[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]

# ![@zachxbt Avatar](https://lunarcrush.com/gi/w:26/cr:twitter::3012852462.png) @zachxbt ZachXBT

ZachXBT, a prominent investigator, has been tracking and exposing various cryptocurrency scams and exploits, including those linked to North Korean IT workers (DPRK ITWs). The investigations have led to multiple arrests, millions of dollars frozen, and the exposure of several scammers, including Crypto Beast, who rebranded as RealCryptoElio. Additionally, ZachXBT's work has highlighted the ongoing issue of DPRK ITWs being hired by companies, often due to a lack of proper due diligence, leading to significant financial losses.

### Engagements: XXXXXXX [#](/creator/twitter::3012852462/interactions)
![Engagements Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::3012852462/c:line/m:interactions.svg)

- X Week XXXXXXXXX -XX%
- X Month XXXXXXXXXX +223%
- X Months XXXXXXXXXX -XX%
- X Year XXXXXXXXXXX -XX%

### Mentions: XXX [#](/creator/twitter::3012852462/posts_active)
![Mentions Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::3012852462/c:line/m:posts_active.svg)

- X Week XXX +16%
- X Month XXX -XXXX%
- X Months XXX -XX%
- X Year XXXXX +0.93%

### Followers: XXXXXXX [#](/creator/twitter::3012852462/followers)
![Followers Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::3012852462/c:line/m:followers.svg)

- X Week XXXXXXX +0.41%
- X Month XXXXXXX +1%
- X Months XXXXXXX +8.30%
- X Year XXXXXXX +37%

### CreatorRank: XXXXXXX [#](/creator/twitter::3012852462/influencer_rank)
![CreatorRank Line Chart](https://lunarcrush.com/gi/w:600/cr:twitter::3012852462/c:line/m:influencer_rank.svg)

### Social Influence [#](/creator/twitter::3012852462/influence)
---

**Social category influence**
[cryptocurrencies](/list/cryptocurrencies)  #895 [exchanges](/list/exchanges)  #1785 [finance](/list/finance)  XXXX% [technology brands](/list/technology-brands)  XXXX% [stocks](/list/stocks)  XXXX% [social networks](/list/social-networks)  XXXX% [countries](/list/countries)  XXXX% [automotive brands](/list/automotive-brands)  XXXX%

**Social topic influence**
[ethereum](/topic/ethereum) #748, [exchanges](/topic/exchanges) #152, [binance](/topic/binance) #1041, [onchain](/topic/onchain) #1505, [$243m](/topic/$243m) #1, [token](/topic/token) #1329, [nft](/topic/nft) #54, [has been](/topic/has-been) 0.84%, [law enforcement](/topic/law-enforcement) #125, [holders](/topic/holders) #819

**Top accounts mentioned or mentioned by**
[@amoomayowa7](/creator/undefined) [@vladumix](/creator/undefined) [@good69_420](/creator/undefined) [@wazzcrypto](/creator/undefined) [@lapalma0101](/creator/undefined) [@thorchain](/creator/undefined) [@ps](/creator/undefined) [@lookonchain](/creator/undefined) [@therealnomics](/creator/undefined) [@coinbase](/creator/undefined) [@basedkarbon](/creator/undefined) [@waleswoosh](/creator/undefined) [@whiterockfi](/creator/undefined) [@inversebrah](/creator/undefined) [@dkerrincendia](/creator/undefined) [@geostaking](/creator/undefined) [@0xcozmic](/creator/undefined) [@cointelegraph](/creator/undefined) [@cl207](/creator/undefined) [@degrok_fun](/creator/undefined)

**Top assets mentioned**
[Ethereum (ETH)](/topic/ethereum) [Bittensor (TAO)](/topic/bittensor) [Coinbase Global, Inc. (COIN)](/topic/coinbase) [USDC (USDC)](/topic/usdc) [Alphabet Inc Class A (GOOGL)](/topic/$googl) [AltLayer (ALT)](/topic/$alt) [Celestia (TIA)](/topic/celestia) [ThorFi (THOR)](/topic/thorfi) [BlackRock Inc (BLK)](/topic/blackrock) [Solana (SOL)](/topic/solana) [Landwolf (WOLF)](/topic/landwolf) [OX Coin (OX)](/topic/$ox) [Pulsechain (PLS)](/topic/pulsechain)
### Top Social Posts [#](/creator/twitter::3012852462/posts)
---
Top posts by engagements in the last XX hours

"@kamasiii0 @THORChain Except they are not fully decentralized they literally chose to unilaterally freeze $200M of user funds with ThorFi earlier this year"  
[X Link](https://x.com/zachxbt/status/1925269729532682245) [@zachxbt](/creator/x/zachxbt) 2025-05-21T19:17Z 918.1K followers, 23.6K engagements


"Update: Crypto Beast just reactivated his account and changed his username to @realcryptoelio a few minutes ago"  
[X Link](https://x.com/zachxbt/status/1953009741635944649) [@zachxbt](/creator/x/zachxbt) 2025-08-06T08:26Z 918.2K followers, 171.7K engagements


"Just example 93838293939 of why Ripple has the most low iq holders convinced by disingenuous marketing Blackrock itself did not invest or back XRPL Ondo has a product that is called Ondo Short-Term U.S. Government Treasuries (OUSG) Ondo just leverages BlackRocks tokenized fund (BUIDL) for the RWA product OUSG was already live on three other chains (Ethereum Solana Polygon) prior to XRPL"  
[X Link](https://x.com/zachxbt/status/1954897391582339484) [@zachxbt](/creator/x/zachxbt) 2025-08-11T13:27Z 918.1K followers, 20.6K engagements


"Update: OpenVPP appears to be potentially misrepresenting a third partnership with Smartcar When contacted the founder stated: His company is using Smartcar's self-service API offering. (It's something that anyone can access and use on our website.) My company Smartcar and have no further connection or involvement with their cryptocurrency token or related activities"  
[X Link](https://x.com/zachxbt/status/1969138235139113206) [@zachxbt](/creator/x/zachxbt) 2025-09-19T20:35Z 918.1K followers, 141.1K engagements


"The problem is nowadays everyone wants an entertaining outcome to occur for major events so my analysis would likely be underwhelming. Theres still too many unknowns to reach a conclusion Id be comfortable publishing. All of the posts gaining attention right now are an exaggeration of half baked theories. Known: Garrett Jin / Exe seemingly started working with a Chinese whale who had XX figs sitting dormant onchain until recent"  
[X Link](https://x.com/zachxbt/status/1977327484531073381) [@zachxbt](/creator/x/zachxbt) 2025-10-12T10:56Z 918.1K followers, 120.7K engagements


"@BTC_Archive @OGHiddenApe Imagine falling for a social engineering customer support scam for Beast bank and losing your BTC while eating your Beast burger and watching Mr Beast on YT. What a movie"  
[X Link](https://x.com/zachxbt/status/1979181763307147638) [@zachxbt](/creator/x/zachxbt) 2025-10-17T13:44Z 918.1K followers, 95.3K engagements


"1/6 My issues with WorldCoin"  
[X Link](https://x.com/zachxbt/status/1683512389105229825) [@zachxbt](/creator/x/zachxbt) 2023-07-24T16:20Z 917.3K followers, 1.6M engagements


