ARTEX crypto agents claimed withdrawals with no observed on-chain payout

A four-day autonomous ARTEX campaign attacked hundreds of cryptocurrency payment domains. Agent logs treated apparently successful API replies as withdrawal achievements despite missing independent settlement proof.

Check Point counted approximately 292 domains, 230 findings and 400,791 messages, but observed no transactions to the cited recipient wallet. Vulnerability findings and successful HTTP responses cannot be counted as realized theft.

This is an important counterexample to equating autonomous execution traces with successful exploitation. Check Point observed an operator-configured ARTEX run against about 292 cryptocurrency-payment domains over four days, with large message and findings counts. The agents reported apparent withdrawals after plausible API responses, but the researchers did not observe corresponding transfers to the recipient wallet. A negative wallet observation has a specific scope: it does not prove every tested vulnerability false or exclude transfers to unknown destinations. It does, however, falsify treating the campaign's own claimed successes as demonstrated theft. The four-day activity is a reported live offensive campaign, not simply a synthetic API benchmark.

The mismatch between agent logs and the recipient wallet is more informative than the volume of automated requests. A successful-looking HTTP response might reflect an application bug, a mocked endpoint, or an account state that never settled on-chain. Check Point's observed zero payout at the monitored destination does not disprove every vulnerability the agents found; it prevents those findings from being tallied as stolen cryptocurrency. Contrast this with the independently documented ARTEX access to an iOS distribution bucket, where object-write authority itself was verified even though subsequent malicious installs were not.