[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]

@zachxbt "@Awkw4rd01 @eyeonchains @GarrettBullish This is not new information as @emmettgallic already revealed the transfer from the HL whale to Garrett Jin two days ago. The only direct connection is a 40K USDT transfer and everything else in this post is unconfirmed theories. It seems more likely to be a friend of Jin"
X Link @zachxbt 2025-10-12T04:53Z 915K followers, 4857 engagements

"@onchainjesse Thanks I realize its been almost a month since my last post so to make up for it tomorrow at X pm UTC Ill publish an investigation on a X fig exploit"
X Link @zachxbt 2025-10-14T17:55Z 915K followers, 20.6K engagements

"Nine hours ago a suspicious transfer was made from a potential victim for 3520 BTC ($330.7M) Theft address bc1qcrypchnrdx87jnal5e5m849fw460t4gk7vz55g Shortly after the funds began to be laundered via 6+ instant exchanges and was swapped for XMR causing the XMR price to spike 50%"
X Link @zachxbt 2025-04-28T07:30Z 915K followers, 3.5M engagements

"@LBank_Exchange Nothing to see here just XXX% legitimate accounts engaging with the post"
X Link @zachxbt 2023-03-20T13:44Z 915K followers, 16.5K engagements

"@CodeXBT Either them or another entity who transferred them the BTC"
X Link @zachxbt 2025-10-14T15:56Z 915K followers, 13.6K engagements

"@deltaxbt Reminder Ash Crypto is a scammer (changed his username after my post)"
X Link @zachxbt 2025-03-16T16:25Z 915K followers, 374.3K engagements

"@ICEBOYBILL @OpenVPP Same influencers who were pushing the depin / ai / gpu tax farms earlier this cycle"
X Link @zachxbt 2025-09-17T15:42Z 914.9K followers, 11.8K engagements

"10/ Still one of the more common questions is how do you know they are North Korean Well besides all of the fraudulent documents detailed above their search history showed frequent Google Translate usage with translations to Korean with a Russian IP"
X Link @zachxbt 2025-08-13T12:55Z 915K followers, 196.2K engagements

"11/ I do not blame all Coinbase employees as most of the fault lies on leadership for these decisions. While this post is critical of Coinbase what have they done well providing good stablecoin on-ramp / off-ramp for retail attracting talent to build on Base recovery tool for users who deposit unsupported assets fighting the SEC Coinbase custody product allowing users to passively earn yield on stables easily (Also theres only so much you can do to educate people about threats such as email/call spoofing)"
X Link @zachxbt 2025-02-03T13:50Z 914.8K followers, 101.1K engagements

"@PeckShieldAlert @THORChain The wallet likely belongs to @jpthor who had a private wallet compromised due to a fake meeting scam a few days ago. JP is one of the people whose has greatly benefited financially from the laundering of DPRK hacks/exploits. So its a bit poetic he got rekt here by DPRK"
X Link @zachxbt 2025-09-12T08:14Z 915K followers, 33.3K engagements

"Need someone to build a service that scrapes users from Ka1to Y@ps GaIxe Layer3 WalIChain etc so you can easily block all of them on X. These platforms are the main culprits for the AI generated slop on the feed posts and replies. Would happily pay for such a service and itd probably have a high success rate"
X Link @zachxbt 2025-10-02T07:28Z 915.1K followers, 28.6K engagements

"@BarryBaumer @exit_liquid @thomahov Interesting"
X Link @zachxbt 2025-01-27T15:37Z 914.8K followers, 92K engagements

"Update: Crypto Beast just reactivated his account and changed his username to @realcryptoelio a few minutes ago"
X Link @zachxbt 2025-08-06T08:26Z 915K followers, 170.7K engagements

"@Steam You clowns allow malware on your platform that has resulted in $150K+ stolen from victims (fake game has been available to download for more than a month)"
X Link @zachxbt 2025-09-21T15:57Z 915K followers, 449.4K engagements

"3/ Here is a private video recording showing the live reaction by multiple of the threat actors to receiving $238M. Theft txn hash 4064 BTC - Aug XX at 4:05 am UTC 4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090"
X Link @zachxbt 2024-09-19T13:04Z 915K followers, 1.3M engagements

"9/ I believe that when a team hires multiple DPRK ITWs it is a decent indicator for determining that startup will be a failure. Unlike other threats to the industry DPRK ITWs have little sophistication so its mainly the result of a teams own negligence. I think the prevalence of them is due to being cheap and the lack of available talent as well as high valuations that resulted in incompetent founders who received funding"
X Link @zachxbt 2025-07-02T12:35Z 915K followers, 173.8K engagements

"@pumpfun_tv @sampepper @SamPepperClips Those who were here last cycle remember Sam Pepper was a massive scammer"
X Link @zachxbt 2025-09-27T07:38Z 915K followers, 51.9K engagements

"@HyperliquidX Wen half decent block explorer or analytic tools for Core"
X Link @zachxbt 2025-10-15T08:03Z 915K followers, 78.2K engagements

"@eyeonchains @Awkw4rd01 @GarrettBullish @emmettgallic You definitively say in your post the Bitcoin whale is Garrett Jin and now in your reply to me say these are certainly BTC from multiple entities"
X Link @zachxbt 2025-10-12T05:54Z 915K followers, 3996 engagements

"1/3 A threat actor has stolen $500K over the past month by compromising 15+ X accounts (Kick Cursor Alex Blania The Arena Brett etc) from sending targeted phishing emails which impersonated the X team to steal credentials and then launch meme coin scams"
X Link @zachxbt 2024-12-24T13:08Z 915K followers, 989.1K engagements