"A recent cyberattack on the Central Bank of Brazil services provider C&M resulted in a breach to the reserve accounts of six financial institutions where attackers converted stolen fiat to crypto. I began working on an initiative that has helped freeze $5M across multiple exchanges and blockchains. A special thanks goes to @Tether_to @Binance Security Team @Bitso @Bybit_Official Compliance Team & @CFInvestigators. Collaboration within the private sector is the most effective way to combat illicit activity and push our industry forward"  
[X Link](https://x.com/zachxbt/status/1944703336411717981) [@zachxbt](/creator/x/zachxbt) 2025-07-14T10:19Z 918.1K followers, 370K engagements


"@ICEBOYBILL @OpenVPP Same influencers who were pushing the depin / ai / gpu tax farms earlier this cycle"  
[X Link](https://x.com/zachxbt/status/1968339828636065958) [@zachxbt](/creator/x/zachxbt) 2025-09-17T15:42Z 918.1K followers, 11.9K engagements


"@DogecoinKenya Its not enjoyable to post frequently on X anymore I just work on cases in private"  
[X Link](https://x.com/zachxbt/status/1977672212892319755) [@zachxbt](/creator/x/zachxbt) 2025-10-13T09:46Z 918.1K followers, 93.4K engagements


"@onchainjesse Thanks I realize its been almost a month since my last post so to make up for it tomorrow at X pm UTC Ill publish an investigation on a X fig exploit"  
[X Link](https://x.com/zachxbt/status/1978157681861918830) [@zachxbt](/creator/x/zachxbt) 2025-10-14T17:55Z 918.1K followers, 21.1K engagements


"2/ XX $TAO holders experienced unauthorized transfers in excess of $28M from May to July 2024 and the Bittensor network was temporarily halted on July X 2024. A post-mortem published by the team revealed the thefts were the result of a supply chain attack after a malicious PyPi package was uploaded in late May 2024 Victims who downloaded the package and performed specific operations accidentally compromised private keys"  
[X Link](https://x.com/zachxbt/status/1978465694644899917) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 36.9K engagements


"@0xavinash @cz_binance @0xQingWu @inversebrah Update: I was immediately blocked"  
[X Link](https://x.com/zachxbt/status/1979192672632881323) [@zachxbt](/creator/x/zachxbt) 2025-10-17T14:27Z 918.1K followers, 26.7K engagements


"1/ Lets breakdown the $6.3m NFT rug Animoon a project that has constantly screwed over its holders since day 1"  
[X Link](https://x.com/zachxbt/status/1532390797479403521) [@zachxbt](/creator/x/zachxbt) 2022-06-02T15:56Z 917.9K followers, 4026 engagements


"@bitforexcom 1) What"  
[X Link](https://x.com/zachxbt/status/1814314867181965764) [@zachxbt](/creator/x/zachxbt) 2024-07-19T15:02Z 917.6K followers, 22.1K engagements


"1/ Meet Yicong Wang () a Chinese OTC trader who has helped Lazarus Group convert tens of millions of stolen crypto to cash from various hacks via bank transfers since 2022"  
[X Link](https://x.com/zachxbt/status/1849071080180240751) [@zachxbt](/creator/x/zachxbt) 2024-10-23T12:51Z 917.7K followers, 1.4M engagements


"7/ Alex Labs was hacked for $4.5M in May 2024 by Lazarus Group. One of the theft addresses deposited XXX ETH to a privacy protocol on June XX 2024 0xc0a0ec4dbf170611cc76f31a9df910ad79bc2266 Matching amounts were withdrawn the same day to two addresses 0x9fc1350f80734044b7189fe7b8f288396f76feb5 0x21c926a1a328a4906feeb18664d00f3d85df1aed Another theft address deposited XXX ETH from June 27-28th 0x1871bb6257b1f622548ef64a12ae5149eb208bd8 Shortly after a matching amount was withdrawn commingling with the Irys co-founder stolen funds. 0xddb2e9feaf0a122b43be14bc085cf713703ce45c On August 13th funds"  
[X Link](https://x.com/zachxbt/status/1849071168411607353) [@zachxbt](/creator/x/zachxbt) 2024-10-23T12:51Z 917.9K followers, 103K engagements


"@OpSecCloud From early on there were many red flags if you did basic due diligence so its clear all of the influencers who promoted OPSEC looked past this. Keep the names of influencers from these screenshots in mind and avoid them for the rest of this bull run"  
[X Link](https://x.com/zachxbt/status/1857014727005655336) [@zachxbt](/creator/x/zachxbt) 2024-11-14T10:56Z 917.8K followers, 121.6K engagements


"1/ Over the past few months I have been tracking a series of related compromises for McDonalds Usher Kabosu Owner Andy Ayrey Wiz Khalifa SPX 6900 etc on X & IG which has resulted in an estimated $3.5M+ stolen via launching Pump Fun meme coins"  
[X Link](https://x.com/zachxbt/status/1861450263925559399) [@zachxbt](/creator/x/zachxbt) 2024-11-26T16:41Z 917.7K followers, 2.2M engagements


"@FatManTerra Finally they got that OTC scammer He stole $7.1M (14.6K TAO) from a TAO whale in February 2024 Also scammed ZYN MOG Kondux Ordiswap Landwolf and Hash AI whales for another $8M+ all this year"  
[X Link](https://x.com/zachxbt/status/1864005956163498170) [@zachxbt](/creator/x/zachxbt) 2024-12-03T17:57Z 917.9K followers, 75.3K engagements


"I am not interested in Pulsechain investigations as that community did not prioritize building decent analytics tools or paying for integrations. Its difficult to analyze a chain without a Etherscan block explorer product on EVM chains Without Chainalysis or TRM integrations complex investigations take 10X as much work Without integrations for Arkham/Nansen / etc theres few options for retail to read/interpret activity"  
[X Link](https://x.com/zachxbt/status/1903448298251272216) [@zachxbt](/creator/x/zachxbt) 2025-03-22T14:06Z 917.8K followers, 26.1K engagements


"Your team stole $30M of investor funds from Zkasino and you were arrested. After those millions were gambled away via Hyperliquid/GMX leveraged positions and laundered the via instant exchanges and crypto to cash OTCs over the past few months. Elham Nourzai if there was a tier list for CT scammers you would be at the top"  
[X Link](https://x.com/zachxbt/status/1909153804131369256) [@zachxbt](/creator/x/zachxbt) 2025-04-07T07:58Z 918K followers, 229.8K engagements


"Update: So far $7M+ has been frozen with the help of @CFInvestigators @tanuki42_ Binance Security team and myself"  
[X Link](https://x.com/zachxbt/status/1918357171604988314) [@zachxbt](/creator/x/zachxbt) 2025-05-02T17:29Z 917.9K followers, 282.8K engagements


"@BitoEx_Official Do you want to explain to the community why multiple of your hot wallets saw suspicious outflows of $11.5M on May X 2025 where you still have not disclosed the security incident on X or Telegram several weeks later"  
[X Link](https://x.com/zachxbt/status/1929417001296146868) [@zachxbt](/creator/x/zachxbt) 2025-06-02T05:57Z 917.9K followers, 76.5K engagements


