#  @zachxbt ZachXBT ZachXBT, a prominent investigator, has been tracking and exposing various cryptocurrency scams and exploits, including those linked to North Korean IT workers (DPRK ITWs). The investigations have led to multiple arrests, millions of dollars frozen, and the exposure of several scammers, including Crypto Beast, who rebranded as RealCryptoElio. Additionally, ZachXBT's work has highlighted the ongoing issue of DPRK ITWs being hired by companies, often due to a lack of proper due diligence, leading to significant financial losses. ### Engagements: [-------] [#](/creator/twitter::3012852462/interactions)  - [--] Week [---------] +68% - [--] Month [----------] +183% - [--] Months [----------] +24% - [--] Year [-----------] -44% ### Mentions: [---] [#](/creator/twitter::3012852462/posts_active)  - [--] Week [---] +6% - [--] Month [---] +24% - [--] Months [---] +24% - [--] Year [-----] -27% ### Followers: [-------] [#](/creator/twitter::3012852462/followers)  - [--] Week [-------] +0.11% - [--] Month [-------] +1% - [--] Months [-------] +6.50% - [--] Year [-------] +25% ### CreatorRank: [------] [#](/creator/twitter::3012852462/influencer_rank)  ### Social Influence **Social category influence** [cryptocurrencies](/list/cryptocurrencies) #6208 [finance](/list/finance) #5120 [exchanges](/list/exchanges) #875 [technology brands](/list/technology-brands) 7.84% [social networks](/list/social-networks) 6.27% [stocks](/list/stocks) 5.49% [countries](/list/countries) 2.35% [currencies](/list/currencies) 0.78% [celebrities](/list/celebrities) 0.78% [nfts](/list/nfts) 0.78% **Social topic influence** [crypto](/topic/crypto) #809, [ai](/topic/ai) #6080, [telegram](/topic/telegram) #74, [in the](/topic/in-the) 4.71%, [coinbase](/topic/coinbase) #195, [law enforcement](/topic/law-enforcement) #759, [market](/topic/market) #347, [memecoin](/topic/memecoin) #15, [posts](/topic/posts) #993, [future](/topic/future) 2.75% **Top accounts mentioned or mentioned by** [@juan_25_q](/creator/undefined) [@sexinfochina](/creator/undefined) [@jerallaire](/creator/undefined) [@kiennguyen](/creator/undefined) [@chironchain](/creator/undefined) [@yumc14](/creator/undefined) [@antihunter59823](/creator/undefined) [@poketubel](/creator/undefined) [@onlyzen](/creator/undefined) [@ceazor7](/creator/undefined) [@scam_wipe](/creator/undefined) [@chain_traces](/creator/undefined) [@polymarket](/creator/undefined) [@onchain_vol](/creator/undefined) [@wyckoffweb](/creator/undefined) [@geoffreywoo](/creator/undefined) [@bank_of_eth](/creator/undefined) [@drtnky](/creator/undefined) [@jamesdpitley](/creator/undefined) [@damselincrypto](/creator/undefined) **Top assets mentioned** [Coinbase Global Inc. (COIN)](/topic/coinbase) [Ethereum (ETH)](/topic/ethereum) [Solana (SOL)](/topic/solana) [Bitcoin (BTC)](/topic/bitcoin) [Litecoin (LTC)](/topic/litecoin) [USDC (USDC)](/topic/usdc) [Alphabet Inc Class A (GOOGL)](/topic/$googl) ### Top Social Posts Top posts by engagements in the last [--] hours "You can read my investigation below 1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support. https://t.co/8kmLR5Y3cv 1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support. https://t.co/8kmLR5Y3cv" [X Link](https://x.com/zachxbt/status/2000540378630422565) 2025-12-15T12:16Z 946.7K followers, 208.8K engagements "Update: The CMDSS company X account website & LinkedIn were all just deactivated" [X Link](https://x.com/zachxbt/status/2015445329194438833) 2026-01-25T15:23Z 946.7K followers, 207.4K engagements "@AOWISEONE @wyckoffweb I receive 30+ requests per day for help If I spent [--] minutes replying / reviewing to all cases thats nearly [--] hours A single case easily can surpass 25+ hrs" [X Link](https://x.com/zachxbt/status/2019861827639996704) 2026-02-06T19:52Z 946.7K followers, [----] engagements "@damselincrypto @Polymarket theres at least some sort of relationship not being disclosed @FFVV1211 @Polymarket Coincidentally it comes only a few days after Logan Paul promoted Polymarket inorganically in a YT video. https://t.co/ayhcBL8HCz @FFVV1211 @Polymarket Coincidentally it comes only a few days after Logan Paul promoted Polymarket inorganically in a YT video. https://t.co/ayhcBL8HCz" [X Link](https://x.com/zachxbt/status/2020847988910809378) 2026-02-09T13:11Z 946.7K followers, 28.3K engagements "Sad to see @MEE6NFT soft rug buyers after collecting $3m (965 ETH) less than a year ago with many roadmap items left unfinished or the future unclear. Not to mention negligence by their team with @mee6bot last year lead to [--] figures in losses where victims were not reimbursed" [X Link](https://x.com/zachxbt/status/1625176253237018627) 2023-02-13T16:53Z 946.7K followers, 300.2K engagements "Thanks @DwightHoward for the quick rug pull" [X Link](https://x.com/zachxbt/status/1752465336451158370) 2024-01-30T22:54Z 946.6K followers, 515.5K engagements "DPRK IT workers are typically easy to spot and are not the smartest individuals. Example: Light Fury (@lee_chienhui) is a DPRK IT worker who transferred $300K+ from his public ENS address to Kim Sang Man who is on the OFAC sanctions list. Fake Name: Gary Lee Alias: Light Fury GitHub: Light-Fury Telegram: leech_dev Number: +1 [---] [---] [----] Alias email: leech.developer@gmail.com Wallet address lightfury.eth 0xe8A06462628b49eb70DBF114EA510EB3BbBDf559 NEW: NORTH KOREAN NATIONALS ARE APPLYING FOR CRYPTO JOBS TO INFILTRATE PROJECTS FOR NEFARIOUS PURPOSES - PER @dlnews https://t.co/gfzEDCJIjp NEW:" [X Link](https://x.com/zachxbt/status/1812856350151766209) 2024-07-15T14:26Z 946.6K followers, 419.1K engagements "@bitforexcom 1) What" [X Link](https://x.com/zachxbt/status/1814314867181965764) 2024-07-19T15:02Z 946.1K followers, 22.3K engagements "4/ Recently they reached back out after having been approached by Yicong Wang for a larger USDT - CNY order on August [--] [----] involving 1.5M USDT at a rate much lower than the market rate. THjaAygUNkzoXufwEoKCzbUZHpsehL9rAZ" [X Link](https://x.com/zachxbt/status/1849071120021909931) 2024-10-23T12:51Z 946.7K followers, 83.4K engagements "5/ When reviewing blockchain data tied to Yicong Wang you will notice high illicit fund exposure from the Alex Labs Irys co-founder and a consolidation of other hacks (EasyFi Bondly Maverick co-founder etc)" [X Link](https://x.com/zachxbt/status/1849071135507267614) 2024-10-23T12:51Z 946.7K followers, 84.3K engagements "1/ Time to share how SCALE NTD TPU & OPSEC projects were all tied to the same person Zopp0 to farm naive traders using numerous influencers shown in leaked messages" [X Link](https://x.com/zachxbt/status/1853065733321724274) 2024-11-03T13:24Z 945.7K followers, 882.9K engagements "@Unc_MattEth @MoonOverlord Onyx protocol Sonne Finance etc the list of examples is endless" [X Link](https://x.com/zachxbt/status/1855642407619928234) 2024-11-10T16:03Z 945.7K followers, [----] engagements "@OpSecCloud From early on there were many red flags if you did basic due diligence so its clear all of the influencers who promoted OPSEC looked past this. Keep the names of influencers from these screenshots in mind and avoid them for the rest of this bull run" [X Link](https://x.com/zachxbt/status/1857014727005655336) 2024-11-14T10:56Z 946K followers, 123.1K engagements "Update: Ronald just deleted his Telegram account" [X Link](https://x.com/zachxbt/status/1859247774660719021) 2024-11-20T14:49Z 946.1K followers, 179.5K engagements "4/ After the theft in May [----] a threat actor began flexing in Telegram chats with the username tezedasads12 sending [--] DAI as proof of owning an address with $6M from the theft. 0x0138d8c265b0d60907055df25ebfb34a6f805acd3675c45dcd5d96b85376ec2d TG ID: 6710473579" [X Link](https://x.com/zachxbt/status/1866482711025860632) 2024-12-10T13:58Z 945.7K followers, 437.8K engagements "1/3 A threat actor has stolen $500K over the past month by compromising 15+ X accounts (Kick Cursor Alex Blania The Arena Brett etc) from sending targeted phishing emails which impersonated the X team to steal credentials and then launch meme coin scams" [X Link](https://x.com/zachxbt/status/1871543397875671099) 2024-12-24T13:08Z 946K followers, 992.7K engagements "@DegenPreacher Ok it did not stop you from messaging me before" [X Link](https://x.com/zachxbt/status/1881715665226338384) 2025-01-21T14:49Z 946.2K followers, 147.2K engagements "@BarryBaumer @exit_liquid @thomahov Interesting" [X Link](https://x.com/zachxbt/status/1883902249690382443) 2025-01-27T15:37Z 946.5K followers, 92.2K engagements "2/ A trader opened multiple highly leveraged positions on Hyperliquid and GMX from Jan - Mar [----]. They gained lots of attention this month after two onchain trades: -Large ETH & BTC long position on 50X leverage just before Trumps crypto reserve announcement by 0xe4d3 ($10M profit) -Large BTC short position on 40X leverage by 0xf3F4 ($9M profit)" [X Link](https://x.com/zachxbt/status/1902713038433554576) 2025-03-20T13:25Z 946.7K followers, 243.1K engagements "3/ I went and identified the main counterparties of 0xf3f: 0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21 0x312f8282f68e17e33b8edde9b52909a77c75d950 0xab3067c58811ade7aa17b58808db3b4c2e86f603 0xe4d31c2541a9ce596419879b1a46ffc7cd202c62 This cluster is to tied to Roobet Binance Gamdom ChangeNOW Shuffle Alphapo BC Game & Metawin accounts. https://twitter.com/i/web/status/1902713054908846248 https://twitter.com/i/web/status/1902713054908846248" [X Link](https://x.com/zachxbt/status/1902713054908846248) 2025-03-20T13:25Z 946.3K followers, 236.2K engagements "1/ Community Alert: At least one team member from the $30M Zkasino exit scam appears to be involved with the project @WhiteRock_Fi $WHITE due to onchain transactions linking both projects and a personal email address" [X Link](https://x.com/zachxbt/status/1934616622846931249) 2025-06-16T14:18Z 945.9K followers, 841.6K engagements "9/ If you use X search you can clearly see its not the first time Crypto Beast has done this as many old followers got rekt on other bundled rugs $ALPHA $RICH $YE $RUG $ACE $JOHN" [X Link](https://x.com/zachxbt/status/1947641116846653546) 2025-07-22T12:53Z 946K followers, 71.6K engagements "@web3 Community alert: @web3 is linked to a team member of the Squiggles NFT rug and Raichu who I previously post about 1/ Ever wonder who connected projects with the celebrities and influencers that promote crypto scams Heres a breakdown on one of the people doing it known as Raichu (Ryan). https://t.co/uzrEZ1pAvX 1/ Ever wonder who connected projects with the celebrities and influencers that promote crypto scams Heres a breakdown on one of the people doing it known as Raichu (Ryan). https://t.co/uzrEZ1pAvX" [X Link](https://x.com/zachxbt/status/1961014477433803003) 2025-08-28T10:34Z 946.3K followers, 161.9K engagements "@lookonchain @jpthor Also in a recent documentary about the Bybit hack in an interview he defended DPRKs right to hack/exploit teams" [X Link](https://x.com/zachxbt/status/1966427843782750342) 2025-09-12T09:05Z 946.6K followers, 52.4K engagements "@elbrys @Cointelegraph @forsetis_anon heres the article for reference https://krebsonsecurity.com/2022/07/breach-exposes-users-of-microleaves-proxy-service/ https://krebsonsecurity.com/2022/07/breach-exposes-users-of-microleaves-proxy-service/" [X Link](https://x.com/zachxbt/status/1975865263783559344) 2025-10-08T10:06Z 946.7K followers, [----] engagements "@SpecterAnalyst @Cointelegraph @forsetis_anon Inb4 the Ice team sends their bots to defend them in the replies @ElonMuskAPO @ForeverCurtis_ @IamNomad @ice_blockchain I am sorry but this is an obvious grift to anyone who does basic due diligence. Ultimately this space has people who will fall for a scam regardless and are not worth my time helping. The followers are botted and engagement is not real. https://t.co/LBdnJByaxv @ElonMuskAPO @ForeverCurtis_ @IamNomad @ice_blockchain I am sorry but this is an obvious grift to anyone who does basic due diligence. Ultimately this space has people who" [X Link](https://x.com/zachxbt/status/1975865655833350305) 2025-10-08T10:07Z 946.7K followers, [----] engagements "@zoomerfied Isnt Basic Markets TedTalksMacros TraderSkews & CryptoBooles project" [X Link](https://x.com/zachxbt/status/1991527073979281425) 2025-11-20T15:20Z 946.7K followers, 55.9K engagements "@karbonbased Funny how under this post theres more slop replies. Inf0Fi projects like Kait0 Y@ps G@lxe L@yer3 Cook1e W@llchain have caused so much harm by incentivizing AI bot networks. We need to be able to hide accounts / posts by country at minimum" [X Link](https://x.com/zachxbt/status/1997953937488719975) 2025-12-08T08:58Z 946.2K followers, 390.9K engagements "5/ To further confirm I found the correct BTC address in February [----] Haby began showing off a wallet with $237K in a group chat. The historical BTC balance for bc1qn3k from Feb [--] [----] matched a screenshot shared" [X Link](https://x.com/zachxbt/status/2005649198281363686) 2025-12-29T14:36Z 945.9K followers, 90.4K engagements "Congrats you accidentally outed yourself as a candidate for the worst onchain analyst of the year. The threat actor bridged from Bitcoin to Ethereum Litecoin & Ripple via Thorchain. The main entity taking the other-side of Thorchain swaps uses Binance for arbitrage. You can also easily tell these are Thorchain txns from the OP_Return memo in your screenshots. While Arkham is good free analytics tool for retail it does not attribute cross chain swaps or UTXO well. bc1qgkjems88jyk8hasj9ncspxz093nepdn00vaq0y = Thorchain user (threat actor) bc1q30drw0j0erj804lyvl8pxrj789kaplpu2dryx9 = Asgard" [X Link](https://x.com/zachxbt/status/2012929490016768148) 2026-01-18T16:46Z 946.3K followers, 116K engagements "Everyone knows his investigations are garbage Yet here you are in my DMs begging for help earlier this month. I have not used Bubblemaps in any of my investigations. I have zero ownership stake in Arkham and never have even have an affiliate link for them. How about actually providing evidence for your claims instead of making up unhinged conspiracies just because I never replied about helping review [----] files for you https://twitter.com/i/web/status/2014989448451354863 https://twitter.com/i/web/status/2014989448451354863" [X Link](https://x.com/zachxbt/status/2014989448451354863) 2026-01-24T09:11Z 945.9K followers, 24.6K engagements "@trading_axe John has negative opsec" [X Link](https://x.com/zachxbt/status/2015439670566612999) 2026-01-25T15:00Z 946K followers, 37.2K engagements "I would use X Chat more if the current issues are addressed: Search function does not work for legacy DMs after migration to XChat so you have no way to find old messages Still receive message alerts after muting accounts Cannot sort chats via folders or filter Cannot search or filter message requests No way to quickly scroll to messages from a specific time period Time period displays as weeks vs date https://twitter.com/i/web/status/2016154586193506472 https://twitter.com/i/web/status/2016154586193506472" [X Link](https://x.com/zachxbt/status/2016154586193506472) 2026-01-27T14:21Z 945.6K followers, 53K engagements "@2times_eth If its the Netflix documentary I am thinking about I declined to interview with them due to the trailer (glamorizing threat actors + interviewing d-tier celebs wit no connection to the story)" [X Link](https://x.com/zachxbt/status/2016782512367030642) 2026-01-29T07:56Z 946.2K followers, 60.1K engagements "A small portion has been returned by exchanges. The larger portion of funds is sitting in government seizure addresses until conclusion of the legal case ($100M+). Hopeful the victim will reward me fairly for my contribution after the larger portion is returned. (I was paid a smaller sum for my initial hours spent) https://twitter.com/i/web/status/2016806550204272781 https://twitter.com/i/web/status/2016806550204272781" [X Link](https://x.com/zachxbt/status/2016806550204272781) 2026-01-29T09:32Z 946K followers, [----] engagements "Please support the movement brother. Just claim the fees its a risk free donation thats all we ask. Why have you not publicly thanked us for using your likeness We promise to stop harassing you on every post if you show your support. Now the token price is down because of you and all investors have lost money" [X Link](https://x.com/zachxbt/status/2017605514994364533) 2026-01-31T14:26Z 946K followers, 77.1K engagements "@jasonkwon MaKeS yOu WoNdEr WhAt He Is HiDiNg" [X Link](https://x.com/zachxbt/status/2018841149318865166) 2026-02-04T00:16Z 946.7K followers, 70.1K engagements "@TGKContent @sama Open AI is the Epstein of AI companies if you think theyll act with integrity and safely handle user personal data vs max extract No Diddy" [X Link](https://x.com/zachxbt/status/2019157377522757923) 2026-02-04T21:13Z 946.7K followers, [----] engagements "Teams got by before due to number go up so currently all of the bs projects get rekt deservedly. The real issue is maybe 5-10 accounts max on CT publish quality content and none of them actively solicit marketing deals. Still hitting ATH reach on investigations regardless of current market conditions. https://twitter.com/i/web/status/2019216734473916911 https://twitter.com/i/web/status/2019216734473916911" [X Link](https://x.com/zachxbt/status/2019216734473916911) 2026-02-05T01:09Z 946.5K followers, 27.4K engagements "@crunch1271 @jerallaire deploying a honeypot" [X Link](https://x.com/zachxbt/status/2019226319834276191) 2026-02-05T01:47Z 946.5K followers, 10.3K engagements "@0xTakeProfits @jerallaire gramps first time using AI" [X Link](https://x.com/zachxbt/status/2019226410036896173) 2026-02-05T01:47Z 946.6K followers, [----] engagements "@SommerChase @jerallaire AI vibecoded slop does not equal quality" [X Link](https://x.com/zachxbt/status/2019227306137731517) 2026-02-05T01:51Z 946.5K followers, 18.8K engagements "@0xRiver8 @jerallaire