"7/ Alex Labs was hacked for $4.5M in May 2024 by Lazarus Group. One of the theft addresses deposited XXX ETH to a privacy protocol on June XX 2024 0xc0a0ec4dbf170611cc76f31a9df910ad79bc2266 Matching amounts were withdrawn the same day to two addresses 0x9fc1350f80734044b7189fe7b8f288396f76feb5 0x21c926a1a328a4906feeb18664d00f3d85df1aed Another theft address deposited XXX ETH from June 27-28th 0x1871bb6257b1f622548ef64a12ae5149eb208bd8 Shortly after a matching amount was withdrawn commingling with the Irys co-founder stolen funds. 0xddb2e9feaf0a122b43be14bc085cf713703ce45c On August 13th funds"
X Link @zachxbt 2024-10-23T12:51Z 915K followers, 103K engagements

"A recent cyberattack on the Central Bank of Brazil services provider C&M resulted in a breach to the reserve accounts of six financial institutions where attackers converted stolen fiat to crypto. I began working on an initiative that has helped freeze $5M across multiple exchanges and blockchains. A special thanks goes to @Tether_to @Binance Security Team @Bitso @Bybit_Official Compliance Team & @CFInvestigators. Collaboration within the private sector is the most effective way to combat illicit activity and push our industry forward"
X Link @zachxbt 2025-07-14T10:19Z 915K followers, 369.5K engagements

"@arkham TLDR myself and Josh from CF connected the Bybit hack on-chain to the Phemex hack"
X Link @zachxbt 2025-02-21T20:27Z 914.8K followers, 539.8K engagements

"@inversebrah Future outlook for K@ito W@llchain Ga1xe L@yer X farmers who dedicated their lives to AI slop"
X Link @zachxbt 2025-10-08T12:26Z 915K followers, 26.1K engagements

"@bitforexcom 1) What"
X Link @zachxbt 2024-07-19T15:02Z 915K followers, 22.1K engagements

"@lmeowcoineth @basedkarbon Because if you do not reply they keep tagging you in posts and sending DMs"
X Link @zachxbt 2025-10-07T12:02Z 915K followers, 2830 engagements

"@lookonchain @jpthor Also in a recent documentary about the Bybit hack in an interview he defended DPRKs right to hack/exploit teams"
X Link @zachxbt 2025-09-12T09:05Z 915K followers, 51.6K engagements

"@MEXC_Official @Gate_io Update: Ildar Ilham aka @XBT_Prometheus (founder of @WhiteRock_Fi) was arrested by UAE law enforcement for his involvement in the $30M Zkasino exit scam. He will be extradited to the Netherlands next for the criminal case"
X Link @zachxbt 2025-07-03T13:38Z 915K followers, 359K engagements

"@js_horne @crystaltaixyz @zora Why did your team and Jesse from Coinbase engage at all with Sahil to begin with His list of celebrity coin rug pulls on Solana is well documented on X by CT and on YT by Coffeezilla so a quick search would have revealed warnings"
X Link @zachxbt 2025-08-25T14:47Z 914.9K followers, 157.8K engagements

"@cecilia_hsueh Meanwhile MEXC listings:"
X Link @zachxbt 2025-10-15T19:28Z 915K followers, 42.2K engagements

"It would be easy for them to prove me wrong. If the incidents were publicly disclosed to the community they could simply share the URL of the disclosure. I would also publicly apologize to them. Ask yourself why a search for news articles and data breach platforms about user data leaks have zero matches"
X Link @zachxbt 2025-09-22T11:23Z 915K followers, 61.5K engagements

"@frdysk @FrankieIsLost someone should create a analytics site to compare different platform i think so many new options nowadays its difficult to compare them all without a table"
X Link @zachxbt 2025-09-17T06:56Z 915.1K followers, 1913 engagements

"9/ Other interesting items from their searches and browser history included:"
X Link @zachxbt 2025-08-13T12:55Z 915.1K followers, 85.8K engagements

"@BitoEx_Official Do you want to explain to the community why multiple of your hot wallets saw suspicious outflows of $11.5M on May X 2025 where you still have not disclosed the security incident on X or Telegram several weeks later"
X Link @zachxbt 2025-06-02T05:57Z 914.9K followers, 76.5K engagements

"Also tired of onchain technology that has primarily benefited from illicit activity where the teams rake in fees and dont take any responsibility by returning fees at minimum if they cannot build mechanisms to prevent it. EX: Garden Finance from Apr - Jul 2025 XX% of total volume was stolen funds and they profited multiple X figs of funds from the flows (I stopped monitoring flows after July)"
X Link @zachxbt 2025-10-15T07:17Z 915K followers, 28.2K engagements

"Whats most interesting is wallet addresses listed in the US government $14B (127K BTC) seizure previously were named in a Milky Sad report X years ago for having vulnerable private keys and now the USG says they have custody of them"
X Link @zachxbt 2025-10-14T15:45Z 915K followers, 512.6K engagements

"8/ 0x5e9c purchased XX X Killer GF NFTs for XXXX ETH total on June XX at 6:35 pm UTC. 0x5e9c sold XX NFTs to 0x0bc7 for XXXX ETH using funds washed from theft address 0x1d7. The diagram below highlights how all three addresses involved interact with each other"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 16.1K engagements

"@cecilia_hsueh X. No crawback"
X Link @zachxbt 2025-10-10T13:36Z 915K followers, 132.8K engagements

"@jessepollak all of these viral coins yet not even a single $5M+ runner"
X Link @zachxbt 2025-04-21T15:46Z 915.1K followers, 160.8K engagements