"9/ I believe that when a team hires multiple DPRK ITWs it is a decent indicator for determining that startup will be a failure. Unlike other threats to the industry DPRK ITWs have little sophistication so its mainly the result of a teams own negligence. I think the prevalence of them is due to being cheap and the lack of available talent as well as high valuations that resulted in incompetent founders who received funding"  
[X Link](https://x.com/zachxbt/status/1940388908124291553) [@zachxbt](/creator/x/zachxbt) 2025-07-02T12:35Z 917.9K followers, 174.2K engagements


"@LBankUpdates @blockdagnetwork I hope your team realizes that BlockDAG Network is a fake project / investment scam that has held a presale for 1.5+ years thats supposedly ending soon while regularly transferring investor funds to various exchange accounts and marketing fake numbers to increase retail fomo"  
[X Link](https://x.com/zachxbt/status/1957426002432598163) [@zachxbt](/creator/x/zachxbt) 2025-08-18T12:55Z 917.9K followers, 39.9K engagements


"@burliko I missed the part where your loss is my problem"  
[X Link](https://x.com/zachxbt/status/1974132583958262251) [@zachxbt](/creator/x/zachxbt) 2025-10-03T15:21Z 917.7K followers, 77.9K engagements


"@jzgulati the story of october money laundry number go up (Swissborg theft edition)"  
[X Link](https://x.com/zachxbt/status/1976989434920010209) [@zachxbt](/creator/x/zachxbt) 2025-10-11T12:33Z 917.9K followers, 55.6K engagements


"Also tired of onchain technology that has primarily benefited from illicit activity where the teams rake in fees and dont take any responsibility by returning fees at minimum if they cannot build mechanisms to prevent it. EX: Garden Finance from Apr - Jul 2025 XX% of total volume was stolen funds and they profited multiple X figs of funds from the flows (I stopped monitoring flows after July)"  
[X Link](https://x.com/zachxbt/status/1978359465020727344) [@zachxbt](/creator/x/zachxbt) 2025-10-15T07:17Z 917.6K followers, 29.5K engagements


"6/ EX 3: For this one Raichu worked with rapper Rich The Kid for the project Ancient Cats Club. The team quickly rugged shortly after launch stealing over $1.7m. The team of this project eventually launched other NFT scams like Bored Bunny and Rich Dwarves Tribe"  
[X Link](https://x.com/zachxbt/status/1643600915096559618) [@zachxbt](/creator/x/zachxbt) 2023-04-05T13:06Z 918K followers, 87.2K engagements


"7/ EX 4: Raichu worked with The Game and Dillon Danis to promote Baby Dinger token another scam"  
[X Link](https://x.com/zachxbt/status/1643600924361781252) [@zachxbt](/creator/x/zachxbt) 2023-04-05T13:06Z 918.1K followers, 45.6K engagements


"1/ An investigation into the YouTuber turned phishing scammer Blue (Jack) who has worked with Monkey Drainer and other drainer services to steal more than $1.5m"  
[X Link](https://x.com/zachxbt/status/1678384917657296898) [@zachxbt](/creator/x/zachxbt) 2023-07-10T12:45Z 918K followers, 758K engagements


"I would advise being careful with @DeDotFi for their $DEFI token sale. They have extended the public sale multiple times increasing the max raise without any transparency. $1M - $1.5M - $2.5M - $3M Not to mention they did a IDO in Feb 2022 and those people have not received tokens after more than XXX yrs. There are also a bunch of suspicious influencer posts advertising this as a 10-100X"  
[X Link](https://x.com/zachxbt/status/1719069626120757347) [@zachxbt](/creator/x/zachxbt) 2023-10-30T19:11Z 918K followers, 585.7K engagements


"Thanks @DwightHoward for the quick rug pull"  
[X Link](https://x.com/zachxbt/status/1752465336451158370) [@zachxbt](/creator/x/zachxbt) 2024-01-30T22:54Z 918.1K followers, 515.2K engagements


"Community Alert: The group of scammers who stole X figs with Magnate Kokomo Lendora Solfire etc is back with a new project on Blast @Leaperfinance Last week they funded an address on Blast with $1M of laundered funds from the previous rugs and have begun adding liquidity to bait people in. Tracing: 1). X week ago 0x46a moves ETH a few hops from Magnate scam to 0x10e 0x46a10e7444bf78736E6a24b1De8dc8A20E4B3ED7 0x10ef5bb874b226bdd6860f00d5e5a2aa3e955b9a 2). Bridges to 0xAc9 on Polygon 0xAc973E1Be91fe8674dff2E0de4A9375803Ae4435 3). 0xAc9 transfers wETH to 0x08"  
[X Link](https://x.com/zachxbt/status/1779333168383791411) [@zachxbt](/creator/x/zachxbt) 2024-04-14T02:17Z 918.1K followers, 964.1K engagements


"Investigation of @GCRClassic hacker reveal will be posted in next 12-24 hrs"  
[X Link](https://x.com/zachxbt/status/1794814443454652748) [@zachxbt](/creator/x/zachxbt) 2024-05-26T19:34Z 918.1K followers, 541.6K engagements


"2/ Incident Summary: On August XX 2024 the threat actors targeted a single Genesis creditor by: 1) Calling as Google Support via spoofed number to compromise personal accounts 2) Calling after as Gemini support claiming account is hacked 3) Social engineered victim into resetting 2FA and sending Gemini funds to compromised wallet 4) Got victim to use AnyDesk to share screen and leaked private keys from Bitcoin core. Gemini txn hash XXXXX BTC - Aug XX at 1:48 am UTC e747b963a463334c164b0a8fff844f73693272bb2b331adbe2147d70ec196360 XXXXX BTC - Aug XX at 2:30 am UTC"  
[X Link](https://x.com/zachxbt/status/1836752940029149269) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:03Z 918.1K followers, 1.1M engagements


"4/ An initial tracing showed $243M split multiple ways between each party before funds quickly peeled off to 15+ exchanges immediately swapping back and forth between Bitcoin Litecoin Ethereum and Monero"  
[X Link](https://x.com/zachxbt/status/1836753196053602525) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:04Z 918.1K followers, 772.8K engagements


"6/ Wizs friend Light/Dark (Aakaash) helped launder the funds for him using eXch and Thorswap. Similar to Wiz he also leaked his name during screen share. Wiz TC Destination address confirmed in video 0xa212d7441fed6db9ab666ba34e8c440c565f4af8"  
[X Link](https://x.com/zachxbt/status/1836753381412536711) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:05Z 918.2K followers, 909.7K engagements


"12/ With the assistance of @CFInvestigators @zeroshadow_io and the Binance Security Team more than $9M+ has been frozen and $500K+ has already been returned back after working closely with the victim to investigate the incident"  
[X Link](https://x.com/zachxbt/status/1836753455366467803) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:05Z 918.2K followers, 508.4K engagements


"13/ As a result of the investigation Box and Greavys were arrested yesterday evening in Miami and LA. I would expect law enforcement seized additional funds during the arrests due to large transfers around that period of time"  
[X Link](https://x.com/zachxbt/status/1836753468725338346) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:05Z 918.2K followers, 588.8K engagements


