zachxbt

"On-Chain Detective" ZachXBT stated that he once disguised himself as a client to infiltrate a criminal gang suspected of laundering money for the North Korean-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack incident.ZachXBT indicated that after Bybit was attacked for $1.5 billion in February 2025, he discovered over 15 accounts seeking help with transactions related to the stolen funds in public Telegram and Discord groups. He then contacted a Telegram user using the alias "Jimmy Green" and built trust through multiple transactions.According to his disclosure, on March 6, 2025, he transferred $3.497 million USDC to an Ethereum address for exchanging USDC with TRON chain USDT. The Gas funds for that address trace back to the Bybit attack funds and have been publicly marked as a Bybit attack blacklist address.ZachXBT stated that in subsequent communications, the other party revealed that their team had participated in handling the stolen funds from Bybit and disclosed in advance that the funds would be transferred on chains such as Solana. By matching transaction times, amounts, and on-chain data, he discovered a wallet cluster involving over $12 million of Bybit attack funds, with funding paths including BTC→ETH→SOL→TRON and others, among which approximately 442,000 USDT had been frozen by Tether. The gang also attempted to launder money through Uniswap liquidity pools and low liquidity tokens.In addition, the other party revealed that they had helped other clients handle approximately $3 million in scam proceeds, and ZachXBT tracked the related funds flowing to sanctioned Huione Guarantee-related wallets.ZachXBT disclosed that during this investigation, he initially invested $3.497 million and bore about 5% loss risk for each transaction. The intelligence obtained was promptly provided to relevant investigative agencies and law enforcement. Since 2022, he has assisted in freezing over $75 million related to North Korea-related incidents.

ZachXBT posted on platform X that UPay may allow the sanctioned illegal market Xinbi to issue its Visa crypto card and requested UPay to clarify the situation.ZachXBT stated that Xinbi is mainly involved in pig butchering scams, fraud, money laundering, and human trafficking.

CoinBureau cites on-chain investigator ZachXBT, stating that suspected North Korean attackers are using Zcash to obscure the stolen funds from Bitget. Approximately 2,700 ZEC, worth about 3.8 million dollars, have begun to be transferred to Zcash's Ironwood.These stolen ZEC are being moved into a shielding pool, where transaction details can be hidden. In a security incident involving various assets totaling about 388 million dollars, approximately 18,900 ZEC, worth about 28.3 million dollars, were stolen. Previously, Bitget's CEO Gracy Chen expressed that she is "not very optimistic" about recovering the stolen funds.

According to on-chain analyst ZachXBT, the recently launched 10K PFP NFT project zkSNARKs on the Zcash chain is suspected of being a rug pull. The project attracted a total of 16,971 bids through a blind auction, ultimately settling at a clearing price of 1.5 ZEC (approximately $2,190) for 8,000 allocations, with a total transaction volume reaching 25,305 ZEC (approximately $36.94 million), and refunds of 13,309 ZEC (approximately $1.943 million) have been gradually returned.ZachXBT pointed out that the project raised about $17 million, while reserving 10% for the team, 5% for royalties, and approximately $2,000 for minting fees, yet it has no practical value, resembling the common "money grab and run" tactics used in the Ordinals series.

On-chain detective ZachXBT posted that the wallet address associated with 7zarc has received 4,870 ETH (approximately 15 million USD), with the funds originating from addresses related to the Raidparty project's approximately 70 million USD "exit scam." Subsequently, this portion of ETH was transferred to recharge addresses of several centralized exchanges.ZachXBT pointed out that 7zarc disappeared from public view in 2022 and only became active again in September 2026. Based on this, he publicly questioned the need for an explanation regarding the flow of the related funds.

On-chain detective ZachXBT posted on his personal channel that Revolut allegedly leaked some users' personal identifiable information (PII) due to failing to recognize a forged government agency information request.According to his disclosure, Revolut previously received a request for customer information retrieval that appeared to come from a real government agency and was sent through the agency's official email domain. Because the email had valid domain authentication information, Revolut believed the request was legitimate and responded accordingly.The potentially involved data includes users' names, birth dates, occupations, addresses, email addresses, and phone numbers, as well as copies of passports or driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transaction records. Revolut stated in the notification sent to users that no biometric facial telemetry data was leaked.ZachXBT indicated that the scale of the incident may currently be limited, but it appears to primarily target high-net-worth users. Several Revolut users received notifications regarding the related security incident yesterday. Revolut officials had previously reminded users to verify suspicious information through in-app customer service to avoid providing personal or financial information.