Bc Circle is criminal" [X Link](https://x.com/zachxbt/status/2019227581527257239) 2026-02-05T01:52Z 946K followers, 10K engagements "@Surf_Liquid @jerallaire Blocked for AI slop" [X Link](https://x.com/zachxbt/status/2019237117457809518) 2026-02-05T02:30Z 946.5K followers, [----] engagements "@lopp Arbitrage countries with lenient laws for violent crime + low law enforcement cooperation when it involves multiple jurisdictions" [X Link](https://x.com/zachxbt/status/2019786307761738145) 2026-02-06T14:52Z 945.7K followers, [----] engagements "@Damos20820110 @TedPillows Web [--] prostitute" [X Link](https://x.com/zachxbt/status/2021953166603092215) 2026-02-12T14:22Z 946.7K followers, [----] engagements "1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple arrests and millions frozen" [X Link](https://x.com/zachxbt/status/1836752923830702392) 2024-09-19T13:03Z 946.7K followers, 13.3M engagements "Heres a long list of [--] NFT projects I did investigations on: Animoon - $6.3M Winter Bears - $3.4M [---] projects - $13M Rogue Society - $5.5M Rich Dwarves Tribe - $3.04M Boneheads - $3.1M Real Floyd NFT - $5M Croatia NFT scam group - $2.8M Rich Bulls Clubs - $3.4M MEE6 - $3M Eternal Beings - $4M Ether Monkeys - $2.8M Swipa The Fox - $1.75M Tribes of Ogun - $700K Billionaire Dogs Club - $960K Crazy Camels - $1.6M Rich Kids - $2M Fashion Ape - $1.1M Trollz- $4M Various NFT projects - $3.7M Players Only - $1.4M Vault of gems - $1M 0xCryatals - $1M Miss Universe - $370K Apes In Space - $10.8M" [X Link](https://x.com/zachxbt/status/1845197031427670048) 2024-10-12T20:17Z 946.7K followers, 63K engagements "1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support" [X Link](https://x.com/zachxbt/status/1859233108320555129) 2024-11-20T13:51Z 946.7K followers, 1.8M engagements "1/ An investigation into the alleged identity of the mysterious Hyperliquid whale tied to illicit activity that profited $20M via highly leveraged positions over the past couple weeks" [X Link](https://x.com/zachxbt/status/1902713021937426495) 2025-03-20T13:25Z 946.7K followers, 2.6M engagements "9/ Another 4.17K ETH ($12.4M) was received from MEXC earlier today flowing to 0xd8bc 0xe0f7a45a491d53f9361d35b4ef9908986d3b37b7 John has an extensive message history on Telegram flaunting his networth and calling others broke. TG ID: 8269661864" [X Link](https://x.com/zachxbt/status/2014685295258558797) 2026-01-23T13:03Z 946.7K followers, 97.4K engagements "History has shown that Circle is a bad actor. SwapNet contracts were exploited for $13M USDC on Base [--] hours ago. 3M USDC is still sitting freezable at 0x6cAad74121bF602e71386505A4687f310e0D833e Why should anyone continue building on $USDC when you never take care of your users as a centralized stablecoin issuer https://twitter.com/i/web/status/2015659175892885541 https://twitter.com/i/web/status/2015659175892885541" [X Link](https://x.com/zachxbt/status/2015659175892885541) 2026-01-26T05:32Z 946.7K followers, 22.2K engagements "@sethsetse until you have the realization that real humans from third world countries flood social media with the same AI slop as bots due to engagement groups ad revenue or other incentives" [X Link](https://x.com/zachxbt/status/2022230458956927036) 2026-02-13T08:44Z 946.7K followers, 50.5K engagements "@mierea @wyckoffweb You messaged about a case from [--] years ago perhaps its time to move on" [X Link](https://x.com/zachxbt/status/2019888890048573788) 2026-02-06T21:40Z 946.7K followers, [----] engagements "@sexinfochina @THORSwap @avax @SwapKitPowered @NEARProtocol @near_intents @AlexAuroraDev Yet I just showed screenshots of how the FreeCity market owner Telegram account was complaining in the Near Intents TG channel about the exact same transactions you shared As more proof heres an old DM before your last X account was banned" [X Link](https://x.com/zachxbt/status/2022506861317271672) 2026-02-14T03:03Z 946.7K followers, [----] engagements "Logan Paul thread coming Friday" [X Link](https://x.com/anyuser/status/1524544483186118658) 2022-05-12T00:18Z 946.7K followers, [----] engagements "1/ Lets breakdown the $6.3m NFT rug Animoon a project that has constantly screwed over its holders since day 1" [X Link](https://x.com/zachxbt/status/1532390797479403521) 2022-06-02T15:56Z 946.7K followers, [----] engagements "damn dillon danis is a scumbag feel bad for everyone he scammed" [X Link](https://x.com/anyuser/status/1606684028563849216) 2022-12-24T16:11Z 946.7K followers, 1.9M engagements "1/2 North Koreas Lazarus Group had a very busy weekend moving $63.5m (41000 ETH) from the Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges" [X Link](https://x.com/zachxbt/status/1614771861266792449) 2023-01-15T23:49Z 946.7K followers, 2.1M engagements "6/ EX 3: For this one Raichu worked with rapper Rich The Kid for the project Ancient Cats Club. The team quickly rugged shortly after launch stealing over $1.7m. The team of this project eventually launched other NFT scams like Bored Bunny and Rich Dwarves Tribe. 2/ On 4/21 the proceeds were transferred away to 0x53 and 0x7c. Well 0x53 sends them to 0x1c which has received money from -Ancient Cats Club ($1.7m rug) -Rich Dwarves Tribe ($3.2m rug) -Bored Bunny ($21m slow rug) https://t.co/MhJ56Tgh24 2/ On 4/21 the proceeds were transferred away to 0x53 and 0x7c. Well 0x53 sends them to 0x1c" [X Link](https://x.com/zachxbt/status/1643600915096559618) 2023-04-05T13:06Z 946.7K followers, 87.5K engagements "7/ EX 4: Raichu worked with The Game and Dillon Danis to promote Baby Dinger token another scam" [X Link](https://x.com/zachxbt/status/1643600924361781252) 2023-04-05T13:06Z 946.7K followers, 45.8K engagements "Over the past [---] months one person has created [---] meme coin scams. Each time stolen funds from the scam are sent to the exact same deposit address. 0x739c58807B99Cb274f6FD96B10194202b8EEfB47" [X Link](https://x.com/zachxbt/status/1651238822963826694) 2023-04-26T14:56Z 946.7K followers, 1.9M engagements "Update: Atomic Wallet Hack appears to potentially have been done by Lazarus Group/DPRK (seeing lots of similarities in the laundering patterns to Ronin + Harmony)" [X Link](https://x.com/zachxbt/status/1666115739764285445) 2023-06-06T16:12Z 946.7K followers, 144K engagements "1/ Its unfortunate I have to make this thread but I am being sued by MachiBigBrother for an article I published in June [----]. Today Machi filed the defamation lawsuit. The lawsuit is baseless and an attempt to chill free speech. I intend to fight back & defend free speech" [X Link](https://x.com/zachxbt/status/1669783717236342785) 2023-06-16T19:07Z 946.7K followers, 8.7M engagements "The same scammer profited $385K (234 ETH) in the past [--] hours off SIM swapping four different FriendTech users" [X Link](https://x.com/anyuser/status/1709697295464141208) 2023-10-04T22:29Z 946.7K followers, 125.6M engagements "Not that people in this space will care but @GROKERC20 $GROK was created by a scammer. Same exact X/Twitter account has been reused for at least one other scam. X/Twitter ID: 1690060301465714692" [X Link](https://x.com/zachxbt/status/1724094712309489810) 2023-11-13T15:59Z 946.7K followers, 2.1M engagements "1/ Throughout this year I have been monitoring someone who has withdrawn 11200+ ETH ($25M) from Tornado Cash and spent the majority of it on Magic The Gathering (MTG) trading cards. Heres my analysis of where the funds went and what the potential source of funds could be" [X Link](https://x.com/zachxbt/status/1732790450350703052) 2023-12-07T15:53Z 946.7K followers, 3.3M engagements "Remember when influencers with a lot of followers start shilling a project launch at the same time it is likely bc they have allocation and will dump their cheap tokens on you" [X Link](https://x.com/zachxbt/status/1748354861878616242) 2024-01-19T14:40Z 946.7K followers, 2M engagements "Remember when KSI posted All of a sudden my $XCAD bag is looking juicy again. #HodlGang Then proceeded to dump $850000 worth of XCAD over the following days from his wallet address. Does this still work Does this still work" [X Link](https://x.com/zachxbt/status/1757554675942060051) 2024-02-13T23:57Z 946.7K followers, 2.5M engagements "Thanks for playing" [X Link](https://x.com/anyuser/status/1757705192924221464) 2024-02-14T09:55Z 946.7K followers, 669.5K engagements "In May [----] the rank [--] DeGods NFT was stolen from a victim after visiting a phishing site and sold for $177K (99 ETH). I am pleased to share I was able to help recover a decent chunk of the stolen funds which have now been returned back to the victim. While recovery can be a lengthy process it does happen and I am always happy to share these success stories. https://twitter.com/i/web/status/1761346473340657773 https://twitter.com/i/web/status/1761346473340657773" [X Link](https://x.com/zachxbt/status/1761346473340657773) 2024-02-24T11:04Z 946.7K followers, 598.2K engagements "I am pleased to share @pokerbrat2019 aka Robert Robb was arrested earlier today in Las Vegas according to Henderson Police records. In December [----] I made a post detailing how he stole $1.2M+ from [--] individuals and exposed his prior criminal history of fraud. Since then I have been working with victims to get them justice. While we cannot know for sure until court documents are released I doubt there would be any other reason for the arrest" [X Link](https://x.com/zachxbt/status/1770681711728177480) 2024-03-21T05:19Z 946.7K followers, 873.7K engagements "1/ An investigation into the French dev Jolan Lacroix who recently stole $900K from the TICKER presale on Base before spending the funds on meme coins and Milady NFTs" [X Link](https://x.com/anyuser/status/1770821182838763998) 2024-03-21T14:34Z 946.7K followers, 1.4M engagements "30.1K BTC ($2.1B) of Silk Road hack funds controlled by US government is on the move right now. [-----] BTC ($69) transferred to a Coinbase deposit address so its a test transfer possibly. txn hash 9c3af4b48e66565f1da1da8278036fa1dbb09f2beaaca99c3504475390ba4590 Coinbase deposit address 3KrZVU9Jz4UKHpKUtuvkEMX1tY8zeiTvX2" [X Link](https://x.com/anyuser/status/1775193016363356238) 2024-04-02T16:06Z 946.7K followers, 2.5M engagements "I have been borderline harassed by @IRS_CI agents on 4-5 occasions now in the past few months with a blatant disregard for any professionalism so I have decided to now share this publicly. They have shown up irl to old addresses contacted personal emails using private data and have sent mail when I have public contact methods readily available. I have always been willing to support victims of scams with documentation needed by law enforcement to aid cases but if you overstep personal boundaries why would I want to assist you" [X Link](https://x.com/zachxbt/status/1776282328572072137) 2024-04-05T16:14Z 946.7K followers, 1.1M engagements "Wtf two of my posts were cited in a recent United Nations report" [X Link](https://x.com/zachxbt/status/1777325294900134233) 2024-04-08T13:19Z 946.7K followers, 568K engagements "Unfollow and block all of the influencers who were shilling you any of these vaporware projects to you as the next bluechip (@CryptoGodJohn @TheCryptoKazi @crypto_TomTom @cryptostasher etc) $scale - ScaliaInfra (-95.3% 24hrs) $tpu - TensorSpace_Ai (-96.3% [--] hrs) $ntd - NTensorDynamics (-97.4% 24hrs) $zkml - ZKMLsystems (-70.6% 24hrs) The same influencers will continue shilling garbage to you throughout the cycle" [X Link](https://x.com/zachxbt/status/1779240455730831705) 2024-04-13T20:09Z 946.7K followers, 1.5M engagements "Community Alert: The group of scammers who stole [--] figs with Magnate Kokomo Lendora Solfire etc is back with a new project on Blast @Leaperfinance Last week they funded an address on Blast with $1M of laundered funds from the previous rugs and have begun adding liquidity to bait people in. Tracing: 1). [--] week ago 0x46a moves ETH a few hops from Magnate scam to 0x10e 0x46a10e7444bf78736E6a24b1De8dc8A20E4B3ED7 0x10ef5bb874b226bdd6860f00d5e5a2aa3e955b9a 2). Bridges to 0xAc9 on Polygon 0xAc973E1Be91fe8674dff2E0de4A9375803Ae4435 3). 0xAc9 transfers wETH to 0x08" [X Link](https://x.com/zachxbt/status/1779333168383791411) 2024-04-14T02:17Z 946.7K followers, 966K engagements "Only [--] month has passed and [--] of the Solana presale meme coins have been completely abandoned after raising [------] SOL ($26.7M). Would avoid any future projects launched by these founders. I was interested to see how much SOL has been sent as a result of the presale meta and calculated [------] SOL ($122.5M) raised from [--] presales. https://t.co/dvsW4TSoov I was interested to see how much SOL has been sent as a result of the presale meta and calculated [------] SOL ($122.5M) raised from [--] presales. https://t.co/dvsW4TSoov" [X Link](https://x.com/zachxbt/status/1782130097895477469) 2024-04-21T19:31Z 946.7K followers, 1.3M engagements "Putting final touches this week on an investigation I have been working on for 15+ months. By far my biggest project to date and I look forward to sharing it soon. Expect no other new posts in the meantime" [X Link](https://x.com/zachxbt/status/1782408905257005234) 2024-04-22T13:59Z 946.7K followers, 1.3M engagements "Proud to share that earlier this year I helped lead an initiative which resulted in the successful seizure of $12M connected to the Caesars ransomware incident from September [----]. This was done in collaboration with @cryptoesq and law enforcement" [X Link](https://x.com/zachxbt/status/1786087795573903586) 2024-05-02T17:38Z 946.7K followers, 531.5K engagements "coming from the clown who runs a call channel to do undisclosed shills and pump and dump meme coins on followers. influencers like you who contribute absolutely nothing and only extract are why this space sucks. guess the $800K+ profited from the bundle does not matter or that the founder is sketchy" [X Link](https://x.com/zachxbt/status/1794179706691969164) 2024-05-25T01:32Z 946.7K followers, 20.8M engagements "For those who are confused and need additional context. Earlier today Arkham announced a $150K bounty for the identity of the DJT creator 11:49 pm UTC I reply to Arkham saying I submitted for the bounty 11:57 pm UTC Martin Shkreli panic DMs me 12:27 am UTC Martin Shkreli creates a spaces and announces he is the creator of DJT" [X Link](https://x.com/anyuser/status/1803240784436797871) 2024-06-19T01:38Z 946.7K followers, 2.4M engagements "@10Ronaldinho Is this a translation for you are bankrupt again In case you forgot here are all of the crypto projects you pump and dumped over the years" [X Link](https://x.com/zachxbt/status/1805076904682434863) 2024-06-24T03:14Z 946.7K followers, 192.4K engagements "1/ So I began tracing the $230M+ WazirX hack back from the original exploiter address and was able to make some interesting observations. 📢 Update: We're aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident. To ensure the safety of your assets INR and crypto withdrawals will be temporarily paused. Thank you for your patience and understanding. 📢 Update: We're aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident. To ensure the safety of your assets INR and" [X Link](https://x.com/zachxbt/status/1813896332022882686) 2024-07-18T11:19Z 946.7K followers, 1.4M engagements "1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed. Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities. I then uncovered 25+ crypto projects with related devs that have been active since June 2024" [X Link](https://x.com/anyuser/status/1824047425822310580) 2024-08-15T11:36Z 946.7K followers, 2.7M engagements "Jason Derulo has not posted about his JASON token on X/Twitter since July. Wonder what happened to: I am committed to this space long term. I want to see everyone win in our community and I want to grow not just our family but all of crypto Yesterday Jason promoted another Tron meme coin and deleted shortly after. Shame on all of the influencers who promoted him and thought this time would be different from the 15+ scams he has promoted in the past" [X Link](https://x.com/zachxbt/status/1831378023091990727) 2024-09-04T17:05Z 946.7K followers, 933.7K engagements "1/ The UK scammer @ape_31 @60711 has stolen more than $650K from 250+ X users in the past year by posting fake PNL screenshots from a Bybit demo account and running a news account to funnel unsuspecting victims into paid services before blocking them upon receiving payment" [X Link](https://x.com/zachxbt/status/1840749550304125401) 2024-09-30T13:44Z 946.7K followers, 1.9M engagements "In April [----] an elderly victim from the US was targeted by Indian call scammers posing as Coinbase support resulting in a large portion of their life savings stolen. Pleased to share that I helped recover $275K which was recently seized and will be sent back to them. Theft txn hash 30125031d32a3a2ec9a6963d218bf2494d4392d9444586061a97d84511479346 During my research I found $5M+ stolen from other victims of this group which were laundered from Ethereum/Bitcoin to Tron via centralized exchanges before stablecoins were transferred to OTCs" [X Link](https://x.com/zachxbt/status/1843261993282650156) 2024-10-07T12:08Z 946.7K followers, 637.9K engagements "1/ A short story about how the influencer @edgeville got caught lying to the community three times this weekend about an allocation for a project all for $2.2K" [X Link](https://x.com/zachxbt/status/1848028277002137886) 2024-10-20T15:47Z 946.7K followers, 1.1M engagements "7/ Alex Labs was hacked for $4.5M in May [----] by Lazarus Group. One of the theft addresses deposited [---] ETH to a privacy protocol on June [--] [----] 0xc0a0ec4dbf170611cc76f31a9df910ad79bc2266 Matching amounts were withdrawn the same day to two addresses 0x9fc1350f80734044b7189fe7b8f288396f76feb5 0x21c926a1a328a4906feeb18664d00f3d85df1aed Another theft address deposited [---] ETH from June 27-28th 0x1871bb6257b1f622548ef64a12ae5149eb208bd8 Shortly after a matching amount was withdrawn commingling with the Irys co-founder stolen funds. 