"1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple arrests and millions frozen"
X Link @zachxbt 2024-09-19T13:03Z 915K followers, 12.1M engagements

"1/ Time to share how SCALE NTD TPU & OPSEC projects were all tied to the same person Zopp0 to farm naive traders using numerous influencers shown in leaked messages"
X Link @zachxbt 2024-11-03T13:24Z 915K followers, 871.9K engagements

"Pleased to share I'll be working with @MattHuang @Paradigm as an incident response advisor to assist their portfolio companies. It was an easy decision as this gives me the freedom to continue helping the community and publishing investigations like. Ive always respected how Paradigm has given back to the space by funding intiatives such as Security Alliance publishing open source research and helping defend the right to privacy"
X Link @zachxbt 2025-02-26T15:33Z 915K followers, 767.5K engagements

"Community Alert: The group of scammers who stole X figs with Magnate Kokomo Lendora Solfire etc is back with a new project on Blast @Leaperfinance Last week they funded an address on Blast with $1M of laundered funds from the previous rugs and have begun adding liquidity to bait people in. Tracing: 1). X week ago 0x46a moves ETH a few hops from Magnate scam to 0x10e 0x46a10e7444bf78736E6a24b1De8dc8A20E4B3ED7 0x10ef5bb874b226bdd6860f00d5e5a2aa3e955b9a 2). Bridges to 0xAc9 on Polygon 0xAc973E1Be91fe8674dff2E0de4A9375803Ae4435 3). 0xAc9 transfers wETH to 0x08"
X Link @zachxbt 2024-04-14T02:17Z 915K followers, 964K engagements

"@0x_Leo_ Why publicly tag me and do not at minimum provide any sort of basic details in DMs such as chat logs transactions etc"
X Link @zachxbt 2025-10-03T06:14Z 915.1K followers, 126.7K engagements

"4/ Theft consolidation 0x09f deposited $4.94M to Railgun a privacy protocol in June 2024. XXXXXXX ETH total was deposited via 0x601 from June 8-9. XXXXXXX ETH 277.2K USDC XXXXX WETH total was deposited via 0xf5ff on June XX & XX. 0x09f76d4fc3bce5bf28543f45c4cee9999e0a0aaf"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 18.1K engagements

"11/ The Favrr CTO Alex Hong has a background which appears suspicious and is likely one of the two DPRK ITWs hired. His LinkedIn was very recently deleted. I also reached out to a project he supposedly worked at but could not verify his work history"
X Link @zachxbt 2025-06-27T14:03Z 915K followers, 169.3K engagements

"@degrekt Hopefully Tether fights it / law enforcement pursues further My only concern is the shell company possibly does OTC via Black U so it comes from many dirty sources and is more difficult to attribute"
X Link @zachxbt 2025-10-15T16:55Z 915K followers, XXX engagements

"@SpiffyLad USG stole from criminals who ran pig butchering scams and trafficked humans DPRK stole from innocent teams within our industry Hard to compare the two"
X Link @zachxbt 2025-10-14T16:08Z 915K followers, 8981 engagements

"@DogecoinKenya Its not enjoyable to post frequently on X anymore I just work on cases in private"
X Link @zachxbt 2025-10-13T09:46Z 915K followers, 93.2K engagements

"1/ An investigation into how @cryptobeastreal scammed followers by lying they were not behind the $190M - $3M $ALT market cap crash where 45+ connected insider wallets sold $11M+ on July XX 2025"
X Link @zachxbt 2025-07-22T12:53Z 915K followers, 1.3M engagements

"This week the project @OpenVPP ($OVPP) claimed to be working with the US government on the tokenization of energy. XX hrs ago Hester Pierce replied saying she does not work alongside or endorse private crypto projects. OpenVPP then hid her reply from the post. I reviewed the accounts promoting OpenVPP and its the usual influencer suspects"
X Link @zachxbt 2025-09-17T15:37Z 915K followers, 774.4K engagements

"3/ I began tracing the stolen funds from two initial theft addresses TAO was bridged to Ethereum via Bittensor native bridge and then transferred to instant exchanges where the attackers swapped to XMR. Victims: $400K: 5ENiTXL63DRMKytjaDRBLnorwd6qURKcCVgsgpu8UQxgptQN $13M: 5DnXm2tBGAD57ySJv5SfpTfLcsQbSKKp6xZKFWABw3cYUgqg"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 20.3K engagements

"5/ I deanonymized the Railgun withdrawals to three addresses (0x1d7 0x87d8 0x1fbc) by applying timing / amount heuristics. Total deposits: 1249.68 ETH 277.2K USDC XXXXX WETH Total withdrawals: 1246.16 ETH 276.4K USDC XXXXX WETH The unique denominations and short deposit time makes the demix high confidence. Withdrawal addresses: 0x87d82c5401764f87856a31746f603ff766c72c7d 0x1d7ac347943c2143587978141a9415f2138adc2a 0x1fbc554caff6c1b4c00a692c9849de62de97e29c"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 17.7K engagements

"On Aug XX 2025 a victim fell for a social engineering scam and lost XXX BTC ($91M) after exchange and hardware wallet customer support were impersonated. The stolen funds began to peel off and deposits to Wasabi were made by the threat actor. Coincidentally this theft happened on the one year anniversary of the $243M Genesis Creditor theft. Theft txn hash da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457 Theft address bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej"
X Link @zachxbt 2025-08-21T17:33Z 915K followers, 690.1K engagements

"Thanks @DwightHoward for the quick rug pull"
X Link @zachxbt 2024-01-30T22:54Z 915K followers, 515.2K engagements