According to on-chain detective ZachXBT's post on his personal channel, Revolut allegedly failed to identify a fraudulent request, resulting in the personal identification information (PII) of some users being leaked. The leaked information includes copies of passports or driver's licenses and verification selfies, account statements, IBANs, withdrawal records, complete transaction histories including Bitcoin transactions, as well as names, birth dates, occupations, home addresses, email addresses, and phone numbers.ZachXBT stated that the number of affected users may be limited, but it appears to target high-net-worth individuals. It is reported that several Revolut users received related security alert emails yesterday.

On-chain investigator ZachXBT posted on X accusing user "Mr Austin Fine" (account "@xmrfine") of exchanging the stolen cryptocurrency assets of victim Malone for luxury goods in exchange for fees, stating that he "may be a whistleblower." ZachXBT indicated that until the victim is compensated, he will consider him "disassociated," which will negatively impact all current and future brand collaborations.ZachXBT later added that he has traced part of the funds on-chain flowing through Monero to purchase cars from the luxury car dealer TBTFW in Los Angeles.

According to on-chain detective ZachXBT's monitoring, multiple verified WOO X users have recently reported that their withdrawals have remained in "pending" or "processing" status for the past three days. WOO X is incubated by Kronos Research and was acquired by FusionX Digital in the fourth quarter of 2025, which is reportedly associated with BitMart founder Sheldon Xia.Previously, BitMart announced the cessation of operations and restructuring on July 26, 2026, with some user funds still unable to be withdrawn, leading to an increase in related complaints on the X platform. Sheldon Xia has stated that user asset security is a priority, but this claim has not yet been independently verified. As of now, WooX has not issued a public statement regarding the withdrawal delay issue.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

On-chain detective ZachXBT stated that after reviewing relevant evidence, he found that two American investment platforms, BitcoinIRA and iTrustCapital, allegedly experienced data breaches this year, but neither seems to have publicly disclosed it yet. The leaked information reportedly includes personal details, portfolio, bank and custody account information, verification status, and more.He cited an example where the attacker "Tiffany" targeted a BitcoinIRA user using the relevant database in June this year and stole over $1.2 million. ZachXBT indicated that he contacted both companies for comments on August 21, but had not received a response by the time of publication.

BitMart founder Sheldon stated that regarding the public accountability statement released by a BitMart employee through the official Twitter account, he has completed the collection of evidence related to the content and claims that the information is all false. Sheldon indicated that he will report to the police during the day in the United States and send a lawyer's letter to the X platform, requesting technical and data evidence collection regarding the relevant content. Sheldon also stated that employee assets do not take precedence over customer assets, and everyone is a customer, with no privileges existing. Previously, BitMart employees publicly questioned the whereabouts of platform assets and related handling situations. Sheldon had previously stated that he would respond to the whereabouts of platform assets by the 19th.Blockchain investigator ZachXBT posted on the X platform questioning the BitMart exchange. In response to the relevant account, he stated that if BitMart indeed has sufficient liquidity, it should directly return the funds to all users instead of issuing vague statements. ZachXBT pointed out that BitMart's related actions have caused real users to be unable to use their funds normally, and there is insufficient transparency. This statement has raised market concerns about the safety of the exchange's funds and operational transparency.

On-chain detective ZachXBT posted that U.S. threat actor Tiffany Milanovich participated in the theft of approximately $5 million in crypto assets by impersonating hardware wallet and centralized exchange customer service.Her methods included disguising as Bitcoin IRA email support, during one attack transferring about $1.2 million in BTC and ETH from the victim's Trezor wallet, and in another case stealing about $500,000 in BTC from a Coinbase account. Tiffany induced victims to hand over access to their funds under the guise of "customer service calls," later boasting about the stolen money on social media and Telegram groups, mocking victims with recordings, and collaborating with other threat actors to launder money using phishing panels and instant exchange services, with some of the stolen funds still dormant on-chain.The threat actor codenamed "Tiffany" is suspected of participating in multiple crypto asset thefts, gambling the stolen funds at crypto casinos. The platform Shuffle has frozen related accounts based on evidence submitted by ZachXBT; Tiffany previously shared a search and seizure warrant from Connecticut, dated before some of the incidents involved.ZachXBT has obtained chat logs, recordings, and on-chain evidence, anticipating that this individual may face further legal consequences. This threat actor is also linked to the John Daghita (Lick) case, who is suspected of stealing over $46 million in crypto assets from a U.S. government-seized wallet.