0xddb2e9feaf0a122b43be14bc085cf713703ce45c On August 13th funds" [X Link](https://x.com/zachxbt/status/1849071168411607353) 2024-10-23T12:51Z 946.7K followers, 103.7K engagements "@FatManTerra Finally they got that OTC scammer He stole $7.1M (14.6K TAO) from a TAO whale in February [----] Also scammed ZYN MOG Kondux Ordiswap Landwolf and Hash AI whales for another $8M+ all this year. Looks like someone got scammed a few hours ago for 45M $OX ($600k). Previously it looks like this person had bought $4.4M of $OX from Sifu. Basically this person got scammed for tokens purchased from scammer of project created by scammer. https://t.co/QxcLm1vofF Looks like someone got scammed a few hours ago for 45M $OX ($600k). Previously it looks like this person had bought $4.4M of $OX" [X Link](https://x.com/zachxbt/status/1864005956163498170) 2024-12-03T17:57Z 946.7K followers, 75.6K engagements "@EdgeWallet Thanks for not crediting the original source. 1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple arrests and millions frozen. https://t.co/dcY1e9xsPd 1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple" [X Link](https://x.com/zachxbt/status/1871413493930570074) 2024-12-24T04:32Z 946.7K followers, 283.2K engagements "@realDonaldTrump" [X Link](https://x.com/zachxbt/status/1880459202768040206) 2025-01-18T03:36Z 946.7K followers, 1.5M engagements "11/ I do not blame all Coinbase employees as most of the fault lies on leadership for these decisions. While this post is critical of Coinbase what have they done well providing good stablecoin on-ramp / off-ramp for retail attracting talent to build on Base recovery tool for users who deposit unsupported assets fighting the SEC Coinbase custody product allowing users to passively earn yield on stables easily (Also theres only so much you can do to educate people about threats such as email/call spoofing)" [X Link](https://x.com/zachxbt/status/1886412046524129743) 2025-02-03T13:50Z 946.7K followers, 101.9K engagements "@arkham @benbybit @Bybit_Official My submission has been sent identifying the organization behind the attack using on-chain data" [X Link](https://x.com/anyuser/status/1893020507160670411) 2025-02-21T19:30Z 946.7K followers, 428.6K engagements "@arkham TLDR myself and Josh from CF connected the Bybit hack on-chain to the Phemex hack" [X Link](https://x.com/zachxbt/status/1893034959721386031) 2025-02-21T20:27Z 946.7K followers, 540.3K engagements "I am not interested in Pulsechain investigations as that community did not prioritize building decent analytics tools or paying for integrations. Its difficult to analyze a chain without a Etherscan block explorer product on EVM chains Without Chainalysis or TRM integrations complex investigations take 10X as much work Without integrations for Arkham/Nansen / etc theres few options for retail to read/interpret activity" [X Link](https://x.com/zachxbt/status/1903448298251272216) 2025-03-22T14:06Z 946.7K followers, 26.1K engagements "@TheNotoriousMMA @getrealtoken" [X Link](https://x.com/anyuser/status/1908557016228057596) 2025-04-05T16:27Z 946.7K followers, 173.8K engagements "Your team stole $30M of investor funds from Zkasino and you were arrested. After those millions were gambled away via Hyperliquid/GMX leveraged positions and laundered the via instant exchanges and crypto to cash OTCs over the past few months. Elham Nourzai if there was a tier list for CT scammers you would be at the top" [X Link](https://x.com/zachxbt/status/1909153804131369256) 2025-04-07T07:58Z 946.7K followers, 230.5K engagements "@satoshivm From SAVM shilled by many influencers last year at TGE to one year later no social media activity on X/TG no Github activity in months and token down 99%. Who could have possibly seen this coming" [X Link](https://x.com/zachxbt/status/1913534556260425737) 2025-04-19T10:06Z 946.7K followers, 63.6K engagements "Nine hours ago a suspicious transfer was made from a potential victim for [----] BTC ($330.7M) Theft address bc1qcrypchnrdx87jnal5e5m849fw460t4gk7vz55g Shortly after the funds began to be laundered via 6+ instant exchanges and was swapped for XMR causing the XMR price to spike 50%" [X Link](https://x.com/anyuser/status/1916756932763046273) 2025-04-28T07:30Z 946.7K followers, 3.5M engagements "@elonmusk Please update DMs & XChat by adding a filter to choose who can add you to group chats. Currently any user can add you to a group unless you turn off your messages entirely" [X Link](https://x.com/zachxbt/status/1934480418834972951) 2025-06-16T05:17Z 946.7K followers, 880K engagements "6/ An unnamed source provided a personal email of an account that interacted multiple time with the WhiteRock deployer address. I noticed the email has an account on Chess(.)com with the username IldarTheGrandMaster. Prometheus from Zkasino = Ildar Whiterock alias = Goedel goedel014@gmail(.)com" [X Link](https://x.com/zachxbt/status/1934616677473534266) 2025-06-16T14:18Z 946.7K followers, 100.1K engagements "The crime supercycle is indeed very real. While its true the industry has historically been ripe for abuse it has noticeably increased since politicians launched meme coins and numerous court cases were dropped further enabling the behavior. Laundering groups and small OTC brokers have seemingly won the battle for Lazarus Group after successfully laundering recent hacks (Bybit DMM Bitcoin WazirX etc) with ease. I estimate the Black U market on Tron is no less than $5-10B and largely unattributed. A number of teams sit and watch collecting fees doing nothing when 50% of the activity for their" [X Link](https://x.com/anyuser/status/1935178436970168347) 2025-06-18T03:31Z 946.7K followers, 683K engagements "Since July [--] [----] an address linked to Ripple co-founder Chris Larsen transferred out 50M XRP ($175M) to four addresses. $140M ended up at exchanges/services 30M XRP recipient rPS9kVPbgZF4vXq2hs6s9Xv2754qdRau98 rnQXgGAjqbF4KoBpcBK5YBHyZEL7nGWWoi 10M XRP recipient rHtLaipqqfbhgMSHkF1YcuWaivvgRH851o $35M received to two new addresses 5M XRP recipient rNLrQvgfLZNLqcqjAAQYBUNBSC5dVkiDXw 5M XRP recipient rhmkfhYZY3XJgGTcGxLAKuEoph49bmMqbb" [X Link](https://x.com/zachxbt/status/1948277287033409710) 2025-07-24T07:01Z 946.7K followers, 464.1K engagements "@memenetic POV your new meme coin grift is destined for failure due to influencer bukkake 150+ promotional posts from d-tier influencers millions of botted followers and likes only [--] SOL raised for the presale few disclosures for the posts" [X Link](https://x.com/zachxbt/status/1959237311880966480) 2025-08-23T12:52Z 946.7K followers, 123.9K engagements "@ICEBOYBILL @OpenVPP Same influencers who were pushing the depin / ai / gpu tax farms earlier this cycle" [X Link](https://x.com/zachxbt/status/1968339828636065958) 2025-09-17T15:42Z 946.7K followers, 12.3K engagements "@Cointelegraph @forsetis_anon Does the Countelegraph team vet sponsors An old Brian Krebs investigation named the Ice Blockchain / Online CEO Alexandru Florea (Zeus) as a cybercrinimal that was the admin of Microleaves a service that was alleged malware/botnet and linked to the [----] ICO rug OIO" [X Link](https://x.com/zachxbt/status/1975862916264952139) 2025-10-08T09:56Z 946.7K followers, 33.9K engagements "@stablealt @HyperliquidX HypurrScan team deserves hundreds of lashes for fumbling their early mover advantage and overlooking basic features EX: The Unit protocol address is not even publicly tagged when they are one of the largest HL protocols" [X Link](https://x.com/zachxbt/status/1978374388970889669) 2025-10-15T08:16Z 946.7K followers, 20.1K engagements "i did not call Vultisig a scam i called out the founder for his history of negligence and lack of morals: ThorFi [--] fig rug via admin key Explicit refusal to return any fees generated on his products from illicit activity (Thorchain Vultisig etc) Associated projects hired DPRK IT workers Personal wallets hacked by DPRK malware after a meeting call scam via Telegram if theres ever any future incidents that are material enough you can be certain he will avoid taking full responsibility https://twitter.com/i/web/status/1982068479466652029 https://twitter.com/i/web/status/1982068479466652029" [X Link](https://x.com/zachxbt/status/1982068479466652029) 2025-10-25T12:55Z 946.7K followers, 41.8K engagements "@patriotsounds @TegiXBT The victims were not provided full compensation by TCY and admin mimir was done unilaterally. A class action lawsuit was even organized by multiple victims as a result of the negligence" [X Link](https://x.com/zachxbt/status/1982079426537140714) 2025-10-25T13:38Z 946.7K followers, [----] engagements "@hammerfrog64 rip" [X Link](https://x.com/zachxbt/status/1983224601636417994) 2025-10-28T17:29Z 946.7K followers, 26.3K engagements "@BNBCHAIN Thanks I look forward to publishing my upcoming investigation into an exploit" [X Link](https://x.com/zachxbt/status/1986041150583845045) 2025-11-05T12:01Z 946.7K followers, 38.9K engagements "@crunch1271 will be donating $5K to a Chile Wildfire charity once @CarlotaFang77 is online (40 SOL received from fees) Hola. I don't like making this kind of post because it can sometimes lead to misinterpretations but I feel its my moral duty and responsibility to do so. Most crypto outlets in the region dont seem to give a fuck about tragedies/charity like this on a regular basis. Besides my https://t.co/LHEgiiWMTP Hola. I don't like making this kind of post because it can sometimes lead to misinterpretations but I feel its my moral duty and responsibility to do so. Most crypto outlets in" [X Link](https://x.com/zachxbt/status/2013586872728199346) 2026-01-20T12:18Z 946.7K followers, 44.6K engagements "Let me rephrase: Ledger a French security company has been breached multiple times which resulted in its customers private data being leaked has lead to targeted thefts and millions stolen. Current products have major issue like the battery for the Ledger Nano X. Now Ledger plans to max extract more via US IPO after recently announcing they will also charge a % for clear signing. https://twitter.com/i/web/status/2014619383294001655 https://twitter.com/i/web/status/2014619383294001655" [X Link](https://x.com/zachxbt/status/2014619383294001655) 2026-01-23T08:41Z 946.7K followers, 123K engagements "@Ledger [----] starter pack" [X Link](https://x.com/zachxbt/status/2014622240051233179) 2026-01-23T08:52Z 946.7K followers, 168.1K engagements "@follis_ Just another day in crypto" [X Link](https://x.com/zachxbt/status/2015675238646939927) 2026-01-26T06:36Z 946.7K followers, 55.8K engagements "@yieldhunter95 They first targeted him from the Ledger data breach" [X Link](https://x.com/zachxbt/status/2019498994930520247) 2026-02-05T19:50Z 946.7K followers, 17.9K engagements "@heiskaws @tayvano_ Sorry I am not assisting with a $10 theft" [X Link](https://x.com/zachxbt/status/2019813323815199060) 2026-02-06T16:39Z 946.7K followers, 17.2K engagements "@0xRustyy @wyckoffweb It is tiring when people always act entitled to your time and then proceed to get upset at you publicly" [X Link](https://x.com/zachxbt/status/2019860761846411584) 2026-02-06T19:48Z 946.7K followers, [----] engagements "5/ Wiz (Veer) received a large % cut from theft and slipped up during screenshare by leaking his full name during the theft. Additional comfort was gained as throughout multiple recordings accomplices referred to him as Veer on audio and in chats. $34.5M of his funds sit here 0x3c7a5f2795e73d2b94a9120a643f608cfc45c935" [X Link](https://x.com/zachxbt/status/1836753207436927042) 2024-09-19T13:04Z 946.7K followers, 903.8K engagements "1/ An investigation into Faris Ali (Zay/Tommy) from the UK and his alleged involvement in robbing an X user out of $4.3M in June [----] during a home invasion as the result of a crypto data breach. https://www.blogdelnarco.org/2024/12/ejecutan-en-su-mercedes-benz-y-al-salir.html https://www.blogdelnarco.org/2024/12/ejecutan-en-su-mercedes-benz-y-al-salir.html" [X Link](https://x.com/zachxbt/status/1844369881342542170) 2024-10-10T13:30Z 946.7K followers, 2M engagements "Update: OpenVPP appears to potentially be misrepresenting another partnership with Commonwealth Edison (ComEd). When contacted the company stated: We did not partner with them and are not interested" [X Link](https://x.com/zachxbt/status/1968704019347484884) 2025-09-18T15:49Z 946.7K followers, 314.4K engagements "9/ Unfortunately the likelihood of this victim seeing any funds recovered is rather low due to a delay in reporting the theft to competent people within the private sector. I recommend victims try to report theft addresses to people as soon as possible as otherwise it can be difficult to detect that a theft even took place. Ripple does not have as good of a support system for victims within their community as there is in Bitcoin Ethereum Solana and major EVM chains. I always try to reply to people who contact me about verified recent thefts $250K to at least instruct them to report and flag" [X Link](https://x.com/zachxbt/status/1979899792000958802) 2025-10-19T13:17Z 946.7K followers, 333.1K engagements "Update: USG made a press release today formally announcing Ronald has been charged" [X Link](https://x.com/zachxbt/status/2002115662328848388) 2025-12-19T20:35Z 946.7K followers, 83.6K engagements "@TroveMarkets For Trove victims heres who was introducing themselves as its founder unwisecap during a side event at Token2049 in Oct 2025" [X Link](https://x.com/zachxbt/status/2013493657551110381) 2026-01-20T06:07Z 946.7K followers, 1.1M engagements "Update: John dusted my public address zachxbt.eth from one of the theft addresses. Transaction hash 0x25d3b02b17ccf5f0867bfbaa86c4cb918766d2b79e30cdcb7847298febfa2d15" [X Link](https://x.com/zachxbt/status/2014775112361509069) 2026-01-23T18:59Z 946.7K followers, 155.3K engagements "Update: Update: John (Lick) sent me [------] ETH ($1.9K) of the stolen government funds from 0xd8bc to my public wallet address. Transaction hash 0x90539e91fbebd0aaa050a492548b1e3b1bc7d82dd84bf8a42a9595a90425ebfa (Any stolen funds received will be sent to a USG seizure address) 4/ In part [--] of the recording Dritan continues to mock John while another $6.7M worth of ETH is moved into the wallet address below: 0xd8bc7ea538c2e9f178a18cc148892ae914a55d08 https://t.co/CZ5VcQHumP 4/ In part [--] of the recording Dritan continues to mock John while another $6.7M worth of ETH is moved into the wallet" [X Link](https://x.com/zachxbt/status/2015771036458049648) 2026-01-26T12:57Z 946.7K followers, 278.1K engagements "@sama Scam Altman" [X Link](https://x.com/zachxbt/status/2019146763307827343) 2026-02-04T20:31Z 946.7K followers, 102.3K engagements "@sirshibaninja @phantom Blocked for AI slop" [X Link](https://x.com/zachxbt/status/2021032508692058244) 2026-02-10T01:24Z 946.7K followers, 10.7K engagements "@MeanHash Sorry not spending time on work without basic details like a ransom payment address at a minimum. Also I only help people native or adjacent to our industry and not others as they generally do not offer fair comp or respect anonymity" [X Link](https://x.com/zachxbt/status/2021536689420943748) 2026-02-11T10:47Z 946.7K followers, [----] engagements "@zoomerfied Heres the Figure co-founder last month" [X Link](https://x.com/zachxbt/status/2022512150426931213) 2026-02-14T03:24Z 946.7K followers, 13.5K engagements "11/ While most of the funds were converted to XMR both Box and Wiz accidentally linked the laundered funds with the dirty funds on multiple instances. a) Wiz during screenshare showed an address he sent funds to for designer clothes which had millions in exposure to the cluster above. 0xb98b8ac004cea6617adcf3e94106d0eec1792bd9 b) Box linked the dirty funds with the cleans funds by accidentally reusing a deposit address. 