"1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects"
X Link @zachxbt 2025-08-13T12:54Z 915K followers, 1M engagements

"1/ An investigation into how I identified one of suspects tied to the $28M Bittensor hack from 2024 by identifying anime NFT wash trades linked to a former employee and earned a whitehat bounty for my efforts"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 191.4K engagements

"7/ 0x1d7 purchased X X Killer GF NFTs for XXXXXX ETH on June XX at 6:29 pm UTC from 0x0bc7 a newly funded wallet via instant exchange X that purchased XX KGF NFTs for XXXXX ETH total on June XX at 5:58 pm UTC. The floor price averaged XXXXX ETH per NFT meaning 0x1d7 suspiciously overpaid from 0x0bc7 by many multiples"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 16K engagements

"2/ XX $TAO holders experienced unauthorized transfers in excess of $28M from May to July 2024 and the Bittensor network was temporarily halted on July X 2024. A post-mortem published by the team revealed the thefts were the result of a supply chain attack after a malicious PyPi package was uploaded in late May 2024 Victims who downloaded the package and performed specific operations accidentally compromised private keys"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 22.9K engagements

"2/ A trader opened multiple highly leveraged positions on Hyperliquid and GMX from Jan - Mar 2025. They gained lots of attention this month after two onchain trades: -Large ETH & BTC long position on 50X leverage just before Trumps crypto reserve announcement by 0xe4d3 ($10M profit) -Large BTC short position on 40X leverage by 0xf3F4 ($9M profit)"
X Link @zachxbt 2025-03-20T13:25Z 915K followers, 240.9K engagements

"@dethective That influencer is a known grifter"
X Link @zachxbt 2025-10-10T13:57Z 915K followers, 43.7K engagements

"@JoeyMooose @frankdegods @notthreadguy @MINHxDYNASTY Thank you for the gesture"
X Link @zachxbt 2025-01-21T11:04Z 915.1K followers, 383K engagements

"@Tradermayne How many rugs is Cole0x connected to now Off the top of my head its: LinkPadVC/Solstarter ClosedAI DerpItOnS BSC meme coin Monad meme coin. Have tried warning the community about Cole and Nekoz many times"
X Link @zachxbt 2025-10-12T20:15Z 915K followers, 65.3K engagements

"@burliko I missed the part where your loss is my problem"
X Link @zachxbt 2025-10-03T15:21Z 915K followers, 77.9K engagements

"@memenetic POV your new meme coin grift is destined for failure due to influencer bukkake 150+ promotional posts from d-tier influencers millions of botted followers and likes only XX SOL raised for the presale few disclosures for the posts"
X Link @zachxbt 2025-08-23T12:52Z 915K followers, 121.6K engagements

"The problem is nowadays everyone wants an entertaining outcome to occur for major events so my analysis would likely be underwhelming. Theres still too many unknowns to reach a conclusion Id be comfortable publishing. All of the posts gaining attention right now are an exaggeration of half baked theories. Known: Garrett Jin / Exe seemingly started working with a Chinese whale who had XX figs sitting dormant onchain until recent"
X Link @zachxbt 2025-10-12T10:56Z 915K followers, 120.1K engagements

"Update: Box (Jeandiel) and Greavys (Malone) just had the indictment for the case unsealed"
X Link @zachxbt 2024-09-19T19:19Z 915K followers, 818.4K engagements

"Heres more lore about Malone Lam we uncovered during the $243M Genesis Creditor theft. On June XX 2024 Mark Cuban fell victim to a social engineering scam losing crypto assets from his public wallet markcuban.eth We noticed the exact same device indicators in the Cuban theft as the $243M theft across multiple transactions where funds were laundered. Yesterday the superseding indictment was unsealed that hints at Lam and Chens involvement in Cubans theft with a matching date/amount. Theft address 0x733ea491051929d0b6619425e088d210deb5cbe6"
X Link @zachxbt 2025-05-16T19:47Z 915K followers, 572K engagements

"1/ Over the past few months I have been tracking a series of related compromises for McDonalds Usher Kabosu Owner Andy Ayrey Wiz Khalifa SPX 6900 etc on X & IG which has resulted in an estimated $3.5M+ stolen via launching Pump Fun meme coins"
X Link @zachxbt 2024-11-26T16:41Z 915K followers, 2.2M engagements

"@serpinxbt @js_horne @crystaltaixyz @zora heres more to the story"
X Link @zachxbt 2025-08-25T14:56Z 914.9K followers, 143.4K engagements

"The affidavit confirmed all of the victims from my investigation Victim X = Beeple Victim X = DeeKay Victim X = Zeneca Victim X = Nouns DAO Victim X = JRNY Club"
X Link @zachxbt 2025-07-30T11:57Z 915K followers, 146.3K engagements

"Investigation of @GCRClassic hacker reveal will be posted in next 12-24 hrs"
X Link @zachxbt 2024-05-26T19:34Z 915K followers, 541.5K engagements

"Update: It has now been over a month of silence from @Matt_Furie @ChainSawNFT as collectors of their projects sit with large losses. The stolen funds sat as a freezable assets but due to lack of action by the team no freeze was made and multiple deposits to MEXC were made by DPRK ITWs. Its debatably the worst handling of an incident I have ever seen and their failure to give any transparency shows negligence"
X Link @zachxbt 2025-07-19T07:01Z 915K followers, 95.6K engagements

"People wonder why I sound annoyed replying to victims on X. Its because it gets tiresome after thousands of times of people falling for the exact same scams never learning no matter how much you try educating. A lot of the time when you want to help them you cannot because theres so many external factors I have no control over like jurisdictions case workloads amounts exchanges law enforcement etc Trying to explain this to victims is an impossible task as if I initially spent 10-15 minutes per person it would take up 8+ hours of my day. I always enjoy being challenged and working on"
X Link @zachxbt 2025-10-07T11:59Z 915K followers, 35.1K engagements