"14/ My post will be updated as the legal case progresses. In the meantime mint a free collectible to commemorate the investigation of the stolen $243M below on Zora"  
[X Link](https://x.com/zachxbt/status/1836753473343259058) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:05Z 918.1K followers, 944K engagements


"Update: Box (Jeandiel) and Greavys (Malone) just had the indictment for the case unsealed"  
[X Link](https://x.com/zachxbt/status/1836847633018626466) [@zachxbt](/creator/x/zachxbt) 2024-09-19T19:19Z 918.1K followers, 819K engagements


"1/ The UK scammer @ape_31 @60711 has stolen more than $650K from 250+ X users in the past year by posting fake PNL screenshots from a Bybit demo account and running a news account to funnel unsuspecting victims into paid services before blocking them upon receiving payment"  
[X Link](https://x.com/zachxbt/status/1840749550304125401) [@zachxbt](/creator/x/zachxbt) 2024-09-30T13:44Z 918.1K followers, 1.9M engagements


"1/ An investigation into Faris Ali (Zay/Tommy) from the UK and his alleged involvement in robbing an X user out of $4.3M in June 2024 during a home invasion as the result of a crypto data breach"  
[X Link](https://x.com/zachxbt/status/1844369881342542170) [@zachxbt](/creator/x/zachxbt) 2024-10-10T13:30Z 918.2K followers, 1.7M engagements


"1/ Time to share how SCALE NTD TPU & OPSEC projects were all tied to the same person Zopp0 to farm naive traders using numerous influencers shown in leaked messages"  
[X Link](https://x.com/zachxbt/status/1853065733321724274) [@zachxbt](/creator/x/zachxbt) 2024-11-03T13:24Z 918.1K followers, 872K engagements


"1/3 A threat actor has stolen $500K over the past month by compromising 15+ X accounts (Kick Cursor Alex Blania The Arena Brett etc) from sending targeted phishing emails which impersonated the X team to steal credentials and then launch meme coin scams"  
[X Link](https://x.com/zachxbt/status/1871543397875671099) [@zachxbt](/creator/x/zachxbt) 2024-12-24T13:08Z 918.2K followers, 989.4K engagements


"@JoeyMooose @frankdegods @notthreadguy @MINHxDYNASTY Thank you for the gesture"  
[X Link](https://x.com/zachxbt/status/1881659207520530671) [@zachxbt](/creator/x/zachxbt) 2025-01-21T11:04Z 918.1K followers, 383K engagements


"6/ Scammers clone the Coinbase site nearly 1:1 and allow the scammers to send different prompts to the target via spoofed emails using panels. There are many Telegram channels where scammers advertise them. See examples of various panels used by scammers below"  
[X Link](https://x.com/zachxbt/status/1886411991918555175) [@zachxbt](/creator/x/zachxbt) 2025-02-03T13:50Z 918.1K followers, 132.4K engagements


"@arkham TLDR myself and Josh from CF connected the Bybit hack on-chain to the Phemex hack"  
[X Link](https://x.com/zachxbt/status/1893034959721386031) [@zachxbt](/creator/x/zachxbt) 2025-02-21T20:27Z 918.1K followers, 539.8K engagements


"1/ An investigation into the alleged identity of the mysterious Hyperliquid whale tied to illicit activity that profited $20M via highly leveraged positions over the past couple weeks"  
[X Link](https://x.com/zachxbt/status/1902713021937426495) [@zachxbt](/creator/x/zachxbt) 2025-03-20T13:25Z 918.2K followers, 2.6M engagements


"2/ A trader opened multiple highly leveraged positions on Hyperliquid and GMX from Jan - Mar 2025. They gained lots of attention this month after two onchain trades: -Large ETH & BTC long position on 50X leverage just before Trumps crypto reserve announcement by 0xe4d3 ($10M profit) -Large BTC short position on 40X leverage by 0xf3F4 ($9M profit)"  
[X Link](https://x.com/zachxbt/status/1902713038433554576) [@zachxbt](/creator/x/zachxbt) 2025-03-20T13:25Z 918.1K followers, 241K engagements


"3/ I went and identified the main counterparties of 0xf3f: 0x7ab8c59db7b959bb8c3481d5b9836dfbc939af21 0x312f8282f68e17e33b8edde9b52909a77c75d950 0xab3067c58811ade7aa17b58808db3b4c2e86f603 0xe4d31c2541a9ce596419879b1a46ffc7cd202c62 This cluster is to tied to Roobet Binance Gamdom ChangeNOW Shuffle Alphapo BC Game & Metawin accounts"  
[X Link](https://x.com/zachxbt/status/1902713054908846248) [@zachxbt](/creator/x/zachxbt) 2025-03-20T13:25Z 918.2K followers, 234.9K engagements


"CRO is no different from a scam Your team just reissued 70B CRO a week ago that was previously burned forever in 2021 (70% total supply) and went against the community wishes as you control majority of the supply. Unsure why Truth would chose a partnership with your exchange over Coinbase Kraken Gemini etc after this move by your team. h/t Unchained Crypto for the data"  
[X Link](https://x.com/zachxbt/status/1904399783697031305) [@zachxbt](/creator/x/zachxbt) 2025-03-25T05:07Z 918.1K followers, 525.5K engagements


"Update: Wiz (Veer Chetal) was arrested by US Marshalls and here is his mug shot"  
[X Link](https://x.com/zachxbt/status/1904581571660706277) [@zachxbt](/creator/x/zachxbt) 2025-03-25T17:10Z 918.2K followers, 444K engagements


"@jessepollak all of these viral coins yet not even a single $5M+ runner"  
[X Link](https://x.com/zachxbt/status/1914344980954415343) [@zachxbt](/creator/x/zachxbt) 2025-04-21T15:46Z 918.1K followers, 160.8K engagements


"Nine hours ago a suspicious transfer was made from a potential victim for 3520 BTC ($330.7M) Theft address bc1qcrypchnrdx87jnal5e5m849fw460t4gk7vz55g Shortly after the funds began to be laundered via 6+ instant exchanges and was swapped for XMR causing the XMR price to spike 50%"  
[X Link](https://x.com/zachxbt/status/1916756932763046273) [@zachxbt](/creator/x/zachxbt) 2025-04-28T07:30Z 918.2K followers, 3.5M engagements


"Update: Today twelve people were charged for the $243M Genesis creditor theft. Aakaash Anand was featured in the clip on 6/ laundering funds for Veer/Wiz"  
[X Link](https://x.com/zachxbt/status/1923123503823192157) [@zachxbt](/creator/x/zachxbt) 2025-05-15T21:09Z 918.2K followers, 245.2K engagements


"Heres more lore about Malone Lam we uncovered during the $243M Genesis Creditor theft. On June XX 2024 Mark Cuban fell victim to a social engineering scam losing crypto assets from his public wallet markcuban.eth We noticed the exact same device indicators in the Cuban theft as the $243M theft across multiple transactions where funds were laundered. Yesterday the superseding indictment was unsealed that hints at Lam and Chens involvement in Cubans theft with a matching date/amount. Theft address 0x733ea491051929d0b6619425e088d210deb5cbe6"  
[X Link](https://x.com/zachxbt/status/1923465312529416702) [@zachxbt](/creator/x/zachxbt) 2025-05-16T19:47Z 918.1K followers, 572.6K engagements