0x6d865235ebb2504d3478fc1dd839100d210144df" [X Link](https://x.com/zachxbt/status/1836753450672988649) 2024-09-19T13:05Z 946.7K followers, 640.3K engagements "13/ As a result of the investigation Box and Greavys were arrested yesterday evening in Miami and LA. I would expect law enforcement seized additional funds during the arrests due to large transfers around that period of time" [X Link](https://x.com/zachxbt/status/1836753468725338346) 2024-09-19T13:05Z 946.7K followers, 616.7K engagements "@BitoEx_Official Do you want to explain to the community why multiple of your hot wallets saw suspicious outflows of $11.5M on May [--] [----] where you still have not disclosed the security incident on X or Telegram several weeks later" [X Link](https://x.com/zachxbt/status/1929417001296146868) 2025-06-02T05:57Z 946.7K followers, 76.7K engagements "@NewsyJohnson pov" [X Link](https://x.com/zachxbt/status/1931216174903398723) 2025-06-07T05:06Z 946.7K followers, 80K engagements "@MEXC_Official @Gate_io Update: Ildar Ilham aka @XBT_Prometheus (founder of @WhiteRock_Fi) was arrested by UAE law enforcement for his involvement in the $30M Zkasino exit scam. He will be extradited to the Netherlands next for the criminal case" [X Link](https://x.com/zachxbt/status/1940767194931253529) 2025-07-03T13:38Z 946.7K followers, 372.5K engagements "The affidavit confirmed all of the victims from my investigation Victim [--] = Beeple Victim [--] = DeeKay Victim [--] = Zeneca Victim [--] = Nouns DAO Victim [--] = JRNY Club 7/ The hacked Twitter accounts lead to millions of dollars worth of crypto stolen in total. This table shows a rough estimate for the amount of crypto stolen with each account in the Tweet above. https://t.co/DEzL3tmnmk 7/ The hacked Twitter accounts lead to millions of dollars worth of crypto stolen in total. This table shows a rough estimate for the amount of crypto stolen with each account in the Tweet above. https://t.co/DEzL3tmnmk" [X Link](https://x.com/zachxbt/status/1950526073055150546) 2025-07-30T11:57Z 946.7K followers, 164.3K engagements "10/ Still one of the more common questions is how do you know they are North Korean Well besides all of the fraudulent documents detailed above their search history showed frequent Google Translate usage with translations to Korean with a Russian IP" [X Link](https://x.com/zachxbt/status/1955614268327444658) 2025-08-13T12:55Z 946.7K followers, 217.2K engagements "@inversebrah These botted milady meme coin KOL scammer accounts that keep appearing out of nowhere are so annoying" [X Link](https://x.com/zachxbt/status/1964634423556788684) 2025-09-07T10:18Z 946.7K followers, 42K engagements "Whats most interesting is wallet addresses listed in the US government $14B (127K BTC) seizure previously were named in a Milky Sad report [--] years ago for having vulnerable private keys and now the USG says they have custody of them. ZOOMER U.S. SEEKS FORFEITURE OF [------] BTC ($12B) TIED TO TRANSNATIONAL PIG BUTCHERING SCAM RUN BY CHINESE NATIONAL CHEN ZHI ZOOMER U.S. SEEKS FORFEITURE OF [------] BTC ($12B) TIED TO TRANSNATIONAL PIG BUTCHERING SCAM RUN BY CHINESE NATIONAL CHEN ZHI" [X Link](https://x.com/zachxbt/status/1978124927162098025) 2025-10-14T15:45Z 946.7K followers, 653K engagements "1/ An investigation into how I identified one of suspects tied to the $28M Bittensor hack from [----] by identifying anime NFT wash trades linked to a former employee and earned a whitehat bounty for my efforts" [X Link](https://x.com/zachxbt/status/1978465677578301723) 2025-10-15T14:19Z 946.7K followers, 471.5K engagements "@cecilia_hsueh @TheWhiteWhaleV2 @MEXC_Official Vendor: How many bots do you want MEXC exec: All of them" [X Link](https://x.com/zachxbt/status/1983920902501777512) 2025-10-30T15:36Z 946.7K followers, 259.2K engagements "Update: A superseding indictment from a few hours ago confirmed my analysis that Danny / Danish Zulfiqar (Khan) was arrested in Dubai. Seizure address 0xb37d617716e46511E56FE07b885fBdD70119f768" [X Link](https://x.com/zachxbt/status/1998267579136455090) 2025-12-09T05:44Z 946.7K followers, 178.7K engagements "10/ Haby regularly posts stories and selfies flaunting his lifestyle with little regard for opsec and was also caught simping for eGirls" [X Link](https://x.com/zachxbt/status/2005649220657934837) 2025-12-29T14:36Z 946.7K followers, 117.7K engagements "12/ Canadian law enforcement may already be familiar with Haby since theres been several swatting attempts involving his personal details locally. Unfortunately Canada is a jurisdiction that rarely ever prosecutes threat actors from The Com. I hope Canadian LE makes an exception as Haby shows zero remorse for victims and it is a rather easy case due to the large quantity of evidence available. https://twitter.com/i/web/status/2005649228408725593 https://twitter.com/i/web/status/2005649228408725593" [X Link](https://x.com/zachxbt/status/2005649228408725593) 2025-12-29T14:36Z 946.7K followers, 173K engagements "3/ In part [--] of the recording Dritan mocks John however John screenshares Exodus Wallet which shows the Tron address below with $2.3M: TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg" [X Link](https://x.com/zachxbt/status/2014685270868660288) 2026-01-23T13:02Z 946.7K followers, 165.2K engagements "7/ 0xc7a2 received $24.9M from a US Government address in March [----] related to the Bitfinex hack seizure which is a theft from the USG I previously reported about in Oct [----]. $18.5M currently sits at 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5" [X Link](https://x.com/zachxbt/status/2014685284726673590) 2026-01-23T13:02Z 946.7K followers, 132.9K engagements "Update: John quickly removed all of the NFT usernames from his Telegram account and change his screenname after my post" [X Link](https://x.com/zachxbt/status/2014690119593373979) 2026-01-23T13:22Z 946.7K followers, 151.9K engagements "Update: Patrick Witt (Executive Director for the US Presidents Council of Advisors for Digital Assets) & USMS have both stated they are looking into the incident" [X Link](https://x.com/zachxbt/status/2016113890736951777) 2026-01-27T11:39Z 946.7K followers, 79.9K engagements "@ParochuteCrypto @wyckoffweb I do not take on XRP cases and never asked to be contacted" [X Link](https://x.com/zachxbt/status/2019881750755963041) 2026-02-06T21:11Z 946.7K followers, [----] engagements "@FFVV1211 @Polymarket Coincidentally it comes only a few days after Logan Paul promoted Polymarket inorganically in a YT video" [X Link](https://x.com/zachxbt/status/2020841332617699501) 2026-02-09T12:44Z 946.7K followers, 53.2K engagements "A class action lawsuit was filed in Canada against the Boneheads team for the $3.1M NFT rug pull The team quickly disappeared and spent the mint funds on BAYCs luxury goods and other items never fulfilling the roadmap Yet another case where my research has been cited 1/ Investigating the $3.1m rug pull @BONEHEADS and the breadcrumbs left behind by the team into how the money has actually been spent. 1/ Investigating the $3.1m rug pull @BONEHEADS and the breadcrumbs left behind by the team into how the money has actually been spent" [X Link](https://x.com/zachxbt/status/1677336923336065024) 2023-07-07T15:21Z 946.7K followers, 488K engagements "Update: Box (Jeandiel) and Greavys (Malone) just had the indictment for the case unsealed https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam" [X Link](https://x.com/zachxbt/status/1836847633018626466) 2024-09-19T19:19Z 946.7K followers, 846.9K engagements "1/ Over the past few months I imagine you have seen many Coinbase users complain on X about their accounts suddenly being restricted. This is the result of aggressive risk models and Coinbases failure to stop its users losing $300M+ per year to social engineering scams" [X Link](https://x.com/zachxbt/status/1886411879939031530) 2025-02-03T13:50Z 946.7K followers, 2.4M engagements "7/ I think the risk of a rug with WhiteRock remains high due to their history with other projects (Zkasino Syncus Zigzag). I hope @MEXC_Official @Gate_io considers delisting WHITE and also conduct enhanced due diligence on the team. As the Zkasino team awaits trial hopefully soon Ildar Ilham Elham Nourzai & Lior Ben Zakan face serious legal repercussions for all of the harm they have caused to investors. https://twitter.com/i/web/status/1934616688928113045 https://twitter.com/i/web/status/1934616688928113045" [X Link](https://x.com/zachxbt/status/1934616688928113045) 2025-06-16T14:18Z 946.7K followers, 169.8K engagements "1/ Multiple projects tied to Pepe creator Matt Furie & ChainSaw as well as another project Favrr were exploited in the past week which resulted in $1M stolen My analysis links both attacks to the same cluster of DPRK IT workers who were likely accidentally hired as developers" [X Link](https://x.com/zachxbt/status/1938598925004607629) 2025-06-27T14:02Z 946.7K followers, 880.1K engagements "Update: Crypto Beast just reactivated his account and changed his username to @realcryptoelio a few minutes ago" [X Link](https://x.com/zachxbt/status/1953009741635944649) 2025-08-06T08:26Z 946.7K followers, 183.5K engagements "1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects" [X Link](https://x.com/zachxbt/status/1955613912201896113) 2025-08-13T12:54Z 946.7K followers, 1.1M engagements "@ceterispar1bus @mert *post about top [---] token = paid shill* Mert Cobie etc 51% bundled ZEC for supply control MRP coded CA" [X Link](https://x.com/zachxbt/status/1990030432935776636) 2025-11-16T12:13Z 946.7K followers, 73.1K engagements "Yes $6M+ stolen at minimum from hundreds of Trust Wallet users. Hopefully they will offer compensation to everyone if its determined theyre at fault for the incident. Its difficult to map out since theres many theft addresses. Heres my list so far below: EVM 0x3b09A3c9aDD7D0262e6E9724D7e823Cd767a0c74 0x463452C356322D463B84891eBDa33DAED274cB40 0xa42297ff42a3b65091967945131cd1db962afae4 0xe072358070506a4DDA5521B19260011A490a5aaA 0xe072358070506a4DDA5521B19260011A490a5aaA 0xc22b8126ca21616424a22bf012fd1b7cf48f02b1 0x463452c356322d463b84891ebda33daed274cb40" [X Link](https://x.com/zachxbt/status/2004298839625195720) 2025-12-25T21:10Z 946.7K followers, 205.1K engagements "@cozypront That X account is a scammer larping as a girl and lying about being a victim of the hack to bait engagement. [--] username changes countless meme coin scams only [---] posts for a [----] account they preblocked me X User ID: 1725149174780268544" [X Link](https://x.com/zachxbt/status/2004400108532793558) 2025-12-26T03:53Z 946.7K followers, 184.3K engagements "4/ Haby swapped his cut from the thefts from XRP to BTC via instant exchanges. By performing a timing analysis i was able to locate his BTC address. bc1qn3k5cz3905p6k50r44pjlj2rl9qcy72flsq3zh" [X Link](https://x.com/zachxbt/status/2005649194435195201) 2025-12-29T14:36Z 946.7K followers, 95.9K engagements "@MarcellxMarcell Question: How down bad do you have to be to blatantly bot all of your engagement on posts and followers with the same third world aged accounts connected via web" [X Link](https://x.com/zachxbt/status/2013253497534517506) 2026-01-19T14:13Z 946.7K followers, 131.2K engagements "7/ Greavys (Malone) lives a flashy lifestyle with the stolen funds having purchased 10+ cars and going out to clubs in LA and Miami with friends spending $250K-500K / night and giving out Birkin bags to girls. During video clips and in chats multiple people refer to him as Malone and was flexing stolen funds on Discord. Currently $3.5M tied to Greavys sits here 0x21d7d256be564191a43553e574c06a4d0e629767" [X Link](https://x.com/zachxbt/status/1836753394091929770) 2024-09-19T13:05Z 946.7K followers, 1.1M engagements "1/ Meet Yicong Wang () a Chinese OTC trader who has helped Lazarus Group convert tens of millions of stolen crypto to cash from various hacks via bank transfers since 2022" [X Link](https://x.com/zachxbt/status/1849071080180240751) 2024-10-23T12:51Z 946.7K followers, 1.4M engagements "Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents. Overlap address: 0x33d057af74779925c4b2e720a820387cb89f8f65 Bybit hack txns on Feb [--] 2025: 0xc963e65b9ec39b11076f78990c31f29aaa80705c75312dafd1748479e3e94ed0 0x411374feedcfa560335f00c0fcfa0a3906fdcc33687e6f924dd78ebecc45cd00 Phemex hack txns on Feb [--] 2025: 0x6262a3339842240aeebae4ebfe338dbc771aa0e2df8f5a1ebcd7f9b090bedfe3" [X Link](https://x.com/zachxbt/status/1893211577836302365) 2025-02-22T08:09Z 946.7K followers, 1.6M engagements "Update: Wiz (Veer Chetal) was arrested by US Marshalls and here is his mug shot" [X Link](https://x.com/zachxbt/status/1904581571660706277) 2025-03-25T17:10Z 946.7K followers, 479.6K engagements "On Aug [--] [----] a victim fell for a social engineering scam and lost [---] BTC ($91M) after exchange and hardware wallet customer support were impersonated. The stolen funds began to peel off and deposits to Wasabi were made by the threat actor. Coincidentally this theft happened on the one year anniversary of the $243M Genesis Creditor theft. Theft txn hash da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457 Theft address bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej" [X Link](https://x.com/zachxbt/status/1958583129356345414) 2025-08-21T17:33Z 946.7K followers, 719.4K engagements "Update: OpenVPP appears to be potentially misrepresenting a third partnership with Smartcar When contacted the founder stated: His company is using Smartcar's self-service API offering. (It's something that anyone can access and use on our website.) My company Smartcar and have no further connection or involvement with their cryptocurrency token or related activities" [X Link](https://x.com/zachxbt/status/1969138235139113206) 2025-09-19T20:35Z 946.7K followers, 166.5K engagements "12/ It's extremely rare to see exploits/hacks involve NFT wash trading and I think the relationship between each address is just too coincidental given how they were funded prior to NFT purchases and traded multiple above the floor price for the collection. Hopefully law enforcement eventually moves forward with a criminal case in the future. Another piece of evidence is the overlap in instant exchanges used by the attacker and also tied to the suspects which I did not dive into as much since this post was getting quite long" [X Link](https://x.com/zachxbt/status/1978465874572128486) 2025-10-15T14:19Z 946.7K followers, 107.3K engagements "5/ I contacted the Zashi team and they informed me they plan to solve this privacy issue by adding ephemeral addresses soon and eventually shielded Near Intent refunds. In the meantime I suggest using multiple seeds on separate devices if you use Near Intent integration for Crosspay transfers using your shielded ZEC balance. Overall I still think Zashi is an enjoyable wallet experience for privacy and fixes several UI/UX complaints I had for Monero" [X Link](https://x.com/zachxbt/status/1980612202458390867) 2025-10-21T12:28Z 946.7K followers, 288K engagements "@inversebrah We will collectively block the hundreds of thousands of InfoFi farmers that spam AI slop replies. I support scamming suspending draining or breaching dbs for all of them. Make CT great again" [X Link](https://x.com/zachxbt/status/1999370489580638318) 2025-12-12T06:47Z 946.7K followers, 79.6K engagements "10/ Rumors circulating from cybercrime Telegram channels indicate John could be John Daghitia who was previously arrested in Sep [----]. Though more research is needed to fully confirm" [X Link](https://x.com/zachxbt/status/2014685299025060154) 2026-01-23T13:03Z 946.7K followers, 182.5K engagements "@beausecurity Both perpetrators deserve the electric chair as punishment" [X Link](https://x.com/zachxbt/status/2019824629964239164) 2026-02-06T17:24Z 946.7K followers, 32.3K engagements "1/ I am very happy to share the FBI seized crypto BAYC [----] AP watch and Doodle [----] from the phishing scammer known as Horror (HZ) aka Chase Senecal as a result of my thread" [X Link](https://x.com/zachxbt/status/1621576193152634881) 2023-02-03T18:27Z 946.7K followers, 1.2M engagements "Another day another influencer @DannyCrypt dumping on their followers undisclosed He received 2% of the supply to assist with marketing but within [--] minutes of receiving the tokens market dumped the majority of them for $57k (31 ETH) Meanwhile he tweeted hodling my HODL coin" [X Link](https://x.com/zachxbt/status/1656375551819497478) 2023-05-10T19:08Z 946.7K followers, 2.6M engagements "I was interested to see how much SOL has been sent as a result of the presale meta and calculated [------] SOL ($122.5M) raised from [--] presales" [X Link](https://x.com/zachxbt/status/1769948459266707961) 2024-03-19T04:46Z 946.7K followers, 3.8M engagements "1/ How Lazarus Group laundered $200M from 25+ crypto hacks to fiat from [----] - [----] https://zachxbt.mirror.xyz/B0-UJtxN41cJhpPtKv0v2LZ8u-0PwZ4ecMPEdX4l8vE https://zachxbt.mirror.xyz/B0-UJtxN41cJhpPtKv0v2LZ8u-0PwZ4ecMPEdX4l8vE" [X Link](https://x.com/zachxbt/status/1784935501935390930) 2024-04-29T13:19Z 946.7K followers, 2.9M engagements "One of my best investigations of all time will be posted within the next [--] hrs related to an $100M+ incident" [X Link](https://x.com/zachxbt/status/1836688635753599350) 2024-09-19T08:47Z 946.7K followers, 837.9K engagements "2/ Incident Summary: On August [--] [----] the threat actors targeted a single Genesis creditor by: 1) Calling as Google Support via spoofed number to compromise personal accounts 2) Calling after as Gemini support claiming account is hacked 3) Social engineered victim into resetting 2FA and sending Gemini funds to compromised wallet 4) Got victim to use AnyDesk to share screen and leaked private keys from Bitcoin core. Gemini txn hash [-----] BTC - Aug [--] at 1:48 am UTC e747b963a463334c164b0a8fff844f73693272bb2b331adbe2147d70ec196360 [-----] BTC - Aug [--] at 2:30 am UTC" [X Link](https://x.com/zachxbt/status/1836752940029149269) 2024-09-19T13:03Z 946.7K followers, 1.2M engagements "12/ With the assistance of @CFInvestigators @zeroshadow_io and the Binance Security Team more than $9M+ has been frozen and $500K+ has already been returned back after working closely with the victim to investigate the incident" [X Link](https://x.com/zachxbt/status/1836753455366467803) 2024-09-19T13:05Z 946.7K followers, 536.1K engagements "1/2 I uncovered [--] high confidence wallets tied to @MustStopMurad holding $24M in meme coins on Ethereum and Solana so the community can monitor his future activity" [X Link](https://x.com/zachxbt/status/1843940648430493906) 2024-10-09T09:04Z 946.7K followers, 3.2M engagements "1/ Over the past few months I have been tracking a series of related compromises for McDonalds Usher Kabosu Owner Andy Ayrey Wiz Khalifa SPX [----] etc on X & IG which has resulted in an estimated $3.5M+ stolen via launching Pump Fun meme coins" [X Link](https://x.com/zachxbt/status/1861450263925559399) 2024-11-26T16:41Z 946.7K followers, 2.2M engagements "Pleased to share I'll be working with @MattHuang @Paradigm as an incident response advisor to assist their portfolio companies. It was an easy decision as this gives me the freedom to continue helping the community and publishing investigations like. Ive always respected how Paradigm has given back to the space by funding intiatives such as Security Alliance publishing open source research and helping defend the right to privacy. .