"4/ An initial tracing showed $243M split multiple ways between each party before funds quickly peeled off to 15+ exchanges immediately swapping back and forth between Bitcoin Litecoin Ethereum and Monero"
X Link @zachxbt 2024-09-19T13:04Z 915K followers, 771.6K engagements

"So Crypto Rover tagged Grok to select a winner for a giveaway and it began replying about his involvement in pump and dump schemes and sketchy promotions and is refusing to select a winner"
X Link @zachxbt 2025-07-21T03:37Z 915K followers, 1.4M engagements

"1/2 I am pleased to share that Cameron Redman was convicted today and ordered to pay restitution as a result of my investigation. In June 2022 X panel access was sold for XXX ETH which resulted in 10+ account compromises (JRNY Beeple Nouns Zeneca DeeKay etc) and millions stolen via phishing scams. At the time of this post other documents related to the case still remain sealed"
X Link @zachxbt 2025-07-29T19:14Z 915K followers, 606.2K engagements

"2/ Earlier this month Crypto Beast began aggressively promoting $ALT on X and TG. On July XX 2025 ALT crashed from XXXX to XXXXX after insiders sold a large percent of the total supply. All of these posts promoting the token. have since been deleted"
X Link @zachxbt 2025-07-22T12:53Z 915K followers, 91K engagements

"Update: Wiz (Veer Chetal) was arrested by US Marshalls and here is his mug shot"
X Link @zachxbt 2025-03-25T17:10Z 915K followers, 443.1K engagements

"I just reviewed the frozen addresses on Tron with @bax1337 and its several hops onchain from ponzi investment scams like BETL Pegasus Ride LSSC. The Riverstone shell company from HK frequently chainhops back & forth from Tron Polygon Ethereum via Bridgers. Theres no way you accidentally associate $44.7M with tainted addresses onchain. Its unfortunate weve reached the point where organized crime is bold enough to fight freezes via sketchy lawyers due to antiquated laws"
X Link @zachxbt 2025-10-15T16:43Z 915K followers, 6996 engagements

"NEW LEAK: Price sheet of 200+ crypto influencers and their wallet addresses from a project they were recently contacted by to promote. From 160+ accounts who accepted the deal I only saw X accounts actually disclose the promotional posts as an advertisement"
X Link @zachxbt 2025-09-01T11:59Z 915K followers, 7.4M engagements

"Update: So far $7M+ has been frozen with the help of @CFInvestigators @tanuki42_ Binance Security team and myself"
X Link @zachxbt 2025-05-02T17:29Z 915K followers, 282.7K engagements

"0x8d0a is an interesting wallet as they were also directly involved in the $HIFI Binance delisting pump and dump last month. 0x8d0a received dust from XX addresses linking XX of the perpetrators Binance deposit addresses used for $HIFI manipulation. 0xb42dba0088c1b2435af4b71613314c5897d08d77 0x531d9ceaecba84067b5bbf8617811a3513b79470 0x67f7fecfa1cda20930185f8810cce1a6972f352c 0x782a26a8845ba02eb8af537918ede35eabc14dd6 0xcedfef02c2e05ec4c24b8e3271725e673db6695e 0xdfbad887f3dacff93ab0fecf19d89d7940d7787c 0xd1ebf0b3a6b453bec246b9eb32d503ef46c16a68 0xcca4ed05987bca2e48ebbb359c0685303f48e605"
X Link @zachxbt 2025-10-11T17:54Z 915K followers, 42.6K engagements

"6/ An unnamed source provided a personal email of an account that interacted multiple time with the WhiteRock deployer address. I noticed the email has an account on Chess(.)com with the username IldarTheGrandMaster. Prometheus from Zkasino = Ildar Whiterock alias = Goedel goedel014@gmail(.)com"
X Link @zachxbt 2025-06-16T14:18Z 915K followers, 98K engagements

"1/ Multiple projects tied to Pepe creator Matt Furie & ChainSaw as well as another project Favrr were exploited in the past week which resulted in $1M stolen My analysis links both attacks to the same cluster of DPRK IT workers who were likely accidentally hired as developers"
X Link @zachxbt 2025-06-27T14:02Z 915K followers, 863K engagements

"8/ Using the phone number linked to his Telegram account I searched it in private dbs revealing his alleged location in France full name and other information tied to him. As long as victims of the scam come forward and file reports with law enforcement in their country I believe this case has potential as Jolan has clear admissions in writing. Sources: Name: Jolan Alias: Qwerty Country: France Current X username:@brgMIDA Old X usernames: @jolaneth @edoclip Telegram ID: 733344223 Phone: if victim filing report ask for via DM Email: if victim filing report ask for via DM IP: If victim filing"
X Link @zachxbt 2024-03-21T14:39Z 915K followers, 331.7K engagements

"Your team stole $30M of investor funds from Zkasino and you were arrested. After those millions were gambled away via Hyperliquid/GMX leveraged positions and laundered the via instant exchanges and crypto to cash OTCs over the past few months. Elham Nourzai if there was a tier list for CT scammers you would be at the top"
X Link @zachxbt 2025-04-07T07:58Z 915K followers, 229.8K engagements

"@inversebrah These botted milady meme coin KOL scammer accounts that keep appearing out of nowhere are so annoying"
X Link @zachxbt 2025-09-07T10:18Z 914.8K followers, 41.6K engagements