"when the biggest shills for a project come from sketchy KOLs (Nekoz etc) vs actual builders for a project it typically means the tech is underwhelming. nonetheless the supply control by them has so far been impressive L1s w/ token preproduct + large tax at launch for a serious project = pumping to insane valuation will always be funny *mutes before angry holders appear*"  
[X Link](https://x.com/zachxbt/status/1932082261303902604) [@zachxbt](/creator/x/zachxbt) 2025-06-09T14:28Z 918.1K followers, 237.1K engagements


"1/ Community Alert: At least one team member from the $30M Zkasino exit scam appears to be involved with the project @WhiteRock_Fi $WHITE due to onchain transactions linking both projects and a personal email address"  
[X Link](https://x.com/zachxbt/status/1934616622846931249) [@zachxbt](/creator/x/zachxbt) 2025-06-16T14:18Z 918.2K followers, 826.4K engagements


"6/ An unnamed source provided a personal email of an account that interacted multiple time with the WhiteRock deployer address. I noticed the email has an account on Chess(.)com with the username IldarTheGrandMaster. Prometheus from Zkasino = Ildar Whiterock alias = Goedel goedel014@gmail(.)com"  
[X Link](https://x.com/zachxbt/status/1934616677473534266) [@zachxbt](/creator/x/zachxbt) 2025-06-16T14:18Z 918.1K followers, 98.1K engagements


"7/ I think the risk of a rug with WhiteRock remains high due to their history with other projects (Zkasino Syncus Zigzag). I hope @MEXC_Official @Gate_io considers delisting WHITE and also conduct enhanced due diligence on the team. As the Zkasino team awaits trial hopefully soon Ildar Ilham Elham Nourzai & Lior Ben Zakan face serious legal repercussions for all of the harm they have caused to investors"  
[X Link](https://x.com/zachxbt/status/1934616688928113045) [@zachxbt](/creator/x/zachxbt) 2025-06-16T14:18Z 918.1K followers, 162.2K engagements


"1/ An investigation into how the New York based social engineering scammer Daytwo/PawsOnHips (Christian Nieves) stole $4M+ from Coinbase users by impersonating customer support bought luxury goods and lost most of the funds gambling at casinos"  
[X Link](https://x.com/zachxbt/status/1937121554124754960) [@zachxbt](/creator/x/zachxbt) 2025-06-23T12:12Z 918.2K followers, 1.3M engagements


"1/ Multiple projects tied to Pepe creator Matt Furie & ChainSaw as well as another project Favrr were exploited in the past week which resulted in $1M stolen My analysis links both attacks to the same cluster of DPRK IT workers who were likely accidentally hired as developers"  
[X Link](https://x.com/zachxbt/status/1938598925004607629) [@zachxbt](/creator/x/zachxbt) 2025-06-27T14:02Z 918.1K followers, 863.9K engagements


"11/ The Favrr CTO Alex Hong has a background which appears suspicious and is likely one of the two DPRK ITWs hired. His LinkedIn was very recently deleted. I also reached out to a project he supposedly worked at but could not verify his work history"  
[X Link](https://x.com/zachxbt/status/1938599027748319442) [@zachxbt](/creator/x/zachxbt) 2025-06-27T14:03Z 918.1K followers, 169.6K engagements


"12/ Soon I plan to publish my stats on total payments being sent out to DPRK ITWs at companies/projects to provide insight into how bad it is. Its depressing how many teams hire DPRK IT workers when basic due diligence would likely have prevented it. The lack of communication from Matt Furie & ChainSaw since the incident occurred has been disappointing with their only warning to the community deleted without explanation. The stolen funds from the ChainSaw incident mostly remain dormant. The stolen funds for Favrr were transferred to Gate and a few nested services. I have been unable to get in"  
[X Link](https://x.com/zachxbt/status/1938599039668474306) [@zachxbt](/creator/x/zachxbt) 2025-06-27T14:03Z 918.2K followers, 156.5K engagements


"@MEXC_Official @Gate_io Update: Ildar Ilham aka @XBT_Prometheus (founder of @WhiteRock_Fi) was arrested by UAE law enforcement for his involvement in the $30M Zkasino exit scam. He will be extradited to the Netherlands next for the criminal case"  
[X Link](https://x.com/zachxbt/status/1940767194931253529) [@zachxbt](/creator/x/zachxbt) 2025-07-03T13:38Z 918.1K followers, 359.6K engagements


"Update: It has now been over a month of silence from @Matt_Furie @ChainSawNFT as collectors of their projects sit with large losses. The stolen funds sat as a freezable assets but due to lack of action by the team no freeze was made and multiple deposits to MEXC were made by DPRK ITWs. Its debatably the worst handling of an incident I have ever seen and their failure to give any transparency shows negligence"  
[X Link](https://x.com/zachxbt/status/1946465292324085841) [@zachxbt](/creator/x/zachxbt) 2025-07-19T07:01Z 918.2K followers, 96.1K engagements


"So Crypto Rover tagged Grok to select a winner for a giveaway and it began replying about his involvement in pump and dump schemes and sketchy promotions and is refusing to select a winner"  
[X Link](https://x.com/zachxbt/status/1947138733733462235) [@zachxbt](/creator/x/zachxbt) 2025-07-21T03:37Z 918.1K followers, 1.4M engagements


"Heres my investigation from last year in case you are unfamiliar"  
[X Link](https://x.com/zachxbt/status/1947139100642828423) [@zachxbt](/creator/x/zachxbt) 2025-07-21T03:38Z 918.2K followers, 279K engagements


"2/ Earlier this month Crypto Beast began aggressively promoting $ALT on X and TG. On July XX 2025 ALT crashed from XXXX to XXXXX after insiders sold a large percent of the total supply. All of these posts promoting the token. have since been deleted"  
[X Link](https://x.com/zachxbt/status/1947641032797262256) [@zachxbt](/creator/x/zachxbt) 2025-07-22T12:53Z 918.1K followers, 91.1K engagements


"4/ I observed LedZo5 was funded via instant exchange so I traced back from the funding txns to the Celestia address below by performing a timing analysis. celestia1chflqywwp0k8rjzgp3w4447fquyk9ynnc6zws5"  
[X Link](https://x.com/zachxbt/status/1947641056188633139) [@zachxbt](/creator/x/zachxbt) 2025-07-22T12:53Z 918.2K followers, 79.5K engagements


"5/ The Celestia address from above transferred small amounts to five instant exchanges from May - July 2025 (Kucoin nested Sideshift Binance nested HTX nested etc) to fund side wallets"  
[X Link](https://x.com/zachxbt/status/1947641067202904158) [@zachxbt](/creator/x/zachxbt) 2025-07-22T12:53Z 918.2K followers, 74.1K engagements


"1/2 I am pleased to share that Cameron Redman was convicted today and ordered to pay restitution as a result of my investigation. In June 2022 X panel access was sold for XXX ETH which resulted in 10+ account compromises (JRNY Beeple Nouns Zeneca DeeKay etc) and millions stolen via phishing scams. At the time of this post other documents related to the case still remain sealed"  
[X Link](https://x.com/zachxbt/status/1950273651133034839) [@zachxbt](/creator/x/zachxbt) 2025-07-29T19:14Z 918.2K followers, 607.4K engagements