@zachxbt is a legend using onchain forensics to keep bad actors accountable. He has returned over $350M to victims of hacks and scams. This is increasingly" [X Link](https://x.com/zachxbt/status/1894772701639721409) 2025-02-26T15:33Z 946.7K followers, 772.5K engagements "CRO is no different from a scam Your team just reissued 70B CRO a week ago that was previously burned forever in [----] (70% total supply) and went against the community wishes as you control majority of the supply. Unsure why Truth would chose a partnership with your exchange over Coinbase Kraken Gemini etc after this move by your team. h/t Unchained Crypto for the data" [X Link](https://x.com/zachxbt/status/1904399783697031305) 2025-03-25T05:07Z 946.7K followers, 527.7K engagements "@jessepollak all of these viral coins yet not even a single $5M+ runner" [X Link](https://x.com/zachxbt/status/1914344980954415343) 2025-04-21T15:46Z 946.7K followers, 161.1K engagements "Update: Today twelve people were charged for the $243M Genesis creditor theft. Aakaash Anand was featured in the clip on 6/ laundering funds for Veer/Wiz" [X Link](https://x.com/zachxbt/status/1923123503823192157) 2025-05-15T21:09Z 946.7K followers, 405.8K engagements "1/ An investigation into how the New York based social engineering scammer Daytwo/PawsOnHips (Christian Nieves) stole $4M+ from Coinbase users by impersonating customer support bought luxury goods and lost most of the funds gambling at casinos" [X Link](https://x.com/zachxbt/status/1937121554124754960) 2025-06-23T12:12Z 946.7K followers, 1.3M engagements "1/ My recent investigation uncovered more than $16.58M in payments since January [--] [----] or $2.76M per month has been sent to North Korean IT workers hired as developers at various projects & companies. To put this in perspective payments range from $3K-8K per month meaning they have infiltrated [---] jobs on the low end or [---] jobs on the high end" [X Link](https://x.com/zachxbt/status/1940388827392344261) 2025-07-02T12:35Z 946.7K followers, 1.2M engagements "So Crypto Rover tagged Grok to select a winner for a giveaway and it began replying about his involvement in pump and dump schemes and sketchy promotions and is refusing to select a winner" [X Link](https://x.com/zachxbt/status/1947138733733462235) 2025-07-21T03:37Z 946.7K followers, 1.4M engagements "1/ An investigation into how @cryptobeastreal scammed followers by lying they were not behind the $190M - $3M $ALT market cap crash where 45+ connected insider wallets sold $11M+ on July [--] 2025" [X Link](https://x.com/zachxbt/status/1947641028720398488) 2025-07-22T12:53Z 946.7K followers, 1.3M engagements "1/2 I am pleased to share that Cameron Redman was convicted today and ordered to pay restitution as a result of my investigation. In June [----] X panel access was sold for [---] ETH which resulted in 10+ account compromises (JRNY Beeple Nouns Zeneca DeeKay etc) and millions stolen via phishing scams. At the time of this post other documents related to the case still remain sealed" [X Link](https://x.com/zachxbt/status/1950273651133034839) 2025-07-29T19:14Z 946.7K followers, 621.6K engagements "NEW LEAK: Price sheet of 200+ crypto influencers and their wallet addresses from a project they were recently contacted by to promote. From 160+ accounts who accepted the deal I only saw [--] accounts actually disclose the promotional posts as an advertisement" [X Link](https://x.com/zachxbt/status/1962485396597776468) 2025-09-01T11:59Z 946.7K followers, 7.8M engagements "This week the project @OpenVPP ($OVPP) claimed to be working with the US government on the tokenization of energy. [--] hrs ago Hester Pierce replied saying she does not work alongside or endorse private crypto projects. OpenVPP then hid her reply from the post. I reviewed the accounts promoting OpenVPP and its the usual influencer suspects. https://twitter.com/i/web/status/1968338476027580483 https://twitter.com/i/web/status/1968338476027580483" [X Link](https://x.com/zachxbt/status/1968338476027580483) 2025-09-17T15:37Z 946.7K followers, 816.9K engagements "11/ Earlier this year a civil lawsuit was filed against multiple suspects based on these findings. An interesting bit taken from the defendants statements is highlighted below where Rusty (Ayden B) admits ownership of several wallets I identified though denies involvement. 0xJones (Jon L) another alleged suspect previously applied for a role at OTF as friends with Rusty and deleted messages from the Bittensor Discord and deactivated his X account after the incident" [X Link](https://x.com/zachxbt/status/1978465858604453944) 2025-10-15T14:19Z 946.7K followers, 117.1K engagements "1/ A video went viral on YT this week after a US based victim lost $3.05M (1.2M XRP) from their Ellipal wallet. Heres the tracing of where the stolen funds ended up and the biggest takeaways for similar thefts" [X Link](https://x.com/zachxbt/status/1979899767212699910) 2025-10-19T13:17Z 946.7K followers, 1M engagements "1/ As part of my work I like to test out privacy products and figure out what works and what doesnt so I can abuse any design flaws for my investigations. With the recent hype around Zashi & its Near Intents integration I tested it for Zcash" [X Link](https://x.com/zachxbt/status/1980612190609576229) 2025-10-21T12:28Z 946.7K followers, 930.3K engagements "6/ I wanted to make this post so more people do not continue the privacy mistake of accidentally revealing their transparent address when bridging with shielded ZEC until a Zashi update is implemented. Should I do more posts like this in the future about how to maintain proper onchain opsec I am considering to offer a service for individual traders or boutique funds looking to anonymize their activity to reduce the chances of being fingerprinted onchain. If you're potentially interested send me a DM to see how we can work together. Do not contact me if you are a threat actor looking to" [X Link](https://x.com/zachxbt/status/1980612205486690606) 2025-10-21T12:28Z 946.7K followers, 239.7K engagements Limited data mode. Full metrics available with subscription: lunarcrush.com/pricing
@zachxbt ZachXBT
ZachXBT, a prominent investigator, has been tracking and exposing various cryptocurrency scams and exploits, including those linked to North Korean IT workers (DPRK ITWs). The investigations have led to multiple arrests, millions of dollars frozen, and the exposure of several scammers, including Crypto Beast, who rebranded as RealCryptoElio. Additionally, ZachXBT's work has highlighted the ongoing issue of DPRK ITWs being hired by companies, often due to a lack of proper due diligence, leading to significant financial losses.
Engagements: [-------] #
- [--] Week [---------] +68%
- [--] Month [----------] +183%
- [--] Months [----------] +24%
- [--] Year [-----------] -44%
Mentions: [---] #
- [--] Week [---] +6%
- [--] Month [---] +24%
- [--] Months [---] +24%
- [--] Year [-----] -27%
Followers: [-------] #
- [--] Week [-------] +0.11%
- [--] Month [-------] +1%
- [--] Months [-------] +6.50%
- [--] Year [-------] +25%
CreatorRank: [------] #
Social Influence
Social category influence cryptocurrencies #6208 finance #5120 exchanges #875 technology brands 7.84% social networks 6.27% stocks 5.49% countries 2.35% currencies 0.78% celebrities 0.78% nfts 0.78%
Social topic influence crypto #809, ai #6080, telegram #74, in the 4.71%, coinbase #195, law enforcement #759, market #347, memecoin #15, posts #993, future 2.75%
Top accounts mentioned or mentioned by @juan_25_q @sexinfochina @jerallaire @kiennguyen @chironchain @yumc14 @antihunter59823 @poketubel @onlyzen @ceazor7 @scam_wipe @chain_traces @polymarket @onchain_vol @wyckoffweb @geoffreywoo @bank_of_eth @drtnky @jamesdpitley @damselincrypto
Top assets mentioned Coinbase Global Inc. (COIN) Ethereum (ETH) Solana (SOL) Bitcoin (BTC) Litecoin (LTC) USDC (USDC) Alphabet Inc Class A (GOOGL)
Top Social Posts
Top posts by engagements in the last [--] hours
"You can read my investigation below 1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support. https://t.co/8kmLR5Y3cv 1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support. https://t.co/8kmLR5Y3cv"
X Link 2025-12-15T12:16Z 946.7K followers, 208.8K engagements
"Update: The CMDSS company X account website & LinkedIn were all just deactivated"
X Link 2026-01-25T15:23Z 946.7K followers, 207.4K engagements
"@AOWISEONE @wyckoffweb I receive 30+ requests per day for help If I spent [--] minutes replying / reviewing to all cases thats nearly [--] hours A single case easily can surpass 25+ hrs"
X Link 2026-02-06T19:52Z 946.7K followers, [----] engagements
"@damselincrypto @Polymarket theres at least some sort of relationship not being disclosed @FFVV1211 @Polymarket Coincidentally it comes only a few days after Logan Paul promoted Polymarket inorganically in a YT video. https://t.co/ayhcBL8HCz @FFVV1211 @Polymarket Coincidentally it comes only a few days after Logan Paul promoted Polymarket inorganically in a YT video. https://t.co/ayhcBL8HCz"
X Link 2026-02-09T13:11Z 946.7K followers, 28.3K engagements
"Sad to see @MEE6NFT soft rug buyers after collecting $3m (965 ETH) less than a year ago with many roadmap items left unfinished or the future unclear. Not to mention negligence by their team with @mee6bot last year lead to [--] figures in losses where victims were not reimbursed"
X Link 2023-02-13T16:53Z 946.7K followers, 300.2K engagements
"Thanks @DwightHoward for the quick rug pull"
X Link 2024-01-30T22:54Z 946.6K followers, 515.5K engagements
"DPRK IT workers are typically easy to spot and are not the smartest individuals. Example: Light Fury (@lee_chienhui) is a DPRK IT worker who transferred $300K+ from his public ENS address to Kim Sang Man who is on the OFAC sanctions list. Fake Name: Gary Lee Alias: Light Fury GitHub: Light-Fury Telegram: leech_dev Number: +1 [---] [---] [----] Alias email: leech.developer@gmail.com Wallet address lightfury.eth 0xe8A06462628b49eb70DBF114EA510EB3BbBDf559 NEW: NORTH KOREAN NATIONALS ARE APPLYING FOR CRYPTO JOBS TO INFILTRATE PROJECTS FOR NEFARIOUS PURPOSES - PER @dlnews https://t.co/gfzEDCJIjp NEW:"
X Link 2024-07-15T14:26Z 946.6K followers, 419.1K engagements
"@bitforexcom 1) What"
X Link 2024-07-19T15:02Z 946.1K followers, 22.3K engagements
"4/ Recently they reached back out after having been approached by Yicong Wang for a larger USDT - CNY order on August [--] [----] involving 1.5M USDT at a rate much lower than the market rate. THjaAygUNkzoXufwEoKCzbUZHpsehL9rAZ"
X Link 2024-10-23T12:51Z 946.7K followers, 83.4K engagements
"5/ When reviewing blockchain data tied to Yicong Wang you will notice high illicit fund exposure from the Alex Labs Irys co-founder and a consolidation of other hacks (EasyFi Bondly Maverick co-founder etc)"
X Link 2024-10-23T12:51Z 946.7K followers, 84.3K engagements
"1/ Time to share how SCALE NTD TPU & OPSEC projects were all tied to the same person Zopp0 to farm naive traders using numerous influencers shown in leaked messages"
X Link 2024-11-03T13:24Z 945.7K followers, 882.9K engagements
"@Unc_MattEth @MoonOverlord Onyx protocol Sonne Finance etc the list of examples is endless"
X Link 2024-11-10T16:03Z 945.7K followers, [----] engagements
"@OpSecCloud From early on there were many red flags if you did basic due diligence so its clear all of the influencers who promoted OPSEC looked past this. Keep the names of influencers from these screenshots in mind and avoid them for the rest of this bull run"
X Link 2024-11-14T10:56Z 946K followers, 123.1K engagements
"Update: Ronald just deleted his Telegram account"
X Link 2024-11-20T14:49Z 946.1K followers, 179.5K engagements
"4/ After the theft in May [----] a threat actor began flexing in Telegram chats with the username tezedasads12 sending [--] DAI as proof of owning an address with $6M from the theft. 0x0138d8c265b0d60907055df25ebfb34a6f805acd3675c45dcd5d96b85376ec2d TG ID: 6710473579"
X Link 2024-12-10T13:58Z 945.7K followers, 437.8K engagements
"1/3 A threat actor has stolen $500K over the past month by compromising 15+ X accounts (Kick Cursor Alex Blania The Arena Brett etc) from sending targeted phishing emails which impersonated the X team to steal credentials and then launch meme coin scams"
X Link 2024-12-24T13:08Z 946K followers, 992.7K engagements
"@DegenPreacher Ok it did not stop you from messaging me before"
X Link 2025-01-21T14:49Z 946.2K followers, 147.2K engagements
"@BarryBaumer @exit_liquid @thomahov Interesting"
X Link 2025-01-27T15:37Z 946.5K followers, 92.2K engagements
"2/ A trader opened multiple highly leveraged positions on Hyperliquid and GMX from Jan - Mar [----]. They gained lots of attention this month after two onchain trades: -Large ETH & BTC long position on 50X leverage just before Trumps crypto reserve announcement by 0xe4d3 ($10M profit) -Large BTC short position on 40X leverage by 0xf3F4 ($9M profit)"
X Link 2025-03-20T13:25Z 946.7K followers, 243.1K engagements
"3/ I went and identified the main counterparties of 0xf3f: 0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21 0x312f8282f68e17e33b8edde9b52909a77c75d950 0xab3067c58811ade7aa17b58808db3b4c2e86f603 0xe4d31c2541a9ce596419879b1a46ffc7cd202c62 This cluster is to tied to Roobet Binance Gamdom ChangeNOW Shuffle Alphapo BC Game & Metawin accounts. https://twitter.com/i/web/status/1902713054908846248 https://twitter.com/i/web/status/1902713054908846248"
X Link 2025-03-20T13:25Z 946.3K followers, 236.2K engagements
"1/ Community Alert: At least one team member from the $30M Zkasino exit scam appears to be involved with the project @WhiteRock_Fi $WHITE due to onchain transactions linking both projects and a personal email address"
X Link 2025-06-16T14:18Z 945.9K followers, 841.6K engagements
"9/ If you use X search you can clearly see its not the first time Crypto Beast has done this as many old followers got rekt on other bundled rugs $ALPHA $RICH $YE $RUG $ACE $JOHN"
X Link 2025-07-22T12:53Z 946K followers, 71.6K engagements
"@web3 Community alert: @web3 is linked to a team member of the Squiggles NFT rug and Raichu who I previously post about 1/ Ever wonder who connected projects with the celebrities and influencers that promote crypto scams Heres a breakdown on one of the people doing it known as Raichu (Ryan). https://t.co/uzrEZ1pAvX 1/ Ever wonder who connected projects with the celebrities and influencers that promote crypto scams Heres a breakdown on one of the people doing it known as Raichu (Ryan). https://t.co/uzrEZ1pAvX"
X Link 2025-08-28T10:34Z 946.3K followers, 161.9K engagements
"@lookonchain @jpthor Also in a recent documentary about the Bybit hack in an interview he defended DPRKs right to hack/exploit teams"
X Link 2025-09-12T09:05Z 946.6K followers, 52.4K engagements
"@elbrys @Cointelegraph @forsetis_anon heres the article for reference https://krebsonsecurity.com/2022/07/breach-exposes-users-of-microleaves-proxy-service/ https://krebsonsecurity.com/2022/07/breach-exposes-users-of-microleaves-proxy-service/"
X Link 2025-10-08T10:06Z 946.7K followers, [----] engagements
"@SpecterAnalyst @Cointelegraph @forsetis_anon Inb4 the Ice team sends their bots to defend them in the replies @ElonMuskAPO @ForeverCurtis_ @IamNomad @ice_blockchain I am sorry but this is an obvious grift to anyone who does basic due diligence. Ultimately this space has people who will fall for a scam regardless and are not worth my time helping. The followers are botted and engagement is not real. https://t.co/LBdnJByaxv @ElonMuskAPO @ForeverCurtis_ @IamNomad @ice_blockchain I am sorry but this is an obvious grift to anyone who does basic due diligence. Ultimately this space has people who"
X Link 2025-10-08T10:07Z 946.7K followers, [----] engagements
"@zoomerfied Isnt Basic Markets TedTalksMacros TraderSkews & CryptoBooles project"
X Link 2025-11-20T15:20Z 946.7K followers, 55.9K engagements
"@karbonbased Funny how under this post theres more slop replies. Inf0Fi projects like Kait0 Y@ps G@lxe L@yer3 Cook1e W@llchain have caused so much harm by incentivizing AI bot networks. We need to be able to hide accounts / posts by country at minimum"
X Link 2025-12-08T08:58Z 946.2K followers, 390.9K engagements
"5/ To further confirm I found the correct BTC address in February [----] Haby began showing off a wallet with $237K in a group chat. The historical BTC balance for bc1qn3k from Feb [--] [----] matched a screenshot shared"
X Link 2025-12-29T14:36Z 945.9K followers, 90.4K engagements
"Congrats you accidentally outed yourself as a candidate for the worst onchain analyst of the year. The threat actor bridged from Bitcoin to Ethereum Litecoin & Ripple via Thorchain. The main entity taking the other-side of Thorchain swaps uses Binance for arbitrage. You can also easily tell these are Thorchain txns from the OP_Return memo in your screenshots. While Arkham is good free analytics tool for retail it does not attribute cross chain swaps or UTXO well. bc1qgkjems88jyk8hasj9ncspxz093nepdn00vaq0y = Thorchain user (threat actor) bc1q30drw0j0erj804lyvl8pxrj789kaplpu2dryx9 = Asgard"
X Link 2026-01-18T16:46Z 946.3K followers, 116K engagements
"Everyone knows his investigations are garbage Yet here you are in my DMs begging for help earlier this month. I have not used Bubblemaps in any of my investigations. I have zero ownership stake in Arkham and never have even have an affiliate link for them. How about actually providing evidence for your claims instead of making up unhinged conspiracies just because I never replied about helping review [----] files for you https://twitter.com/i/web/status/2014989448451354863 https://twitter.com/i/web/status/2014989448451354863"
X Link 2026-01-24T09:11Z 945.9K followers, 24.6K engagements
"@trading_axe John has negative opsec"
X Link 2026-01-25T15:00Z 946K followers, 37.2K engagements
"I would use X Chat more if the current issues are addressed: Search function does not work for legacy DMs after migration to XChat so you have no way to find old messages Still receive message alerts after muting accounts Cannot sort chats via folders or filter Cannot search or filter message requests No way to quickly scroll to messages from a specific time period Time period displays as weeks vs date https://twitter.com/i/web/status/2016154586193506472 https://twitter.com/i/web/status/2016154586193506472"