"It appears @Ripple was hacked for 213M XRP ($112.5M) Source address rJNLz3A1qPKfWCtJLPhmMZAfBkutC2Qojm So far the stolen funds have been laundered through MEXC Gate Binance Kraken OKX HTX HitBTC etc"
X Link @zachxbt 2024-01-31T14:05Z 915K followers, 2.7M engagements

"@LBankUpdates @blockdagnetwork I hope your team realizes that BlockDAG Network is a fake project / investment scam that has held a presale for 1.5+ years thats supposedly ending soon while regularly transferring investor funds to various exchange accounts and marketing fake numbers to increase retail fomo"
X Link @zachxbt 2025-08-18T12:55Z 915K followers, 39.7K engagements

"@AlpineF1Team @blockdagnetwork Not sure who does your due diligence on F1 partners but Blockdag is an investment scam that has been running a presale for 1.5+ yrs now and advertises fake numbers for how much theyve raised"
X Link @zachxbt 2025-09-30T19:19Z 915K followers, 37.1K engagements

"8/ The 0x78e1 address is closely tied onchain to the recent $680K Favrr exploit from June 2025 where their CTO and other devs turned out to be DPRK ITWs with fraudulent documents. Additional DPRK ITWs were identified at projects from the 0x78e1 address"
X Link @zachxbt 2025-08-13T12:55Z 915K followers, 98.9K engagements

"7/ Later Jolan bridged $536K of the stolen funds back to Ethereum where he spent XX ETH ($161K) on Milady & Milady derivative NFTs and begins trading meme coins (currently holds $140K+ between wallets) 0xD333897380cee55df130d4b30a7FA7dd4DBa5C38"
X Link @zachxbt 2024-03-21T14:38Z 915K followers, 199.3K engagements

"7/ One of the wallet addresses used by them to send and receive multiple payments was 0x78e1a4781d184e7ce6a124dd96e765e2bea96f2c"
X Link @zachxbt 2025-08-13T12:55Z 915K followers, 69.9K engagements

"@FatManTerra Finally they got that OTC scammer He stole $7.1M (14.6K TAO) from a TAO whale in February 2024 Also scammed ZYN MOG Kondux Ordiswap Landwolf and Hash AI whales for another $8M+ all this year"
X Link @zachxbt 2024-12-03T17:57Z 914.8K followers, 75.2K engagements

"13/ As a result of the investigation Box and Greavys were arrested yesterday evening in Miami and LA. I would expect law enforcement seized additional funds during the arrests due to large transfers around that period of time"
X Link @zachxbt 2024-09-19T13:05Z 915K followers, 588.2K engagements

"Update: The OpenVPP team made a statement and says the reply was accidentally hidden by a 24/7 intern"
X Link @zachxbt 2025-09-17T16:11Z 915K followers, 125K engagements

"I would advise being careful with @DeDotFi for their $DEFI token sale. They have extended the public sale multiple times increasing the max raise without any transparency. $1M - $1.5M - $2.5M - $3M Not to mention they did a IDO in Feb 2022 and those people have not received tokens after more than XXX yrs. There are also a bunch of suspicious influencer posts advertising this as a 10-100X"
X Link @zachxbt 2023-10-30T19:11Z 915K followers, 585.6K engagements

"5/ The Celestia address from above transferred small amounts to five instant exchanges from May - July 2025 (Kucoin nested Sideshift Binance nested HTX nested etc) to fund side wallets"
X Link @zachxbt 2025-07-22T12:53Z 915K followers, 73.9K engagements

"6/ Scammers clone the Coinbase site nearly 1:1 and allow the scammers to send different prompts to the target via spoofed emails using panels. There are many Telegram channels where scammers advertise them. See examples of various panels used by scammers below"
X Link @zachxbt 2025-02-03T13:50Z 915K followers, 132.3K engagements

"6/ Wizs friend Light/Dark (Aakaash) helped launder the funds for him using eXch and Thorswap. Similar to Wiz he also leaked his name during screen share. Wiz TC Destination address confirmed in video 0xa212d7441fed6db9ab666ba34e8c440c565f4af8"
X Link @zachxbt 2024-09-19T13:05Z 915K followers, 908.5K engagements

"1/ The UK scammer @ape_31 @60711 has stolen more than $650K from 250+ X users in the past year by posting fake PNL screenshots from a Bybit demo account and running a news account to funnel unsuspecting victims into paid services before blocking them upon receiving payment"
X Link @zachxbt 2024-09-30T13:44Z 915K followers, 1.9M engagements

"when the biggest shills for a project come from sketchy KOLs (Nekoz etc) vs actual builders for a project it typically means the tech is underwhelming. nonetheless the supply control by them has so far been impressive L1s w/ token preproduct + large tax at launch for a serious project = pumping to insane valuation will always be funny mutes before angry holders appear"
X Link @zachxbt 2025-06-09T14:28Z 915K followers, 237.1K engagements

"4/ I observed LedZo5 was funded via instant exchange so I traced back from the funding txns to the Celestia address below by performing a timing analysis. celestia1chflqywwp0k8rjzgp3w4447fquyk9ynnc6zws5"
X Link @zachxbt 2025-07-22T12:53Z 915K followers, 79.4K engagements

"5/ They then sent a spoofed email which appeared to be from Coinbase with a fake Case ID further gaining trust. They instructed the victim to transfer funds to a Coinbase Wallet and whitelist an address while support verified their accounts security"
X Link @zachxbt 2025-02-03T13:50Z 915K followers, 145.1K engagements