"The affidavit confirmed all of the victims from my investigation Victim X = Beeple Victim X = DeeKay Victim X = Zeneca Victim X = Nouns DAO Victim X = JRNY Club"  
[X Link](https://x.com/zachxbt/status/1950526073055150546) [@zachxbt](/creator/x/zachxbt) 2025-07-30T11:57Z 918.2K followers, 147.7K engagements


"1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects"  
[X Link](https://x.com/zachxbt/status/1955613912201896113) [@zachxbt](/creator/x/zachxbt) 2025-08-13T12:54Z 918.1K followers, 1M engagements


"10/ Still one of the more common questions is how do you know they are North Korean Well besides all of the fraudulent documents detailed above their search history showed frequent Google Translate usage with translations to Korean with a Russian IP"  
[X Link](https://x.com/zachxbt/status/1955614268327444658) [@zachxbt](/creator/x/zachxbt) 2025-08-13T12:55Z 918.2K followers, 197.6K engagements


"11/ The main challenge faced in fighting DPRK ITWs at companies include the lack of collaboration between services and the private sector. Theres also the negligence by the teams hiring them who become combative when alerted. ITWs are in no way sophisticated but are persistent since theres so many flooding the job market globally for roles. Payoneer is commonly being used to convert fiat into crypto from dev work. I have already covered multiple times on indicators of what to look out for so I will not repeat those again"  
[X Link](https://x.com/zachxbt/status/1955614285343699128) [@zachxbt](/creator/x/zachxbt) 2025-08-13T12:55Z 918K followers, 167.9K engagements


"@memenetic POV your new meme coin grift is destined for failure due to influencer bukkake 150+ promotional posts from d-tier influencers millions of botted followers and likes only XX SOL raised for the presale few disclosures for the posts"  
[X Link](https://x.com/zachxbt/status/1959237311880966480) [@zachxbt](/creator/x/zachxbt) 2025-08-23T12:52Z 918.2K followers, 121.7K engagements


"NEW LEAK: Price sheet of 200+ crypto influencers and their wallet addresses from a project they were recently contacted by to promote. From 160+ accounts who accepted the deal I only saw X accounts actually disclose the promotional posts as an advertisement"  
[X Link](https://x.com/zachxbt/status/1962485396597776468) [@zachxbt](/creator/x/zachxbt) 2025-09-01T11:59Z 918.1K followers, 7.5M engagements


"@inversebrah These botted milady meme coin KOL scammer accounts that keep appearing out of nowhere are so annoying"  
[X Link](https://x.com/zachxbt/status/1964634423556788684) [@zachxbt](/creator/x/zachxbt) 2025-09-07T10:18Z 918.1K followers, 41.7K engagements


"@PayPal @Venmo Shoutout PayPal I would never have found crypto originally if it was not for locking my account for simply selling items while being underage"  
[X Link](https://x.com/zachxbt/status/1966405445465325988) [@zachxbt](/creator/x/zachxbt) 2025-09-12T07:36Z 918.1K followers, 75.7K engagements


"@lookonchain @jpthor Also in a recent documentary about the Bybit hack in an interview he defended DPRKs right to hack/exploit teams"  
[X Link](https://x.com/zachxbt/status/1966427843782750342) [@zachxbt](/creator/x/zachxbt) 2025-09-12T09:05Z 918.1K followers, 51.7K engagements


"@frdysk @FrankieIsLost someone should create a analytics site to compare different platform i think so many new options nowadays its difficult to compare them all without a table"  
[X Link](https://x.com/zachxbt/status/1968207527340020181) [@zachxbt](/creator/x/zachxbt) 2025-09-17T06:56Z 918.1K followers, 1921 engagements


"This week the project @OpenVPP ($OVPP) claimed to be working with the US government on the tokenization of energy. XX hrs ago Hester Pierce replied saying she does not work alongside or endorse private crypto projects. OpenVPP then hid her reply from the post. I reviewed the accounts promoting OpenVPP and its the usual influencer suspects"  
[X Link](https://x.com/zachxbt/status/1968338476027580483) [@zachxbt](/creator/x/zachxbt) 2025-09-17T15:37Z 918.1K followers, 780.9K engagements


"Update: The OpenVPP team made a statement and says the reply was accidentally hidden by a 24/7 intern"  
[X Link](https://x.com/zachxbt/status/1968346998869995760) [@zachxbt](/creator/x/zachxbt) 2025-09-17T16:11Z 918.2K followers, 125.2K engagements


"Update: OpenVPP appears to potentially be misrepresenting another partnership with Commonwealth Edison (ComEd). When contacted the company stated: We did not partner with them and are not interested"  
[X Link](https://x.com/zachxbt/status/1968704019347484884) [@zachxbt](/creator/x/zachxbt) 2025-09-18T15:49Z 918.1K followers, 286K engagements


"@Steam You clowns allow malware on your platform that has resulted in $150K+ stolen from victims (fake game has been available to download for more than a month)"  
[X Link](https://x.com/zachxbt/status/1969793042531107300) [@zachxbt](/creator/x/zachxbt) 2025-09-21T15:57Z 918.2K followers, 450K engagements


"@AlpineF1Team @blockdagnetwork Not sure who does your due diligence on F1 partners but Blockdag is an investment scam that has been running a presale for 1.5+ yrs now and advertises fake numbers for how much theyve raised"  
[X Link](https://x.com/zachxbt/status/1973105321775341972) [@zachxbt](/creator/x/zachxbt) 2025-09-30T19:19Z 918.2K followers, 37.3K engagements


"@cecilia_hsueh X. No crawback"  
[X Link](https://x.com/zachxbt/status/1976642879427678690) [@zachxbt](/creator/x/zachxbt) 2025-10-10T13:36Z 918.1K followers, 133.6K engagements


"0x8d0a is an interesting wallet as they were also directly involved in the $HIFI Binance delisting pump and dump last month. 0x8d0a received dust from XX addresses linking XX of the perpetrators Binance deposit addresses used for $HIFI manipulation. 0xb42dba0088c1b2435af4b71613314c5897d08d77 0x531d9ceaecba84067b5bbf8617811a3513b79470 0x67f7fecfa1cda20930185f8810cce1a6972f352c 0x782a26a8845ba02eb8af537918ede35eabc14dd6 0xcedfef02c2e05ec4c24b8e3271725e673db6695e 0xdfbad887f3dacff93ab0fecf19d89d7940d7787c 0xd1ebf0b3a6b453bec246b9eb32d503ef46c16a68 0xcca4ed05987bca2e48ebbb359c0685303f48e605"  
[X Link](https://x.com/zachxbt/status/1977070305626775878) [@zachxbt](/creator/x/zachxbt) 2025-10-11T17:54Z 918.1K followers, 42.9K engagements


"@Tradermayne How many rugs is Cole0x connected to now Off the top of my head its: LinkPadVC/Solstarter ClosedAI DerpItOnS BSC meme coin Monad meme coin. Have tried warning the community about Cole and Nekoz many times"  
[X Link](https://x.com/zachxbt/status/1977468284858687596) [@zachxbt](/creator/x/zachxbt) 2025-10-12T20:15Z 918.1K followers, 66.1K engagements