X Link 2026-01-27T14:21Z 945.6K followers, 53K engagements
"@2times_eth If its the Netflix documentary I am thinking about I declined to interview with them due to the trailer (glamorizing threat actors + interviewing d-tier celebs wit no connection to the story)"
X Link 2026-01-29T07:56Z 946.2K followers, 60.1K engagements
"A small portion has been returned by exchanges. The larger portion of funds is sitting in government seizure addresses until conclusion of the legal case ($100M+). Hopeful the victim will reward me fairly for my contribution after the larger portion is returned. (I was paid a smaller sum for my initial hours spent) https://twitter.com/i/web/status/2016806550204272781 https://twitter.com/i/web/status/2016806550204272781"
X Link 2026-01-29T09:32Z 946K followers, [----] engagements
"Please support the movement brother. Just claim the fees its a risk free donation thats all we ask. Why have you not publicly thanked us for using your likeness We promise to stop harassing you on every post if you show your support. Now the token price is down because of you and all investors have lost money"
X Link 2026-01-31T14:26Z 946K followers, 77.1K engagements
"@jasonkwon MaKeS yOu WoNdEr WhAt He Is HiDiNg"
X Link 2026-02-04T00:16Z 946.7K followers, 70.1K engagements
"@TGKContent @sama Open AI is the Epstein of AI companies if you think theyll act with integrity and safely handle user personal data vs max extract No Diddy"
X Link 2026-02-04T21:13Z 946.7K followers, [----] engagements
"Teams got by before due to number go up so currently all of the bs projects get rekt deservedly. The real issue is maybe 5-10 accounts max on CT publish quality content and none of them actively solicit marketing deals. Still hitting ATH reach on investigations regardless of current market conditions. https://twitter.com/i/web/status/2019216734473916911 https://twitter.com/i/web/status/2019216734473916911"
X Link 2026-02-05T01:09Z 946.5K followers, 27.4K engagements
"@crunch1271 @jerallaire deploying a honeypot"
X Link 2026-02-05T01:47Z 946.5K followers, 10.3K engagements
"@0xTakeProfits @jerallaire gramps first time using AI"
X Link 2026-02-05T01:47Z 946.6K followers, [----] engagements
"@SommerChase @jerallaire AI vibecoded slop does not equal quality"
X Link 2026-02-05T01:51Z 946.5K followers, 18.8K engagements
"@0xRiver8 @jerallaire Bc Circle is criminal"
X Link 2026-02-05T01:52Z 946K followers, 10K engagements
"@Surf_Liquid @jerallaire Blocked for AI slop"
X Link 2026-02-05T02:30Z 946.5K followers, [----] engagements
"@lopp Arbitrage countries with lenient laws for violent crime + low law enforcement cooperation when it involves multiple jurisdictions"
X Link 2026-02-06T14:52Z 945.7K followers, [----] engagements
"@Damos20820110 @TedPillows Web [--] prostitute"
X Link 2026-02-12T14:22Z 946.7K followers, [----] engagements
"1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple arrests and millions frozen"
X Link 2024-09-19T13:03Z 946.7K followers, 13.3M engagements
"Heres a long list of [--] NFT projects I did investigations on: Animoon - $6.3M Winter Bears - $3.4M [---] projects - $13M Rogue Society - $5.5M Rich Dwarves Tribe - $3.04M Boneheads - $3.1M Real Floyd NFT - $5M Croatia NFT scam group - $2.8M Rich Bulls Clubs - $3.4M MEE6 - $3M Eternal Beings - $4M Ether Monkeys - $2.8M Swipa The Fox - $1.75M Tribes of Ogun - $700K Billionaire Dogs Club - $960K Crazy Camels - $1.6M Rich Kids - $2M Fashion Ape - $1.1M Trollz- $4M Various NFT projects - $3.7M Players Only - $1.4M Vault of gems - $1M 0xCryatals - $1M Miss Universe - $370K Apes In Space - $10.8M"
X Link 2024-10-12T20:17Z 946.7K followers, 63K engagements
"1/ An investigation into the social engineering scammer Ronaldd (Ronald Spektor) who allegedly helped steal $6.5M last month from a single victim by impersonating Coinbase support"
X Link 2024-11-20T13:51Z 946.7K followers, 1.8M engagements
"1/ An investigation into the alleged identity of the mysterious Hyperliquid whale tied to illicit activity that profited $20M via highly leveraged positions over the past couple weeks"
X Link 2025-03-20T13:25Z 946.7K followers, 2.6M engagements
"9/ Another 4.17K ETH ($12.4M) was received from MEXC earlier today flowing to 0xd8bc 0xe0f7a45a491d53f9361d35b4ef9908986d3b37b7 John has an extensive message history on Telegram flaunting his networth and calling others broke. TG ID: 8269661864"
X Link 2026-01-23T13:03Z 946.7K followers, 97.4K engagements
"History has shown that Circle is a bad actor. SwapNet contracts were exploited for $13M USDC on Base [--] hours ago. 3M USDC is still sitting freezable at 0x6cAad74121bF602e71386505A4687f310e0D833e Why should anyone continue building on $USDC when you never take care of your users as a centralized stablecoin issuer https://twitter.com/i/web/status/2015659175892885541 https://twitter.com/i/web/status/2015659175892885541"
X Link 2026-01-26T05:32Z 946.7K followers, 22.2K engagements
"@sethsetse until you have the realization that real humans from third world countries flood social media with the same AI slop as bots due to engagement groups ad revenue or other incentives"
X Link 2026-02-13T08:44Z 946.7K followers, 50.5K engagements
"@mierea @wyckoffweb You messaged about a case from [--] years ago perhaps its time to move on"
X Link 2026-02-06T21:40Z 946.7K followers, [----] engagements
"@sexinfochina @THORSwap @avax @SwapKitPowered @NEARProtocol @near_intents @AlexAuroraDev Yet I just showed screenshots of how the FreeCity market owner Telegram account was complaining in the Near Intents TG channel about the exact same transactions you shared As more proof heres an old DM before your last X account was banned"
X Link 2026-02-14T03:03Z 946.7K followers, [----] engagements
"Logan Paul thread coming Friday"
X Link 2022-05-12T00:18Z 946.7K followers, [----] engagements
"1/ Lets breakdown the $6.3m NFT rug Animoon a project that has constantly screwed over its holders since day 1"
X Link 2022-06-02T15:56Z 946.7K followers, [----] engagements
"damn dillon danis is a scumbag feel bad for everyone he scammed"
X Link 2022-12-24T16:11Z 946.7K followers, 1.9M engagements
"1/2 North Koreas Lazarus Group had a very busy weekend moving $63.5m (41000 ETH) from the Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges"
X Link 2023-01-15T23:49Z 946.7K followers, 2.1M engagements
"6/ EX 3: For this one Raichu worked with rapper Rich The Kid for the project Ancient Cats Club. The team quickly rugged shortly after launch stealing over $1.7m. The team of this project eventually launched other NFT scams like Bored Bunny and Rich Dwarves Tribe. 2/ On 4/21 the proceeds were transferred away to 0x53 and 0x7c. Well 0x53 sends them to 0x1c which has received money from -Ancient Cats Club ($1.7m rug) -Rich Dwarves Tribe ($3.2m rug) -Bored Bunny ($21m slow rug) https://t.co/MhJ56Tgh24 2/ On 4/21 the proceeds were transferred away to 0x53 and 0x7c. Well 0x53 sends them to 0x1c"
X Link 2023-04-05T13:06Z 946.7K followers, 87.5K engagements
"7/ EX 4: Raichu worked with The Game and Dillon Danis to promote Baby Dinger token another scam"
X Link 2023-04-05T13:06Z 946.7K followers, 45.8K engagements
"Over the past [---] months one person has created [---] meme coin scams. Each time stolen funds from the scam are sent to the exact same deposit address. 0x739c58807B99Cb274f6FD96B10194202b8EEfB47"
X Link 2023-04-26T14:56Z 946.7K followers, 1.9M engagements
"Update: Atomic Wallet Hack appears to potentially have been done by Lazarus Group/DPRK (seeing lots of similarities in the laundering patterns to Ronin + Harmony)"
X Link 2023-06-06T16:12Z 946.7K followers, 144K engagements
"1/ Its unfortunate I have to make this thread but I am being sued by MachiBigBrother for an article I published in June [----]. Today Machi filed the defamation lawsuit. The lawsuit is baseless and an attempt to chill free speech. I intend to fight back & defend free speech"
X Link 2023-06-16T19:07Z 946.7K followers, 8.7M engagements
"The same scammer profited $385K (234 ETH) in the past [--] hours off SIM swapping four different FriendTech users"
X Link 2023-10-04T22:29Z 946.7K followers, 125.6M engagements
"Not that people in this space will care but @GROKERC20 $GROK was created by a scammer. Same exact X/Twitter account has been reused for at least one other scam. X/Twitter ID: 1690060301465714692"
X Link 2023-11-13T15:59Z 946.7K followers, 2.1M engagements
"1/ Throughout this year I have been monitoring someone who has withdrawn 11200+ ETH ($25M) from Tornado Cash and spent the majority of it on Magic The Gathering (MTG) trading cards. Heres my analysis of where the funds went and what the potential source of funds could be"
X Link 2023-12-07T15:53Z 946.7K followers, 3.3M engagements
"Remember when influencers with a lot of followers start shilling a project launch at the same time it is likely bc they have allocation and will dump their cheap tokens on you"
X Link 2024-01-19T14:40Z 946.7K followers, 2M engagements
"Remember when KSI posted All of a sudden my $XCAD bag is looking juicy again. #HodlGang Then proceeded to dump $850000 worth of XCAD over the following days from his wallet address. Does this still work Does this still work"
X Link 2024-02-13T23:57Z 946.7K followers, 2.5M engagements
"Thanks for playing"
X Link 2024-02-14T09:55Z 946.7K followers, 669.5K engagements
"In May [----] the rank [--] DeGods NFT was stolen from a victim after visiting a phishing site and sold for $177K (99 ETH). I am pleased to share I was able to help recover a decent chunk of the stolen funds which have now been returned back to the victim. While recovery can be a lengthy process it does happen and I am always happy to share these success stories. https://twitter.com/i/web/status/1761346473340657773 https://twitter.com/i/web/status/1761346473340657773"
X Link 2024-02-24T11:04Z 946.7K followers, 598.2K engagements
"I am pleased to share @pokerbrat2019 aka Robert Robb was arrested earlier today in Las Vegas according to Henderson Police records. In December [----] I made a post detailing how he stole $1.2M+ from [--] individuals and exposed his prior criminal history of fraud. Since then I have been working with victims to get them justice. While we cannot know for sure until court documents are released I doubt there would be any other reason for the arrest"
X Link 2024-03-21T05:19Z 946.7K followers, 873.7K engagements
"1/ An investigation into the French dev Jolan Lacroix who recently stole $900K from the TICKER presale on Base before spending the funds on meme coins and Milady NFTs"
X Link 2024-03-21T14:34Z 946.7K followers, 1.4M engagements
"30.1K BTC ($2.1B) of Silk Road hack funds controlled by US government is on the move right now. [-----] BTC ($69) transferred to a Coinbase deposit address so its a test transfer possibly. txn hash 9c3af4b48e66565f1da1da8278036fa1dbb09f2beaaca99c3504475390ba4590 Coinbase deposit address 3KrZVU9Jz4UKHpKUtuvkEMX1tY8zeiTvX2"
X Link 2024-04-02T16:06Z 946.7K followers, 2.5M engagements
"I have been borderline harassed by @IRS_CI agents on 4-5 occasions now in the past few months with a blatant disregard for any professionalism so I have decided to now share this publicly. They have shown up irl to old addresses contacted personal emails using private data and have sent mail when I have public contact methods readily available. I have always been willing to support victims of scams with documentation needed by law enforcement to aid cases but if you overstep personal boundaries why would I want to assist you"
X Link 2024-04-05T16:14Z 946.7K followers, 1.1M engagements
"Wtf two of my posts were cited in a recent United Nations report"
X Link 2024-04-08T13:19Z 946.7K followers, 568K engagements
"Unfollow and block all of the influencers who were shilling you any of these vaporware projects to you as the next bluechip (@CryptoGodJohn @TheCryptoKazi @crypto_TomTom @cryptostasher etc) $scale - ScaliaInfra (-95.3% 24hrs) $tpu - TensorSpace_Ai (-96.3% [--] hrs) $ntd - NTensorDynamics (-97.4% 24hrs) $zkml - ZKMLsystems (-70.6% 24hrs) The same influencers will continue shilling garbage to you throughout the cycle"
X Link 2024-04-13T20:09Z 946.7K followers, 1.5M engagements
"Community Alert: The group of scammers who stole [--] figs with Magnate Kokomo Lendora Solfire etc is back with a new project on Blast @Leaperfinance Last week they funded an address on Blast with $1M of laundered funds from the previous rugs and have begun adding liquidity to bait people in. Tracing: 1). [--] week ago 0x46a moves ETH a few hops from Magnate scam to 0x10e 0x46a10e7444bf78736E6a24b1De8dc8A20E4B3ED7 0x10ef5bb874b226bdd6860f00d5e5a2aa3e955b9a 2). Bridges to 0xAc9 on Polygon 0xAc973E1Be91fe8674dff2E0de4A9375803Ae4435 3). 0xAc9 transfers wETH to 0x08"
X Link 2024-04-14T02:17Z 946.7K followers, 966K engagements
"Only [--] month has passed and [--] of the Solana presale meme coins have been completely abandoned after raising [------] SOL ($26.7M). Would avoid any future projects launched by these founders. I was interested to see how much SOL has been sent as a result of the presale meta and calculated [------] SOL ($122.5M) raised from [--] presales. https://t.co/dvsW4TSoov I was interested to see how much SOL has been sent as a result of the presale meta and calculated [------] SOL ($122.5M) raised from [--] presales. https://t.co/dvsW4TSoov"
X Link 2024-04-21T19:31Z 946.7K followers, 1.3M engagements
"Putting final touches this week on an investigation I have been working on for 15+ months. By far my biggest project to date and I look forward to sharing it soon. Expect no other new posts in the meantime"
X Link 2024-04-22T13:59Z 946.7K followers, 1.3M engagements
"Proud to share that earlier this year I helped lead an initiative which resulted in the successful seizure of $12M connected to the Caesars ransomware incident from September [----]. This was done in collaboration with @cryptoesq and law enforcement"
X Link 2024-05-02T17:38Z 946.7K followers, 531.5K engagements
"coming from the clown who runs a call channel to do undisclosed shills and pump and dump meme coins on followers. influencers like you who contribute absolutely nothing and only extract are why this space sucks. guess the $800K+ profited from the bundle does not matter or that the founder is sketchy"
X Link 2024-05-25T01:32Z 946.7K followers, 20.8M engagements
"For those who are confused and need additional context. Earlier today Arkham announced a $150K bounty for the identity of the DJT creator 11:49 pm UTC I reply to Arkham saying I submitted for the bounty 11:57 pm UTC Martin Shkreli panic DMs me 12:27 am UTC Martin Shkreli creates a spaces and announces he is the creator of DJT"
X Link 2024-06-19T01:38Z 946.7K followers, 2.4M engagements
"@10Ronaldinho Is this a translation for you are bankrupt again In case you forgot here are all of the crypto projects you pump and dumped over the years"
X Link 2024-06-24T03:14Z 946.7K followers, 192.4K engagements
"1/ So I began tracing the $230M+ WazirX hack back from the original exploiter address and was able to make some interesting observations. 📢 Update: We're aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident. To ensure the safety of your assets INR and crypto withdrawals will be temporarily paused. Thank you for your patience and understanding. 📢 Update: We're aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident. To ensure the safety of your assets INR and"
X Link 2024-07-18T11:19Z 946.7K followers, 1.4M engagements
"1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed. Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities. I then uncovered 25+ crypto projects with related devs that have been active since June 2024"
X Link 2024-08-15T11:36Z 946.7K followers, 2.7M engagements
"Jason Derulo has not posted about his JASON token on X/Twitter since July. Wonder what happened to: I am committed to this space long term. I want to see everyone win in our community and I want to grow not just our family but all of crypto Yesterday Jason promoted another Tron meme coin and deleted shortly after. Shame on all of the influencers who promoted him and thought this time would be different from the 15+ scams he has promoted in the past"
X Link 2024-09-04T17:05Z 946.7K followers, 933.7K engagements
"1/ The UK scammer @ape_31 @60711 has stolen more than $650K from 250+ X users in the past year by posting fake PNL screenshots from a Bybit demo account and running a news account to funnel unsuspecting victims into paid services before blocking them upon receiving payment"
X Link 2024-09-30T13:44Z 946.7K followers, 1.9M engagements
"In April [----] an elderly victim from the US was targeted by Indian call scammers posing as Coinbase support resulting in a large portion of their life savings stolen. Pleased to share that I helped recover $275K which was recently seized and will be sent back to them. Theft txn hash 30125031d32a3a2ec9a6963d218bf2494d4392d9444586061a97d84511479346 During my research I found $5M+ stolen from other victims of this group which were laundered from Ethereum/Bitcoin to Tron via centralized exchanges before stablecoins were transferred to OTCs"
X Link 2024-10-07T12:08Z 946.7K followers, 637.9K engagements
"1/ A short story about how the influencer @edgeville got caught lying to the community three times this weekend about an allocation for a project all for $2.2K"
X Link 2024-10-20T15:47Z 946.7K followers, 1.1M engagements
"7/ Alex Labs was hacked for $4.5M in May [----] by Lazarus Group. One of the theft addresses deposited [---] ETH to a privacy protocol on June [--] [----] 0xc0a0ec4dbf170611cc76f31a9df910ad79bc2266 Matching amounts were withdrawn the same day to two addresses 0x9fc1350f80734044b7189fe7b8f288396f76feb5 0x21c926a1a328a4906feeb18664d00f3d85df1aed Another theft address deposited [---] ETH from June 27-28th 0x1871bb6257b1f622548ef64a12ae5149eb208bd8 Shortly after a matching amount was withdrawn commingling with the Irys co-founder stolen funds. 0xddb2e9feaf0a122b43be14bc085cf713703ce45c On August 13th funds"