"@satoshivm From SAVM shilled by many influencers last year at TGE to one year later no social media activity on X/TG no Github activity in months and token down 99%. Who could have possibly seen this coming"
X Link @zachxbt 2025-04-19T10:06Z 915K followers, 62.8K engagements

"@Cointelegraph @forsetis_anon Does the Countelegraph team vet sponsors An old Brian Krebs investigation named the Ice Blockchain / Online CEO Alexandru Florea (Zeus) as a cybercrinimal that was the admin of Microleaves a service that was alleged malware/botnet and linked to the 2018 ICO rug OIO"
X Link @zachxbt 2025-10-08T09:56Z 915K followers, 27.4K engagements

"7/ EX 4: Raichu worked with The Game and Dillon Danis to promote Baby Dinger token another scam"
X Link @zachxbt 2023-04-05T13:06Z 915.1K followers, 45.6K engagements

"@jzgulati the story of october money laundry number go up (Swissborg theft edition)"
X Link @zachxbt 2025-10-11T12:33Z 915K followers, 55.5K engagements

"7/ I think the risk of a rug with WhiteRock remains high due to their history with other projects (Zkasino Syncus Zigzag). I hope @MEXC_Official @Gate_io considers delisting WHITE and also conduct enhanced due diligence on the team. As the Zkasino team awaits trial hopefully soon Ildar Ilham Elham Nourzai & Lior Ben Zakan face serious legal repercussions for all of the harm they have caused to investors"
X Link @zachxbt 2025-06-16T14:18Z 915K followers, 161.8K engagements

"6/ EX 3: For this one Raichu worked with rapper Rich The Kid for the project Ancient Cats Club. The team quickly rugged shortly after launch stealing over $1.7m. The team of this project eventually launched other NFT scams like Bored Bunny and Rich Dwarves Tribe"
X Link @zachxbt 2023-04-05T13:06Z 915.2K followers, 87.2K engagements

"11/ Earlier this year a civil lawsuit was filed against multiple suspects based on these findings. An interesting bit taken from the defendants statements is highlighted below where Rusty (Ayden B) admits ownership of several wallets I identified though denies involvement. 0xJones (Jon L) another alleged suspect previously applied for a role at OTF as friends with Rusty and deleted messages from the Bittensor Discord and deactivated his X account after the incident"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 34.8K engagements

"1/6 My issues with WorldCoin"
X Link @zachxbt 2023-07-24T16:20Z 915.1K followers, 1.6M engagements

"1/ Meet Yicong Wang () a Chinese OTC trader who has helped Lazarus Group convert tens of millions of stolen crypto to cash from various hacks via bank transfers since 2022"
X Link @zachxbt 2024-10-23T12:51Z 915K followers, 1.4M engagements

"5/ When reviewing blockchain data tied to Yicong Wang you will notice high illicit fund exposure from the Alex Labs Irys co-founder and a consolidation of other hacks (EasyFi Bondly Maverick co-founder etc)"
X Link @zachxbt 2024-10-23T12:51Z 915K followers, 83.6K engagements

"12/ Soon I plan to publish my stats on total payments being sent out to DPRK ITWs at companies/projects to provide insight into how bad it is. Its depressing how many teams hire DPRK IT workers when basic due diligence would likely have prevented it. The lack of communication from Matt Furie & ChainSaw since the incident occurred has been disappointing with their only warning to the community deleted without explanation. The stolen funds from the ChainSaw incident mostly remain dormant. The stolen funds for Favrr were transferred to Gate and a few nested services. I have been unable to get in"
X Link @zachxbt 2025-06-27T14:03Z 915K followers, 155.9K engagements

"@OpSecCloud From early on there were many red flags if you did basic due diligence so its clear all of the influencers who promoted OPSEC looked past this. Keep the names of influencers from these screenshots in mind and avoid them for the rest of this bull run"
X Link @zachxbt 2024-11-14T10:56Z 915K followers, 121.5K engagements

"@stablealt @HyperliquidX HypurrScan team deserves hundreds of lashes for fumbling their early mover advantage and overlooking basic features EX: The Unit protocol address is not even publicly tagged when they are one of the largest HL protocols"
X Link @zachxbt 2025-10-15T08:16Z 915K followers, 17.2K engagements

"1/ Community Alert: At least one team member from the $30M Zkasino exit scam appears to be involved with the project @WhiteRock_Fi $WHITE due to onchain transactions linking both projects and a personal email address"
X Link @zachxbt 2025-06-16T14:18Z 915K followers, 825.8K engagements

"@IamNomad Just going off of memory Raid Party was $70M Bored Bunny was $21M Metacard was $23M Apes In Space was $10.8M"
X Link @zachxbt 2024-10-12T19:34Z 915.1K followers, 23.8K engagements

"3/ I went and identified the main counterparties of 0xf3f: 0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21 0x312f8282f68e17e33b8edde9b52909a77c75d950 0xab3067c58811ade7aa17b58808db3b4c2e86f603 0xe4d31c2541a9ce596419879b1a46ffc7cd202c62 This cluster is to tied to Roobet Binance Gamdom ChangeNOW Shuffle Alphapo BC Game & Metawin accounts"
X Link @zachxbt 2025-03-20T13:25Z 915K followers, 234.8K engagements

"Update: OpenVPP appears to potentially be misrepresenting another partnership with Commonwealth Edison (ComEd). When contacted the company stated: We did not partner with them and are not interested"
X Link @zachxbt 2025-09-18T15:49Z 915K followers, 281.1K engagements