"@Bitrace_team @MistTrack_io Only Circle would attempt one of the most useless freezes I have ever seen. Tips off the hacker in the future they will attempt to freeze them Address holds DAI not USDC Send the DAI to a new address and swap to USDC"  
[X Link](https://x.com/zachxbt/status/1978070359657042372) [@zachxbt](/creator/x/zachxbt) 2025-10-14T12:08Z 918K followers, 28.4K engagements


"Whats most interesting is wallet addresses listed in the US government $14B (127K BTC) seizure previously were named in a Milky Sad report X years ago for having vulnerable private keys and now the USG says they have custody of them"  
[X Link](https://x.com/zachxbt/status/1978124927162098025) [@zachxbt](/creator/x/zachxbt) 2025-10-14T15:45Z 918.2K followers, 584.7K engagements


"@SpiffyLad USG stole from criminals who ran pig butchering scams and trafficked humans DPRK stole from innocent teams within our industry Hard to compare the two"  
[X Link](https://x.com/zachxbt/status/1978130723308486669) [@zachxbt](/creator/x/zachxbt) 2025-10-14T16:08Z 918.1K followers, 9550 engagements


"@HyperliquidX Wen half decent block explorer or analytic tools for Core"  
[X Link](https://x.com/zachxbt/status/1978371067459604481) [@zachxbt](/creator/x/zachxbt) 2025-10-15T08:03Z 918.1K followers, 89.4K engagements


"@stablealt @HyperliquidX HypurrScan team deserves hundreds of lashes for fumbling their early mover advantage and overlooking basic features EX: The Unit protocol address is not even publicly tagged when they are one of the largest HL protocols"  
[X Link](https://x.com/zachxbt/status/1978374388970889669) [@zachxbt](/creator/x/zachxbt) 2025-10-15T08:16Z 918.1K followers, 19.3K engagements


"unsure whats true since the team never made a statement but i saw several people comment he was forced to step back from his role so he may be legally obligated to avoid commenting of course the natural follow up question for that would be why just dont think its good to witch hunt without more details instead people should push the Story team for transparency since its not a good look from them having a co-founder depart immediately after TGE"  
[X Link](https://x.com/zachxbt/status/1978379571633471573) [@zachxbt](/creator/x/zachxbt) 2025-10-15T08:37Z 918.1K followers, 115.9K engagements


"1/ An investigation into how I identified one of suspects tied to the $28M Bittensor hack from 2024 by identifying anime NFT wash trades linked to a former employee and earned a whitehat bounty for my efforts"  
[X Link](https://x.com/zachxbt/status/1978465677578301723) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 367.8K engagements


"3/ I began tracing the stolen funds from two initial theft addresses TAO was bridged to Ethereum via Bittensor native bridge and then transferred to instant exchanges where the attackers swapped to XMR. Victims: $400K: 5ENiTXL63DRMKytjaDRBLnorwd6qURKcCVgsgpu8UQxgptQN $13M: 5DnXm2tBGAD57ySJv5SfpTfLcsQbSKKp6xZKFWABw3cYUgqg"  
[X Link](https://x.com/zachxbt/status/1978465711233417684) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 32.4K engagements


"5/ I deanonymized the Railgun withdrawals to three addresses (0x1d7 0x87d8 0x1fbc) by applying timing / amount heuristics. Total deposits: 1249.68 ETH 277.2K USDC XXXXX WETH Total withdrawals: 1246.16 ETH 276.4K USDC XXXXX WETH The unique denominations and short deposit time makes the demix high confidence. Withdrawal addresses: 0x87d82c5401764f87856a31746f603ff766c72c7d 0x1d7ac347943c2143587978141a9415f2138adc2a 0x1fbc554caff6c1b4c00a692c9849de62de97e29c"  
[X Link](https://x.com/zachxbt/status/1978465746142589232) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 37.2K engagements


"6/ The stolen funds flowed to more instant exchanges from 0x87d8 on June X and the rest was consolidated to 0x1d7 on June XX. 0x1d7 bridged 1054 ETH to Avalanche and back again to Ethereum via Synapse on June XX. 0x4fbc6c00fa1ef99561e1d977ee6c678a54cfb06f"  
[X Link](https://x.com/zachxbt/status/1978465762026352784) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 26.8K engagements


"7/ 0x1d7 purchased X X Killer GF NFTs for XXXXXX ETH on June XX at 6:29 pm UTC from 0x0bc7 a newly funded wallet via instant exchange X that purchased XX KGF NFTs for XXXXX ETH total on June XX at 5:58 pm UTC. The floor price averaged XXXXX ETH per NFT meaning 0x1d7 suspiciously overpaid from 0x0bc7 by many multiples"  
[X Link](https://x.com/zachxbt/status/1978465777335595214) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 24.7K engagements


"8/ 0x5e9c purchased XX X Killer GF NFTs for XXXX ETH total on June XX at 6:35 pm UTC. 0x5e9c sold XX NFTs to 0x0bc7 for XXXX ETH using funds washed from theft address 0x1d7. The diagram below highlights how all three addresses involved interact with each other"  
[X Link](https://x.com/zachxbt/status/1978465794414805412) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 24.7K engagements


"12/ It's extremely rare to see exploits/hacks involve NFT wash trading and I think the relationship between each address is just too coincidental given how they were funded prior to NFT purchases and traded multiple above the floor price for the collection. Hopefully law enforcement eventually moves forward with a criminal case in the future. Another piece of evidence is the overlap in instant exchanges used by the attacker and also tied to the suspects which I did not dive into as much since this post was getting quite long"  
[X Link](https://x.com/zachxbt/status/1978465874572128486) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 54.2K engagements


"I just reviewed the frozen addresses on Tron with @bax1337 and its several hops onchain from ponzi investment scams like BETL Pegasus Ride LSSC. The Riverstone shell company from HK frequently chainhops back & forth from Tron Polygon Ethereum via Bridgers. Theres no way you accidentally associate $44.7M with tainted addresses onchain. Its unfortunate weve reached the point where organized crime is bold enough to fight freezes via sketchy lawyers due to antiquated laws"  
[X Link](https://x.com/zachxbt/status/1978502076729852428) [@zachxbt](/creator/x/zachxbt) 2025-10-15T16:43Z 918.1K followers, 14.9K engagements


"@degrekt Hopefully Tether fights it / law enforcement pursues further My only concern is the shell company possibly does OTC via Black U so it comes from many dirty sources and is more difficult to attribute"  
[X Link](https://x.com/zachxbt/status/1978504925299523865) [@zachxbt](/creator/x/zachxbt) 2025-10-15T16:55Z 918.1K followers, 1600 engagements


"No let me explain the analysis as if you were X iq: The Bittensor hacker deposited $4.9M of three assets to a privacy protocol Almost immediately after $4.9M of the three same assets was withdrawn from the privacy protocol to an address thats tied onchain to a former OTF (Bittensor) employee You do not think thats highly suspicious What i publish is just the portion i can make public as certain other aspects are better to share with law enforcement"  
[X Link](https://x.com/zachxbt/status/1978720926142218658) [@zachxbt](/creator/x/zachxbt) 2025-10-16T07:13Z 918.1K followers, 10.6K engagements