X Link 2024-10-23T12:51Z 946.7K followers, 103.7K engagements
"@FatManTerra Finally they got that OTC scammer He stole $7.1M (14.6K TAO) from a TAO whale in February [----] Also scammed ZYN MOG Kondux Ordiswap Landwolf and Hash AI whales for another $8M+ all this year. Looks like someone got scammed a few hours ago for 45M $OX ($600k). Previously it looks like this person had bought $4.4M of $OX from Sifu. Basically this person got scammed for tokens purchased from scammer of project created by scammer. https://t.co/QxcLm1vofF Looks like someone got scammed a few hours ago for 45M $OX ($600k). Previously it looks like this person had bought $4.4M of $OX"
X Link 2024-12-03T17:57Z 946.7K followers, 75.6K engagements
"@EdgeWallet Thanks for not crediting the original source. 1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple arrests and millions frozen. https://t.co/dcY1e9xsPd 1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple"
X Link 2024-12-24T04:32Z 946.7K followers, 283.2K engagements
"@realDonaldTrump"
X Link 2025-01-18T03:36Z 946.7K followers, 1.5M engagements
"11/ I do not blame all Coinbase employees as most of the fault lies on leadership for these decisions. While this post is critical of Coinbase what have they done well providing good stablecoin on-ramp / off-ramp for retail attracting talent to build on Base recovery tool for users who deposit unsupported assets fighting the SEC Coinbase custody product allowing users to passively earn yield on stables easily (Also theres only so much you can do to educate people about threats such as email/call spoofing)"
X Link 2025-02-03T13:50Z 946.7K followers, 101.9K engagements
"@arkham @benbybit @Bybit_Official My submission has been sent identifying the organization behind the attack using on-chain data"
X Link 2025-02-21T19:30Z 946.7K followers, 428.6K engagements
"@arkham TLDR myself and Josh from CF connected the Bybit hack on-chain to the Phemex hack"
X Link 2025-02-21T20:27Z 946.7K followers, 540.3K engagements
"I am not interested in Pulsechain investigations as that community did not prioritize building decent analytics tools or paying for integrations. Its difficult to analyze a chain without a Etherscan block explorer product on EVM chains Without Chainalysis or TRM integrations complex investigations take 10X as much work Without integrations for Arkham/Nansen / etc theres few options for retail to read/interpret activity"
X Link 2025-03-22T14:06Z 946.7K followers, 26.1K engagements
"@TheNotoriousMMA @getrealtoken"
X Link 2025-04-05T16:27Z 946.7K followers, 173.8K engagements
"Your team stole $30M of investor funds from Zkasino and you were arrested. After those millions were gambled away via Hyperliquid/GMX leveraged positions and laundered the via instant exchanges and crypto to cash OTCs over the past few months. Elham Nourzai if there was a tier list for CT scammers you would be at the top"
X Link 2025-04-07T07:58Z 946.7K followers, 230.5K engagements
"@satoshivm From SAVM shilled by many influencers last year at TGE to one year later no social media activity on X/TG no Github activity in months and token down 99%. Who could have possibly seen this coming"
X Link 2025-04-19T10:06Z 946.7K followers, 63.6K engagements
"Nine hours ago a suspicious transfer was made from a potential victim for [----] BTC ($330.7M) Theft address bc1qcrypchnrdx87jnal5e5m849fw460t4gk7vz55g Shortly after the funds began to be laundered via 6+ instant exchanges and was swapped for XMR causing the XMR price to spike 50%"
X Link 2025-04-28T07:30Z 946.7K followers, 3.5M engagements
"@elonmusk Please update DMs & XChat by adding a filter to choose who can add you to group chats. Currently any user can add you to a group unless you turn off your messages entirely"
X Link 2025-06-16T05:17Z 946.7K followers, 880K engagements
"6/ An unnamed source provided a personal email of an account that interacted multiple time with the WhiteRock deployer address. I noticed the email has an account on Chess(.)com with the username IldarTheGrandMaster. Prometheus from Zkasino = Ildar Whiterock alias = Goedel goedel014@gmail(.)com"
X Link 2025-06-16T14:18Z 946.7K followers, 100.1K engagements
"The crime supercycle is indeed very real. While its true the industry has historically been ripe for abuse it has noticeably increased since politicians launched meme coins and numerous court cases were dropped further enabling the behavior. Laundering groups and small OTC brokers have seemingly won the battle for Lazarus Group after successfully laundering recent hacks (Bybit DMM Bitcoin WazirX etc) with ease. I estimate the Black U market on Tron is no less than $5-10B and largely unattributed. A number of teams sit and watch collecting fees doing nothing when 50% of the activity for their"
X Link 2025-06-18T03:31Z 946.7K followers, 683K engagements
"Since July [--] [----] an address linked to Ripple co-founder Chris Larsen transferred out 50M XRP ($175M) to four addresses. $140M ended up at exchanges/services 30M XRP recipient rPS9kVPbgZF4vXq2hs6s9Xv2754qdRau98 rnQXgGAjqbF4KoBpcBK5YBHyZEL7nGWWoi 10M XRP recipient rHtLaipqqfbhgMSHkF1YcuWaivvgRH851o $35M received to two new addresses 5M XRP recipient rNLrQvgfLZNLqcqjAAQYBUNBSC5dVkiDXw 5M XRP recipient rhmkfhYZY3XJgGTcGxLAKuEoph49bmMqbb"
X Link 2025-07-24T07:01Z 946.7K followers, 464.1K engagements
"@memenetic POV your new meme coin grift is destined for failure due to influencer bukkake 150+ promotional posts from d-tier influencers millions of botted followers and likes only [--] SOL raised for the presale few disclosures for the posts"
X Link 2025-08-23T12:52Z 946.7K followers, 123.9K engagements
"@ICEBOYBILL @OpenVPP Same influencers who were pushing the depin / ai / gpu tax farms earlier this cycle"
X Link 2025-09-17T15:42Z 946.7K followers, 12.3K engagements
"@Cointelegraph @forsetis_anon Does the Countelegraph team vet sponsors An old Brian Krebs investigation named the Ice Blockchain / Online CEO Alexandru Florea (Zeus) as a cybercrinimal that was the admin of Microleaves a service that was alleged malware/botnet and linked to the [----] ICO rug OIO"
X Link 2025-10-08T09:56Z 946.7K followers, 33.9K engagements
"@stablealt @HyperliquidX HypurrScan team deserves hundreds of lashes for fumbling their early mover advantage and overlooking basic features EX: The Unit protocol address is not even publicly tagged when they are one of the largest HL protocols"
X Link 2025-10-15T08:16Z 946.7K followers, 20.1K engagements
"i did not call Vultisig a scam i called out the founder for his history of negligence and lack of morals: ThorFi [--] fig rug via admin key Explicit refusal to return any fees generated on his products from illicit activity (Thorchain Vultisig etc) Associated projects hired DPRK IT workers Personal wallets hacked by DPRK malware after a meeting call scam via Telegram if theres ever any future incidents that are material enough you can be certain he will avoid taking full responsibility https://twitter.com/i/web/status/1982068479466652029 https://twitter.com/i/web/status/1982068479466652029"
X Link 2025-10-25T12:55Z 946.7K followers, 41.8K engagements
"@patriotsounds @TegiXBT The victims were not provided full compensation by TCY and admin mimir was done unilaterally. A class action lawsuit was even organized by multiple victims as a result of the negligence"
X Link 2025-10-25T13:38Z 946.7K followers, [----] engagements
"@hammerfrog64 rip"
X Link 2025-10-28T17:29Z 946.7K followers, 26.3K engagements
"@BNBCHAIN Thanks I look forward to publishing my upcoming investigation into an exploit"
X Link 2025-11-05T12:01Z 946.7K followers, 38.9K engagements
"@crunch1271 will be donating $5K to a Chile Wildfire charity once @CarlotaFang77 is online (40 SOL received from fees) Hola. I don't like making this kind of post because it can sometimes lead to misinterpretations but I feel its my moral duty and responsibility to do so. Most crypto outlets in the region dont seem to give a fuck about tragedies/charity like this on a regular basis. Besides my https://t.co/LHEgiiWMTP Hola. I don't like making this kind of post because it can sometimes lead to misinterpretations but I feel its my moral duty and responsibility to do so. Most crypto outlets in"
X Link 2026-01-20T12:18Z 946.7K followers, 44.6K engagements
"Let me rephrase: Ledger a French security company has been breached multiple times which resulted in its customers private data being leaked has lead to targeted thefts and millions stolen. Current products have major issue like the battery for the Ledger Nano X. Now Ledger plans to max extract more via US IPO after recently announcing they will also charge a % for clear signing. https://twitter.com/i/web/status/2014619383294001655 https://twitter.com/i/web/status/2014619383294001655"
X Link 2026-01-23T08:41Z 946.7K followers, 123K engagements
"@Ledger [----] starter pack"
X Link 2026-01-23T08:52Z 946.7K followers, 168.1K engagements
"@follis_ Just another day in crypto"
X Link 2026-01-26T06:36Z 946.7K followers, 55.8K engagements
"@yieldhunter95 They first targeted him from the Ledger data breach"
X Link 2026-02-05T19:50Z 946.7K followers, 17.9K engagements
"@heiskaws @tayvano_ Sorry I am not assisting with a $10 theft"
X Link 2026-02-06T16:39Z 946.7K followers, 17.2K engagements
"@0xRustyy @wyckoffweb It is tiring when people always act entitled to your time and then proceed to get upset at you publicly"
X Link 2026-02-06T19:48Z 946.7K followers, [----] engagements
"5/ Wiz (Veer) received a large % cut from theft and slipped up during screenshare by leaking his full name during the theft. Additional comfort was gained as throughout multiple recordings accomplices referred to him as Veer on audio and in chats. $34.5M of his funds sit here 0x3c7a5f2795e73d2b94a9120a643f608cfc45c935"
X Link 2024-09-19T13:04Z 946.7K followers, 903.8K engagements
"1/ An investigation into Faris Ali (Zay/Tommy) from the UK and his alleged involvement in robbing an X user out of $4.3M in June [----] during a home invasion as the result of a crypto data breach. https://www.blogdelnarco.org/2024/12/ejecutan-en-su-mercedes-benz-y-al-salir.html https://www.blogdelnarco.org/2024/12/ejecutan-en-su-mercedes-benz-y-al-salir.html"
X Link 2024-10-10T13:30Z 946.7K followers, 2M engagements
"Update: OpenVPP appears to potentially be misrepresenting another partnership with Commonwealth Edison (ComEd). When contacted the company stated: We did not partner with them and are not interested"
X Link 2025-09-18T15:49Z 946.7K followers, 314.4K engagements
"9/ Unfortunately the likelihood of this victim seeing any funds recovered is rather low due to a delay in reporting the theft to competent people within the private sector. I recommend victims try to report theft addresses to people as soon as possible as otherwise it can be difficult to detect that a theft even took place. Ripple does not have as good of a support system for victims within their community as there is in Bitcoin Ethereum Solana and major EVM chains. I always try to reply to people who contact me about verified recent thefts $250K to at least instruct them to report and flag"
X Link 2025-10-19T13:17Z 946.7K followers, 333.1K engagements
"Update: USG made a press release today formally announcing Ronald has been charged"
X Link 2025-12-19T20:35Z 946.7K followers, 83.6K engagements
"@TroveMarkets For Trove victims heres who was introducing themselves as its founder unwisecap during a side event at Token2049 in Oct 2025"
X Link 2026-01-20T06:07Z 946.7K followers, 1.1M engagements
"Update: John dusted my public address zachxbt.eth from one of the theft addresses. Transaction hash 0x25d3b02b17ccf5f0867bfbaa86c4cb918766d2b79e30cdcb7847298febfa2d15"
X Link 2026-01-23T18:59Z 946.7K followers, 155.3K engagements
"Update: Update: John (Lick) sent me [------] ETH ($1.9K) of the stolen government funds from 0xd8bc to my public wallet address. Transaction hash 0x90539e91fbebd0aaa050a492548b1e3b1bc7d82dd84bf8a42a9595a90425ebfa (Any stolen funds received will be sent to a USG seizure address) 4/ In part [--] of the recording Dritan continues to mock John while another $6.7M worth of ETH is moved into the wallet address below: 0xd8bc7ea538c2e9f178a18cc148892ae914a55d08 https://t.co/CZ5VcQHumP 4/ In part [--] of the recording Dritan continues to mock John while another $6.7M worth of ETH is moved into the wallet"
X Link 2026-01-26T12:57Z 946.7K followers, 278.1K engagements
"@sama Scam Altman"
X Link 2026-02-04T20:31Z 946.7K followers, 102.3K engagements
"@sirshibaninja @phantom Blocked for AI slop"
X Link 2026-02-10T01:24Z 946.7K followers, 10.7K engagements
"@MeanHash Sorry not spending time on work without basic details like a ransom payment address at a minimum. Also I only help people native or adjacent to our industry and not others as they generally do not offer fair comp or respect anonymity"
X Link 2026-02-11T10:47Z 946.7K followers, [----] engagements
"@zoomerfied Heres the Figure co-founder last month"
X Link 2026-02-14T03:24Z 946.7K followers, 13.5K engagements
"11/ While most of the funds were converted to XMR both Box and Wiz accidentally linked the laundered funds with the dirty funds on multiple instances. a) Wiz during screenshare showed an address he sent funds to for designer clothes which had millions in exposure to the cluster above. 0xb98b8ac004cea6617adcf3e94106d0eec1792bd9 b) Box linked the dirty funds with the cleans funds by accidentally reusing a deposit address. 0x6d865235ebb2504d3478fc1dd839100d210144df"
X Link 2024-09-19T13:05Z 946.7K followers, 640.3K engagements
"13/ As a result of the investigation Box and Greavys were arrested yesterday evening in Miami and LA. I would expect law enforcement seized additional funds during the arrests due to large transfers around that period of time"
X Link 2024-09-19T13:05Z 946.7K followers, 616.7K engagements
"@BitoEx_Official Do you want to explain to the community why multiple of your hot wallets saw suspicious outflows of $11.5M on May [--] [----] where you still have not disclosed the security incident on X or Telegram several weeks later"
X Link 2025-06-02T05:57Z 946.7K followers, 76.7K engagements
"@NewsyJohnson pov"
X Link 2025-06-07T05:06Z 946.7K followers, 80K engagements
"@MEXC_Official @Gate_io Update: Ildar Ilham aka @XBT_Prometheus (founder of @WhiteRock_Fi) was arrested by UAE law enforcement for his involvement in the $30M Zkasino exit scam. He will be extradited to the Netherlands next for the criminal case"
X Link 2025-07-03T13:38Z 946.7K followers, 372.5K engagements
"The affidavit confirmed all of the victims from my investigation Victim [--] = Beeple Victim [--] = DeeKay Victim [--] = Zeneca Victim [--] = Nouns DAO Victim [--] = JRNY Club 7/ The hacked Twitter accounts lead to millions of dollars worth of crypto stolen in total. This table shows a rough estimate for the amount of crypto stolen with each account in the Tweet above. https://t.co/DEzL3tmnmk 7/ The hacked Twitter accounts lead to millions of dollars worth of crypto stolen in total. This table shows a rough estimate for the amount of crypto stolen with each account in the Tweet above. https://t.co/DEzL3tmnmk"
X Link 2025-07-30T11:57Z 946.7K followers, 164.3K engagements
"10/ Still one of the more common questions is how do you know they are North Korean Well besides all of the fraudulent documents detailed above their search history showed frequent Google Translate usage with translations to Korean with a Russian IP"
X Link 2025-08-13T12:55Z 946.7K followers, 217.2K engagements
"@inversebrah These botted milady meme coin KOL scammer accounts that keep appearing out of nowhere are so annoying"
X Link 2025-09-07T10:18Z 946.7K followers, 42K engagements
"Whats most interesting is wallet addresses listed in the US government $14B (127K BTC) seizure previously were named in a Milky Sad report [--] years ago for having vulnerable private keys and now the USG says they have custody of them. ZOOMER U.S. SEEKS FORFEITURE OF [------] BTC ($12B) TIED TO TRANSNATIONAL PIG BUTCHERING SCAM RUN BY CHINESE NATIONAL CHEN ZHI ZOOMER U.S. SEEKS FORFEITURE OF [------] BTC ($12B) TIED TO TRANSNATIONAL PIG BUTCHERING SCAM RUN BY CHINESE NATIONAL CHEN ZHI"
X Link 2025-10-14T15:45Z 946.7K followers, 653K engagements
"1/ An investigation into how I identified one of suspects tied to the $28M Bittensor hack from [----] by identifying anime NFT wash trades linked to a former employee and earned a whitehat bounty for my efforts"
X Link 2025-10-15T14:19Z 946.7K followers, 471.5K engagements
"@cecilia_hsueh @TheWhiteWhaleV2 @MEXC_Official Vendor: How many bots do you want MEXC exec: All of them"
X Link 2025-10-30T15:36Z 946.7K followers, 259.2K engagements
"Update: A superseding indictment from a few hours ago confirmed my analysis that Danny / Danish Zulfiqar (Khan) was arrested in Dubai. Seizure address 0xb37d617716e46511E56FE07b885fBdD70119f768"
X Link 2025-12-09T05:44Z 946.7K followers, 178.7K engagements
"10/ Haby regularly posts stories and selfies flaunting his lifestyle with little regard for opsec and was also caught simping for eGirls"
X Link 2025-12-29T14:36Z 946.7K followers, 117.7K engagements
"12/ Canadian law enforcement may already be familiar with Haby since theres been several swatting attempts involving his personal details locally. Unfortunately Canada is a jurisdiction that rarely ever prosecutes threat actors from The Com. I hope Canadian LE makes an exception as Haby shows zero remorse for victims and it is a rather easy case due to the large quantity of evidence available. https://twitter.com/i/web/status/2005649228408725593 https://twitter.com/i/web/status/2005649228408725593"
X Link 2025-12-29T14:36Z 946.7K followers, 173K engagements