"11/ The main challenge faced in fighting DPRK ITWs at companies include the lack of collaboration between services and the private sector. Theres also the negligence by the teams hiring them who become combative when alerted. ITWs are in no way sophisticated but are persistent since theres so many flooding the job market globally for roles. Payoneer is commonly being used to convert fiat into crypto from dev work. I have already covered multiple times on indicators of what to look out for so I will not repeat those again"
X Link @zachxbt 2025-08-13T12:55Z 915K followers, 166.7K engagements

"You are supposedly a MEXC exec. Its been X weeks since you publicly acknowledged his posts and multiple months since it was frozen / publicized. Unfreezing an account is the push of a single button. The users whitelisted address was funded via Coinbase and likely not illicit funds. I do not believe the MEXC compliance email excuses as MEXC is known to be uncooperative and rarely is proactive with blocking actual illicit funds and seems to only freeze legitimate profitable user accounts like a bucket shop which gets highlighted by user complaints on CT"
X Link @zachxbt 2025-10-10T14:37Z 915K followers, 29.8K engagements

"Update: Today twelve people were charged for the $243M Genesis creditor theft. Aakaash Anand was featured in the clip on 6/ laundering funds for Veer/Wiz"
X Link @zachxbt 2025-05-15T21:09Z 915K followers, 244.4K engagements

"1/ An investigation into the alleged identity of the mysterious Hyperliquid whale tied to illicit activity that profited $20M via highly leveraged positions over the past couple weeks"
X Link @zachxbt 2025-03-20T13:25Z 915K followers, 2.6M engagements

"@keung @graildoteth @yogapetz How much has been extracted from the space now with all of your projects $55M with buzzwords 6500 ETH with NFTs (according to this old post) Its good to know that larping with fake positivity vibes is still a profitable endeavor"
X Link @zachxbt 2024-07-04T06:18Z 914.8K followers, 92.3K engagements

"6/ The stolen funds flowed to more instant exchanges from 0x87d8 on June X and the rest was consolidated to 0x1d7 on June XX. 0x1d7 bridged 1054 ETH to Avalanche and back again to Ethereum via Synapse on June XX. 0x4fbc6c00fa1ef99561e1d977ee6c678a54cfb06f"
X Link @zachxbt 2025-10-15T14:19Z 915K followers, 17.3K engagements

"14/ My post will be updated as the legal case progresses. In the meantime mint a free collectible to commemorate the investigation of the stolen $243M below on Zora"
X Link @zachxbt 2024-09-19T13:05Z 915K followers, 943.4K engagements

"Heres my investigation from last year in case you are unfamiliar"
X Link @zachxbt 2025-07-21T03:38Z 915K followers, 277.9K engagements

"12/ With the assistance of @CFInvestigators @zeroshadow_io and the Binance Security Team more than $9M+ has been frozen and $500K+ has already been returned back after working closely with the victim to investigate the incident"
X Link @zachxbt 2024-09-19T13:05Z 915K followers, 507.8K engagements

"2/ Incident Summary: On August XX 2024 the threat actors targeted a single Genesis creditor by: 1) Calling as Google Support via spoofed number to compromise personal accounts 2) Calling after as Gemini support claiming account is hacked 3) Social engineered victim into resetting 2FA and sending Gemini funds to compromised wallet 4) Got victim to use AnyDesk to share screen and leaked private keys from Bitcoin core. Gemini txn hash XXXXX BTC - Aug XX at 1:48 am UTC e747b963a463334c164b0a8fff844f73693272bb2b331adbe2147d70ec196360 XXXXX BTC - Aug XX at 2:30 am UTC"
X Link @zachxbt 2024-09-19T13:03Z 915K followers, 1.1M engagements

"@Bitrace_team @MistTrack_io Only Circle would attempt one of the most useless freezes I have ever seen. Tips off the hacker in the future they will attempt to freeze them Address holds DAI not USDC Send the DAI to a new address and swap to USDC"
X Link @zachxbt 2025-10-14T12:08Z 915K followers, 26.7K engagements

"@ManaMoonNFT @Tradermayne lmeow @CL207"
X Link @zachxbt 2025-10-12T20:21Z 915K followers, 5195 engagements

"Update: OpenVPP appears to be potentially misrepresenting a third partnership with Smartcar When contacted the founder stated: His company is using Smartcar's self-service API offering. (It's something that anyone can access and use on our website.) My company Smartcar and have no further connection or involvement with their cryptocurrency token or related activities"
X Link @zachxbt 2025-09-19T20:35Z 915K followers, 137K engagements

"Heres a long list of XX NFT projects I did investigations on: Animoon - $6.3M Winter Bears - $3.4M XXX projects - $13M Rogue Society - $5.5M Rich Dwarves Tribe - $3.04M Boneheads - $3.1M Real Floyd NFT - $5M Croatia NFT scam group - $2.8M Rich Bulls Clubs - $3.4M MEE6 - $3M Eternal Beings - $4M Ether Monkeys - $2.8M Swipa The Fox - $1.75M Tribes of Ogun - $700K Billionaire Dogs Club - $960K Crazy Camels - $1.6M Rich Kids - $2M Fashion Ape - $1.1M Trollz- $4M Various NFT projects - $3.7M Players Only - $1.4M Vault of gems - $1M 0xCryatals - $1M Miss Universe - $370K Apes In Space - $10.8M"
X Link @zachxbt 2024-10-12T20:17Z 915K followers, 37.8K engagements

"Such an awful take normalizing wash trading is bad for the industry I am commenting on this fairly as an observer Zero posts about HYPE and only two posts mentioning HL which Aster was also referenced Meanwhile almost every other post is about Aster Worst thing Aster community has done thus far is choosing to associate with so many known grifters (Wynn Shillin etc)"
X Link @zachxbt 2025-10-06T04:26Z 915K followers, 58.6K engagements