"@sandyzkp report about privacy collects your data to read it"  
[X Link](https://x.com/zachxbt/status/1979168887632429472) [@zachxbt](/creator/x/zachxbt) 2025-10-17T12:53Z 918.1K followers, 69.3K engagements


"@cz_binance @0xQingWu careful CZ this X account is a scammer theyve changed their username many times (X user ID: 1619319140438921216)"  
[X Link](https://x.com/zachxbt/status/1979192044296741023) [@zachxbt](/creator/x/zachxbt) 2025-10-17T14:25Z 918.2K followers, 274.3K engagements


"@dkerrincendia @DCryptoTiger No I simply dislike all MLM cult chains like Ripple Cardano Pulsechain/Hex Hedera etc"  
[X Link](https://x.com/zachxbt/status/1979529840307863965) [@zachxbt](/creator/x/zachxbt) 2025-10-18T12:47Z 918.2K followers, 28K engagements


"1/ An investigation into how Greavys (Malone Iam) Wiz (Veer Chetal) and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack and my efforts which have helped lead to multiple arrests and millions frozen"  
[X Link](https://x.com/zachxbt/status/1836752923830702392) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:03Z 918.1K followers, 12.1M engagements


"Pleased to share I'll be working with @MattHuang @Paradigm as an incident response advisor to assist their portfolio companies. It was an easy decision as this gives me the freedom to continue helping the community and publishing investigations like. Ive always respected how Paradigm has given back to the space by funding intiatives such as Security Alliance publishing open source research and helping defend the right to privacy"  
[X Link](https://x.com/zachxbt/status/1894772701639721409) [@zachxbt](/creator/x/zachxbt) 2025-02-26T15:33Z 918.1K followers, 767.7K engagements


"You are supposedly a MEXC exec. Its been X weeks since you publicly acknowledged his posts and multiple months since it was frozen / publicized. Unfreezing an account is the push of a single button. The users whitelisted address was funded via Coinbase and likely not illicit funds. I do not believe the MEXC compliance email excuses as MEXC is known to be uncooperative and rarely is proactive with blocking actual illicit funds and seems to only freeze legitimate profitable user accounts like a bucket shop which gets highlighted by user complaints on CT"  
[X Link](https://x.com/zachxbt/status/1976658410562052590) [@zachxbt](/creator/x/zachxbt) 2025-10-10T14:37Z 918.1K followers, 30K engagements


"@CodeXBT Either them or another entity who transferred them the BTC"  
[X Link](https://x.com/zachxbt/status/1978127845894324479) [@zachxbt](/creator/x/zachxbt) 2025-10-14T15:56Z 918.1K followers, 14.8K engagements


"4/ Theft consolidation 0x09f deposited $4.94M to Railgun a privacy protocol in June 2024. XXXXXXX ETH total was deposited via 0x601 from June 8-9. XXXXXXX ETH 277.2K USDC XXXXX WETH total was deposited via 0xf5ff on June XX & XX. 0x09f76d4fc3bce5bf28543f45c4cee9999e0a0aaf"  
[X Link](https://x.com/zachxbt/status/1978465726957789431) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 28.7K engagements


"11/ Earlier this year a civil lawsuit was filed against multiple suspects based on these findings. An interesting bit taken from the defendants statements is highlighted below where Rusty (Ayden B) admits ownership of several wallets I identified though denies involvement. 0xJones (Jon L) another alleged suspect previously applied for a role at OTF as friends with Rusty and deleted messages from the Bittensor Discord and deactivated his X account after the incident"  
[X Link](https://x.com/zachxbt/status/1978465858604453944) [@zachxbt](/creator/x/zachxbt) 2025-10-15T14:19Z 918.1K followers, 57.9K engagements


"@cecilia_hsueh Meanwhile MEXC listings:"  
[X Link](https://x.com/zachxbt/status/1978543499185164429) [@zachxbt](/creator/x/zachxbt) 2025-10-15T19:28Z 918.1K followers, 92.3K engagements


"@binji_x Immediately blocking AI slop merchants in my replies with zero hesitation (Ka1to Y@ps W@llChain L@yer3 etc farmers). People do not dislike all accounts spamming replies enough on CT"  
[X Link](https://x.com/zachxbt/status/1978774481695834505) [@zachxbt](/creator/x/zachxbt) 2025-10-16T10:46Z 918.1K followers, 39.7K engagements


"@CDangerr @binji_x Heres my starter kit to mute them"  
[X Link](https://x.com/zachxbt/status/1978775601419825390) [@zachxbt](/creator/x/zachxbt) 2025-10-16T10:50Z 918.1K followers, 6878 engagements


"@DCryptoTiger Hello I have stated several times I will not assist Ripple community members. While losing funds is unfortunate its in no way my responsibility and important to educate yourself so you do not fall victim to these basic scams"  
[X Link](https://x.com/zachxbt/status/1979527113763164589) [@zachxbt](/creator/x/zachxbt) 2025-10-18T12:36Z 918.1K followers, 135.7K engagements


"1/ A video went viral on YT this week after a US based victim lost $3.05M (1.2M XRP) from their Ellipal wallet. Heres the tracing of where the stolen funds ended up and the biggest takeaways for similar thefts"  
[X Link](https://x.com/zachxbt/status/1979899767212699910) [@zachxbt](/creator/x/zachxbt) 2025-10-19T13:17Z 918.2K followers, 68.9K engagements


"3/ Here is a private video recording showing the live reaction by multiple of the threat actors to receiving $238M. Theft txn hash 4064 BTC - Aug XX at 4:05 am UTC 4b277ba298830ea538086114803b9487558bb093b5083e383e94db687fbe9090"  
[X Link](https://x.com/zachxbt/status/1836753185718865979) [@zachxbt](/creator/x/zachxbt) 2024-09-19T13:04Z 918.1K followers, 1.3M engagements


"1/ An investigation into how @cryptobeastreal scammed followers by lying they were not behind the $190M - $3M $ALT market cap crash where 45+ connected insider wallets sold $11M+ on July XX 2025"  
[X Link](https://x.com/zachxbt/status/1947641028720398488) [@zachxbt](/creator/x/zachxbt) 2025-07-22T12:53Z 918.1K followers, 1.3M engagements


"On Aug XX 2025 a victim fell for a social engineering scam and lost XXX BTC ($91M) after exchange and hardware wallet customer support were impersonated. The stolen funds began to peel off and deposits to Wasabi were made by the threat actor. Coincidentally this theft happened on the one year anniversary of the $243M Genesis Creditor theft. Theft txn hash da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457 Theft address bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej"  
[X Link](https://x.com/zachxbt/status/1958583129356345414) [@zachxbt](/creator/x/zachxbt) 2025-08-21T17:33Z 918.1K followers, 693K engagements


"7/ The XRP victim mentioned in a later video how they could not quickly get in touch with US law enforcement for a $3M theft. Theres few LE qualified to handle such cases and endless victim reports so naturally incidents are overlooked. In general US Netherlands Singapore France etc have been better jurisdictions for victims to work with from my experience though it ultimately depends who is assigned to the case. It becomes much more unreliable in other jurisdictions and it is extremely costly to go the civil route"  
[X Link](https://x.com/zachxbt/status/1979899785617305779) [@zachxbt](/creator/x/zachxbt) 2025-10-19T13:17Z 918.1K followers, 9242 engagements