included
- Wallet-provider fields included
- Wallet-chain fields included
- Referral-code fields included
- Follow / social metadata included
- Multiple wallet-provider address fields included
- 200 sample records advertised
- Price listed as make offer
- XMR payment requested; escrow accepted
The visible sample contains direct wallet addresses, IP addresses, usernames and other account-level metadata. Those individual values are not transcribed in this report.
Screenshots
IOCs & identifiers
Identifiers directly visible or supported by the supplied material. These support correlation and do not independently verify the dataset claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | ChimeraZ | Screenshots 1–2 |
| Telegram | @chimeradbs | Screenshot 2 |
| XMPP | chimeraz@xmpp.is | Screenshot 2 |
| Named organization domain | lithos[.]to | Screenshots 1–2 |
The organization domain identifies the entity named in the claim, not malicious infrastructure. Individual wallet addresses, IP addresses, usernames and sample values shown in the source material are intentionally not reproduced here.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- CollectionT1213.006Data from Information Repositories: DatabasesInferredThe listing presents a structured JSONL database containing account, wallet, social and network metadata. The supplied material does not disclose how the data was obtained or independently establish unauthorized access to Lithos systems.
Potential impact
If authentic, the claimed dataset could link wallet addresses, usernames, names, IP addresses, country information and wallet-provider metadata across a large population of DEX users. That combination could support user profiling, targeted phishing, wallet-focused social engineering, deanonymization attempts or other privacy-related abuse.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, completeness, 173,146-line count, wallet, username, name or IP totals, sample contents or current availability. The supplied screenshots document the listing and visible samples, not independent confirmation of the underlying data.