On-chain data shows that cryptocurrency theft suspect Dritan Kapllani Jr laundered 126.7 ETH again on July 22, worth approximately $239,000.Previously, on-chain detective ZachXBT revealed that Dritan Kapllani Jr is suspected of stealing assets from cryptocurrency holders through social engineering techniques, with a total amount involved reaching $19 million. Dritan Kapllani Jr has long showcased a lifestyle featuring luxury cars, high-end watches, and private jets on social media, and publicly displayed assets worth $3.68 million in his Exodus wallet during a Discord call on April 23, 2026.

According to The Block, Trezor's Chief Business Officer Danny Sanders refuted recent criticisms of cryptocurrency hardware wallets made by blockchain investigator ZachXBT.Earlier this week, ZachXBT posted on Telegram, "All hardware wallets are complete garbage and I do not recommend using them for important tasks such as signing transactions or storing funds," and suggested that users use a dedicated iPhone to store funds and sign transactions.In response, Sanders acknowledged in an interview that firmware/software updates for hardware wallets can sometimes interfere with urgent or large transactions, and that the user experience can indeed be "clunky," understanding the users' frustration. However, he opposed ZachXBT's blanket statement: while hardware wallets may not be the best single solution for advanced users managing large amounts of funds, they are not garbage.He pointed out that compared to hardware wallets, the operating system and connectivity features of an iPhone present more "attack risks." For the average cryptocurrency user, hardware wallets remain the best self-custody option available.

On-chain detective ZachXBT updated on X that an entity initially funded by the LAB team deposited 18.4 million LAB into Aster, approximately 18.3 million USD, and sold it on the DEX spot market, causing the LAB price to drop again by 54%, from 1.2 USD to 0.55 USD.ZachXBT stated that this entity transferred LAB to 3 Aster deposit addresses between July 10 and 11, and currently holds about 81.5 million LAB. He added that the entity received over 196 million LAB from the LAB team in April 2026, subsequently transferred to a Bitget address, and withdrew from Bitget to 10 addresses between May 11 and 12.ZachXBT has previously questioned the existence of market manipulation and insider supply issues with LAB, claiming that one of the multi-signers from the LAB team had financial ties to addresses related to RIVER manipulation, and pointed out that nearly 226 million LAB was deposited into Bitget between March and April.

On-chain detective ZachXBT posted that an early whale address related to the initial allocation of the Solana genesis block was suspected to have been attacked a few hours ago, with approximately 180,900 SOL (about 14.2 million USD) stolen.ZachXBT stated that in collaboration with the on-chain investigation agency Specter Investigation, they discovered abnormal unstaking and cross-chain operations to Ethereum while tracking unusual fund flows, and subsequently confirmed that the related assets had been transferred.Currently, the involved victim address and several suspected theft addresses have been made public, and the specific method of attack and the whereabouts of the funds are still under further investigation.

On-chain investigator ZachXBT posted that the LAB token has dropped from $14 to less than $2 in the past 24 hours, a decline of about 85%, with the fully diluted valuation (FDV) significantly shrinking from about $14 billion.ZachXBT expressed disappointment that Binance, Bitget, and Gate failed to take measures in advance to prevent price manipulation, stating that if centralized exchanges truly valued user interests, they should at least return the profits from accounts suspected of manipulating the market to the users. He also pointed out that LAB investors were originally scheduled to start unlocking tokens later this month, but the vesting arrangements have been modified multiple times before, with insiders controlling almost the entire circulating supply and implementing extreme price manipulation through market makers on centralized exchanges. Therefore, he "does not recommend trading LAB under any circumstances."

On-chain detective ZachXBT stated on X that unless the case involves recent events, each victim has lost more than $250,000, the jurisdiction is favorable, the relevant chain supports their work, and it does not involve meme coins or prediction markets, they will not review or respond to related case requests.

On-chain detective ZachXBT disclosed on his personal channel that a hacker extracted approximately 3,200 ETH through Tornado Cash between July 2 and 3. The funds are related to two private key leakage incidents. The address subsequently used Circle's CCTP cross-chain bridge to launder approximately $5,500,000 in assets across chains and further transferred USDC to seven deposit addresses on the Arbitrum network.ZachXBT pointed out that the flow of funds exhibits a typical decentralized money laundering path, utilizing mixing tools and cross-chain infrastructure to reduce tracking difficulty. Currently, the related on-chain assets are still in circulation.