"3/ In part [--] of the recording Dritan mocks John however John screenshares Exodus Wallet which shows the Tron address below with $2.3M: TMrWCLMS3ibDbKLcnNYhLggohRuLUSoHJg"
X Link 2026-01-23T13:02Z 946.7K followers, 165.2K engagements
"7/ 0xc7a2 received $24.9M from a US Government address in March [----] related to the Bitfinex hack seizure which is a theft from the USG I previously reported about in Oct [----]. $18.5M currently sits at 0xc7A253fD3C61CF69d043e6184c107dF4E29475B5"
X Link 2026-01-23T13:02Z 946.7K followers, 132.9K engagements
"Update: John quickly removed all of the NFT usernames from his Telegram account and change his screenname after my post"
X Link 2026-01-23T13:22Z 946.7K followers, 151.9K engagements
"Update: Patrick Witt (Executive Director for the US Presidents Council of Advisors for Digital Assets) & USMS have both stated they are looking into the incident"
X Link 2026-01-27T11:39Z 946.7K followers, 79.9K engagements
"@ParochuteCrypto @wyckoffweb I do not take on XRP cases and never asked to be contacted"
X Link 2026-02-06T21:11Z 946.7K followers, [----] engagements
"@FFVV1211 @Polymarket Coincidentally it comes only a few days after Logan Paul promoted Polymarket inorganically in a YT video"
X Link 2026-02-09T12:44Z 946.7K followers, 53.2K engagements
"A class action lawsuit was filed in Canada against the Boneheads team for the $3.1M NFT rug pull The team quickly disappeared and spent the mint funds on BAYCs luxury goods and other items never fulfilling the roadmap Yet another case where my research has been cited 1/ Investigating the $3.1m rug pull @BONEHEADS and the breadcrumbs left behind by the team into how the money has actually been spent. 1/ Investigating the $3.1m rug pull @BONEHEADS and the breadcrumbs left behind by the team into how the money has actually been spent"
X Link 2023-07-07T15:21Z 946.7K followers, 488K engagements
"Update: Box (Jeandiel) and Greavys (Malone) just had the indictment for the case unsealed https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam"
X Link 2024-09-19T19:19Z 946.7K followers, 846.9K engagements
"1/ Over the past few months I imagine you have seen many Coinbase users complain on X about their accounts suddenly being restricted. This is the result of aggressive risk models and Coinbases failure to stop its users losing $300M+ per year to social engineering scams"
X Link 2025-02-03T13:50Z 946.7K followers, 2.4M engagements
"7/ I think the risk of a rug with WhiteRock remains high due to their history with other projects (Zkasino Syncus Zigzag). I hope @MEXC_Official @Gate_io considers delisting WHITE and also conduct enhanced due diligence on the team. As the Zkasino team awaits trial hopefully soon Ildar Ilham Elham Nourzai & Lior Ben Zakan face serious legal repercussions for all of the harm they have caused to investors. https://twitter.com/i/web/status/1934616688928113045 https://twitter.com/i/web/status/1934616688928113045"
X Link 2025-06-16T14:18Z 946.7K followers, 169.8K engagements
"1/ Multiple projects tied to Pepe creator Matt Furie & ChainSaw as well as another project Favrr were exploited in the past week which resulted in $1M stolen My analysis links both attacks to the same cluster of DPRK IT workers who were likely accidentally hired as developers"
X Link 2025-06-27T14:02Z 946.7K followers, 880.1K engagements
"Update: Crypto Beast just reactivated his account and changed his username to @realcryptoelio a few minutes ago"
X Link 2025-08-06T08:26Z 946.7K followers, 183.5K engagements
"1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects"
X Link 2025-08-13T12:54Z 946.7K followers, 1.1M engagements
"@ceterispar1bus @mert post about top [---] token = paid shill Mert Cobie etc 51% bundled ZEC for supply control MRP coded CA"
X Link 2025-11-16T12:13Z 946.7K followers, 73.1K engagements
"Yes $6M+ stolen at minimum from hundreds of Trust Wallet users. Hopefully they will offer compensation to everyone if its determined theyre at fault for the incident. Its difficult to map out since theres many theft addresses. Heres my list so far below: EVM 0x3b09A3c9aDD7D0262e6E9724D7e823Cd767a0c74 0x463452C356322D463B84891eBDa33DAED274cB40 0xa42297ff42a3b65091967945131cd1db962afae4 0xe072358070506a4DDA5521B19260011A490a5aaA 0xe072358070506a4DDA5521B19260011A490a5aaA 0xc22b8126ca21616424a22bf012fd1b7cf48f02b1 0x463452c356322d463b84891ebda33daed274cb40"
X Link 2025-12-25T21:10Z 946.7K followers, 205.1K engagements
"@cozypront That X account is a scammer larping as a girl and lying about being a victim of the hack to bait engagement. [--] username changes countless meme coin scams only [---] posts for a [----] account they preblocked me X User ID: 1725149174780268544"
X Link 2025-12-26T03:53Z 946.7K followers, 184.3K engagements
"4/ Haby swapped his cut from the thefts from XRP to BTC via instant exchanges. By performing a timing analysis i was able to locate his BTC address. bc1qn3k5cz3905p6k50r44pjlj2rl9qcy72flsq3zh"
X Link 2025-12-29T14:36Z 946.7K followers, 95.9K engagements
"@MarcellxMarcell Question: How down bad do you have to be to blatantly bot all of your engagement on posts and followers with the same third world aged accounts connected via web"
X Link 2026-01-19T14:13Z 946.7K followers, 131.2K engagements
"7/ Greavys (Malone) lives a flashy lifestyle with the stolen funds having purchased 10+ cars and going out to clubs in LA and Miami with friends spending $250K-500K / night and giving out Birkin bags to girls. During video clips and in chats multiple people refer to him as Malone and was flexing stolen funds on Discord. Currently $3.5M tied to Greavys sits here 0x21d7d256be564191a43553e574c06a4d0e629767"
X Link 2024-09-19T13:05Z 946.7K followers, 1.1M engagements
"1/ Meet Yicong Wang () a Chinese OTC trader who has helped Lazarus Group convert tens of millions of stolen crypto to cash from various hacks via bank transfers since 2022"
X Link 2024-10-23T12:51Z 946.7K followers, 1.4M engagements
"Lazarus Group just connected the Bybit hack to the Phemex hack directly on-chain commingling funds from the intial theft address for both incidents. Overlap address: 0x33d057af74779925c4b2e720a820387cb89f8f65 Bybit hack txns on Feb [--] 2025: 0xc963e65b9ec39b11076f78990c31f29aaa80705c75312dafd1748479e3e94ed0 0x411374feedcfa560335f00c0fcfa0a3906fdcc33687e6f924dd78ebecc45cd00 Phemex hack txns on Feb [--] 2025: 0x6262a3339842240aeebae4ebfe338dbc771aa0e2df8f5a1ebcd7f9b090bedfe3"
X Link 2025-02-22T08:09Z 946.7K followers, 1.6M engagements
"Update: Wiz (Veer Chetal) was arrested by US Marshalls and here is his mug shot"
X Link 2025-03-25T17:10Z 946.7K followers, 479.6K engagements
"On Aug [--] [----] a victim fell for a social engineering scam and lost [---] BTC ($91M) after exchange and hardware wallet customer support were impersonated. The stolen funds began to peel off and deposits to Wasabi were made by the threat actor. Coincidentally this theft happened on the one year anniversary of the $243M Genesis Creditor theft. Theft txn hash da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457 Theft address bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej"
X Link 2025-08-21T17:33Z 946.7K followers, 719.4K engagements
"Update: OpenVPP appears to be potentially misrepresenting a third partnership with Smartcar When contacted the founder stated: His company is using Smartcar's self-service API offering. (It's something that anyone can access and use on our website.) My company Smartcar and have no further connection or involvement with their cryptocurrency token or related activities"
X Link 2025-09-19T20:35Z 946.7K followers, 166.5K engagements
"12/ It's extremely rare to see exploits/hacks involve NFT wash trading and I think the relationship between each address is just too coincidental given how they were funded prior to NFT purchases and traded multiple above the floor price for the collection. Hopefully law enforcement eventually moves forward with a criminal case in the future. Another piece of evidence is the overlap in instant exchanges used by the attacker and also tied to the suspects which I did not dive into as much since this post was getting quite long"
X Link 2025-10-15T14:19Z 946.7K followers, 107.3K engagements
"5/ I contacted the Zashi team and they informed me they plan to solve this privacy issue by adding ephemeral addresses soon and eventually shielded Near Intent refunds. In the meantime I suggest using multiple seeds on separate devices if you use Near Intent integration for Crosspay transfers using your shielded ZEC balance. Overall I still think Zashi is an enjoyable wallet experience for privacy and fixes several UI/UX complaints I had for Monero"
X Link 2025-10-21T12:28Z 946.7K followers, 288K engagements
"@inversebrah We will collectively block the hundreds of thousands of InfoFi farmers that spam AI slop replies. I support scamming suspending draining or breaching dbs for all of them. Make CT great again"
X Link 2025-12-12T06:47Z 946.7K followers, 79.6K engagements
"10/ Rumors circulating from cybercrime Telegram channels indicate John could be John Daghitia who was previously arrested in Sep [----]. Though more research is needed to fully confirm"
X Link 2026-01-23T13:03Z 946.7K followers, 182.5K engagements
"@beausecurity Both perpetrators deserve the electric chair as punishment"
X Link 2026-02-06T17:24Z 946.7K followers, 32.3K engagements
"1/ I am very happy to share the FBI seized crypto BAYC [----] AP watch and Doodle [----] from the phishing scammer known as Horror (HZ) aka Chase Senecal as a result of my thread"
X Link 2023-02-03T18:27Z 946.7K followers, 1.2M engagements
"Another day another influencer @DannyCrypt dumping on their followers undisclosed He received 2% of the supply to assist with marketing but within [--] minutes of receiving the tokens market dumped the majority of them for $57k (31 ETH) Meanwhile he tweeted hodling my HODL coin"
X Link 2023-05-10T19:08Z 946.7K followers, 2.6M engagements
"I was interested to see how much SOL has been sent as a result of the presale meta and calculated [------] SOL ($122.5M) raised from [--] presales"
X Link 2024-03-19T04:46Z 946.7K followers, 3.8M engagements
"1/ How Lazarus Group laundered $200M from 25+ crypto hacks to fiat from [----] - [----] https://zachxbt.mirror.xyz/B0-UJtxN41cJhpPtKv0v2LZ8u-0PwZ4ecMPEdX4l8vE https://zachxbt.mirror.xyz/B0-UJtxN41cJhpPtKv0v2LZ8u-0PwZ4ecMPEdX4l8vE"
X Link 2024-04-29T13:19Z 946.7K followers, 2.9M engagements
"One of my best investigations of all time will be posted within the next [--] hrs related to an $100M+ incident"
X Link 2024-09-19T08:47Z 946.7K followers, 837.9K engagements
"2/ Incident Summary: On August [--] [----] the threat actors targeted a single Genesis creditor by: 1) Calling as Google Support via spoofed number to compromise personal accounts 2) Calling after as Gemini support claiming account is hacked 3) Social engineered victim into resetting 2FA and sending Gemini funds to compromised wallet 4) Got victim to use AnyDesk to share screen and leaked private keys from Bitcoin core. Gemini txn hash [-----] BTC - Aug [--] at 1:48 am UTC e747b963a463334c164b0a8fff844f73693272bb2b331adbe2147d70ec196360 [-----] BTC - Aug [--] at 2:30 am UTC"
X Link 2024-09-19T13:03Z 946.7K followers, 1.2M engagements
"12/ With the assistance of @CFInvestigators @zeroshadow_io and the Binance Security Team more than $9M+ has been frozen and $500K+ has already been returned back after working closely with the victim to investigate the incident"
X Link 2024-09-19T13:05Z 946.7K followers, 536.1K engagements
"1/2 I uncovered [--] high confidence wallets tied to @MustStopMurad holding $24M in meme coins on Ethereum and Solana so the community can monitor his future activity"
X Link 2024-10-09T09:04Z 946.7K followers, 3.2M engagements
"1/ Over the past few months I have been tracking a series of related compromises for McDonalds Usher Kabosu Owner Andy Ayrey Wiz Khalifa SPX [----] etc on X & IG which has resulted in an estimated $3.5M+ stolen via launching Pump Fun meme coins"
X Link 2024-11-26T16:41Z 946.7K followers, 2.2M engagements
"Pleased to share I'll be working with @MattHuang @Paradigm as an incident response advisor to assist their portfolio companies. It was an easy decision as this gives me the freedom to continue helping the community and publishing investigations like. Ive always respected how Paradigm has given back to the space by funding intiatives such as Security Alliance publishing open source research and helping defend the right to privacy. .@zachxbt is a legend using onchain forensics to keep bad actors accountable. He has returned over $350M to victims of hacks and scams. This is increasingly"
X Link 2025-02-26T15:33Z 946.7K followers, 772.5K engagements
"CRO is no different from a scam Your team just reissued 70B CRO a week ago that was previously burned forever in [----] (70% total supply) and went against the community wishes as you control majority of the supply. Unsure why Truth would chose a partnership with your exchange over Coinbase Kraken Gemini etc after this move by your team. h/t Unchained Crypto for the data"
X Link 2025-03-25T05:07Z 946.7K followers, 527.7K engagements
"@jessepollak all of these viral coins yet not even a single $5M+ runner"
X Link 2025-04-21T15:46Z 946.7K followers, 161.1K engagements
"Update: Today twelve people were charged for the $243M Genesis creditor theft. Aakaash Anand was featured in the clip on 6/ laundering funds for Veer/Wiz"
X Link 2025-05-15T21:09Z 946.7K followers, 405.8K engagements
"1/ An investigation into how the New York based social engineering scammer Daytwo/PawsOnHips (Christian Nieves) stole $4M+ from Coinbase users by impersonating customer support bought luxury goods and lost most of the funds gambling at casinos"
X Link 2025-06-23T12:12Z 946.7K followers, 1.3M engagements
"1/ My recent investigation uncovered more than $16.58M in payments since January [--] [----] or $2.76M per month has been sent to North Korean IT workers hired as developers at various projects & companies. To put this in perspective payments range from $3K-8K per month meaning they have infiltrated [---] jobs on the low end or [---] jobs on the high end"
X Link 2025-07-02T12:35Z 946.7K followers, 1.2M engagements
"So Crypto Rover tagged Grok to select a winner for a giveaway and it began replying about his involvement in pump and dump schemes and sketchy promotions and is refusing to select a winner"
X Link 2025-07-21T03:37Z 946.7K followers, 1.4M engagements
"1/ An investigation into how @cryptobeastreal scammed followers by lying they were not behind the $190M - $3M $ALT market cap crash where 45+ connected insider wallets sold $11M+ on July [--] 2025"
X Link 2025-07-22T12:53Z 946.7K followers, 1.3M engagements
"1/2 I am pleased to share that Cameron Redman was convicted today and ordered to pay restitution as a result of my investigation. In June [----] X panel access was sold for [---] ETH which resulted in 10+ account compromises (JRNY Beeple Nouns Zeneca DeeKay etc) and millions stolen via phishing scams. At the time of this post other documents related to the case still remain sealed"
X Link 2025-07-29T19:14Z 946.7K followers, 621.6K engagements
"NEW LEAK: Price sheet of 200+ crypto influencers and their wallet addresses from a project they were recently contacted by to promote. From 160+ accounts who accepted the deal I only saw [--] accounts actually disclose the promotional posts as an advertisement"
X Link 2025-09-01T11:59Z 946.7K followers, 7.8M engagements
"This week the project @OpenVPP ($OVPP) claimed to be working with the US government on the tokenization of energy. [--] hrs ago Hester Pierce replied saying she does not work alongside or endorse private crypto projects. OpenVPP then hid her reply from the post. I reviewed the accounts promoting OpenVPP and its the usual influencer suspects. https://twitter.com/i/web/status/1968338476027580483 https://twitter.com/i/web/status/1968338476027580483"
X Link 2025-09-17T15:37Z 946.7K followers, 816.9K engagements
"11/ Earlier this year a civil lawsuit was filed against multiple suspects based on these findings. An interesting bit taken from the defendants statements is highlighted below where Rusty (Ayden B) admits ownership of several wallets I identified though denies involvement. 0xJones (Jon L) another alleged suspect previously applied for a role at OTF as friends with Rusty and deleted messages from the Bittensor Discord and deactivated his X account after the incident"
X Link 2025-10-15T14:19Z 946.7K followers, 117.1K engagements
"1/ A video went viral on YT this week after a US based victim lost $3.05M (1.2M XRP) from their Ellipal wallet. Heres the tracing of where the stolen funds ended up and the biggest takeaways for similar thefts"
X Link 2025-10-19T13:17Z 946.7K followers, 1M engagements
"1/ As part of my work I like to test out privacy products and figure out what works and what doesnt so I can abuse any design flaws for my investigations. With the recent hype around Zashi & its Near Intents integration I tested it for Zcash"
X Link 2025-10-21T12:28Z 946.7K followers, 930.3K engagements
"6/ I wanted to make this post so more people do not continue the privacy mistake of accidentally revealing their transparent address when bridging with shielded ZEC until a Zashi update is implemented. Should I do more posts like this in the future about how to maintain proper onchain opsec I am considering to offer a service for individual traders or boutique funds looking to anonymize their activity to reduce the chances of being fingerprinted onchain. If you're potentially interested send me a DM to see how we can work together. Do not contact me if you are a threat actor looking to"
X Link 2025-10-21T12:28Z 946.7K followers, 239.7K engagements
Limited data mode. Full metrics available with subscription: lunarcrush.com/pricing