Latest posts
Investigations by ZachXBT
8 Nov, 11:05
NEW: The US Treasury sanctioned eight Canadian OTCs on Friday (Nov 6), including Nia Nations (NNCE) & Million Exchange (MillionEX), five months after I replied to them on X suggesting they sanction the Iranian OTC brokers in Canada being abused by illicit actors.As I've stated before, Canada is a bottom-three jurisdiction globally with rampant abuse due to ineffective laws.Investigations by ZachXBT
4 Nov, 02:24edited
Update: I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident. A portion of the CEX withdrawals occurred after my initial disclosure. My working theory is a large financial institution inInvestigations by ZachXBT
3 Nov, 07:31edited
Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor. Over the past 24 hours the illicit actor has been aggressivelyInvestigations by ZachXBT
2 Nov, 12:28edited
Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor.Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.Theft addresses: 0xADd95cD98E0288ba69785E3151E1db86adF8Dd58 0x29e9D7715D935e0D0D4B0DD0efC952A97E551020 0x378B4f150707C283574DC89739608D29036D57d5 0x795a9d22F233024487161Fe6daFf73397c162621 0x730Bcb1296758c377149d7409f98f041cf723992 0x12D9012731eb0D54871A31Af5566Eb9ECCa351Db 0x5A154f77852ed274Fd6F4c324a1Ee27809052FF7 0xA1096A66f9ed58A9594A6A1ad67A5472C0907224 0x90F0b6D51ed2FE2348A45b2C49BC441E959bc557 0x8A97BC406180e28b11C5495fA099BF5119c6C6B0 0xd010cba790a6ab0048da18f2fbe8e3faf463a16aInvestigations by ZachXBT
30 Oct, 00:15edited
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.Exploiter address 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5Trsanction hash: 0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb6 0x410af166c81f9c0f26cc19b4d970c984f526225eeea2aea169179856fd615f70Investigations by ZachXBT
29 Oct, 12:17edited
Community Alert: Axis Robotics (AXIS) insiders received 76M+ AXIS ($12M+) from a Axis Team multisig and began market selling via DEX and transferring AXIS to Bitget causing the price to crash 40% over the past 24 hours.The AXIS token went live on October 21, 2026.A single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base: 0xcc279c2499bcf4bd0f169c2d3f333243473242f7 0x66612012c5ad9b2fed81d09a9ab429b5285b2c62 0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0 0x99cd3975c90b79ffdbe16425de033a605b814c49 0xbbed67fec9c7793218fa60c40fb9e6b059d86483 0xe69d8d6b9b7f9056eda455b76384e9748749f4d1 0x4ef72e67e6a7c37ea1378fe2adf811d711422e5dInvestigations by ZachXBT
21 Oct, 07:26edited
An institutional entity lost ~$2.3M (973K MORPHO) a few hours ago from two addresses and the funds were deposited to Tornado Cash: 0x4943b0c9959dcf58871a799dfb71bece0d97c9f4 0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4On Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges stolen, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool: 0x24a9e00be5f169142c4f0797b41dacdf807d3e63Both thefts from 0x4943 & 0x10bf involve EIP-7702 delegation transactions.0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which reportedly lost eight figures due to a private key compromise in Sep 2023, after which the family office allegedly exited crypto.Investigations by ZachXBT
21 Oct, 05:45edited
An institutional entity is suspected to have lost ~$2.84M to DPRK-linked SquidSquad on October 8, 2026 on BSC.Yesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses.Tornado withdrawal addresses: 0xb8b25f535a6e51d0b18c48941d791c7e83559d2b 0x35c72e26f6888b4cba8668c6cfa4143599680bfe 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848From there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at: TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU TVxzjnx3GPDTciiuagXPaUbU5f5y13VouxBoth consolidation addresses have exposure to previously attributed DPRK addresses.Within minutes, the funds moved through intermediary addresses to Chinese OTCs, likely to evade any potential Tether freeze.Victim address: 0x579be84d2a0f7bcfc34b4b3883153adec84ff153 Theft address: 0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80Investigations by ZachXBT
12 Sept, 06:29
Community alert: Revolut appears to have exposed personally identifiable information (PII) for a subset of users due to failing to detect a fraudulent government request.Exposed data included: -Copy of passport and/or driver's licence, plus the verification selfie -Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin -Full name, date of birth, occupation -Home address, email, phone numberWhile the incident is likely limited in size it seems to have been targeted at high net worth users.An email alerting users was sent out to multiple Revolut users yesterday.Investigations by ZachXBT
6 Sept, 13:59
Community Alert: Multiple verified WooX users have reported withdrawals stuck in pending or processing over the past three days.WooX was incubated by Kronos Research, and in Q4 2025 it was acquired by FusionX Digital, a firm which allegedly has ties to BitMart founder Sheldon Xia.On July 26, 2026, BitMart announced it would cease operations and restructure. Its users have been left without access to millions in stuck funds, with complaints increasing on X. Sheldon Xia has published only vague statements claiming user assets are safe, and those claims still have not been independently verified.As of this post, WooX has not yet issued a statement.Investigations by ZachXBT
24 Aug, 14:18
Community Alert: I've reviewed evidence that two US based investment platforms: BitcoinIRA & iTrustCapital allegedly had data breaches this year but appear to have not disclosed the incidents publicly.Leaked info: Personal details, Portfolio holdings, Banking details, Custodian details, Verification status, etcExample: Threat actor ‘Tiffany’ targeted a BitcoinIRA user and stole $1.2M+ using the db in June 2026.I reached out to both companies for comment on August 21 but have not heard back yet.Investigations by ZachXBT
22 Aug, 11:48edited
Bottom 5 jurisdictions globally for victims ranked in order:🥇 Canada 🥈 UK 🥉 India 4). Nigeria 5). Morocco, Algeria, or Bangladesh(If you contact me from any of these countries I will likely automatically decline the case)Investigations by ZachXBT
26 Jul, 15:36edited
Telegram keeps allowing scam ads to be displayed in my channel to subscribers.If you are a premium user please consider using boosts for my channel https://t.me/boost/investigations so I can unlock the feature to disable ads (need to hit level 50).Investigations by ZachXBT
20 Jul, 14:35
It appears the bridge TeleSwap had a $735K+ exploit on July 15, 2026 and still has not disclosed the incident publicly after five days.Shortly after the suspicious outflows its Bitcoin hot wallet stopped processing transactions. Two hours ago the attacker deposited the funds to Tornado.Theft addresses bc1pz95zv3qhpmt52yezs84a5zrddrk5jsxm8a60rln5kzlk06e87a3q8pf79l 0x2448cbaee50a67030692b7519a954e5550dc2718 0xfc5048fbba2f74ed482ffcd7663601f818c5bb47 0xf8706a51f8df01a71f408e50c901dd14916a12c7TeleSwap Bitcoin hot wallet bc1q5wnpn4k99wc587maaaa6eqnx27g4r6mduxg2s5Investigations by ZachXBT
15 Jul, 21:53edited
Hot take: All hardware wallets are complete garbage and l do not advise using them for important tasks like signing transactions or storing funds.Much better to have a separate iPhone with its only purpose being to use as your hardware wallet.Ledger is the worst and Ledger Live has regular updates for UI / apps for no good reason that break simple actions.(Only do this if you are not low iq)Investigations by ZachXBT
12 Jul, 05:09edited
An entity previously received ESPORTS, RIVER, & LIGHT tokens via Sablier vesting contract and is also directly tied to a signer on three LAB multisigs. These four BSC tokens have experienced market manipulation incidents on centralized exchanges. I peviouslyInvestigations by ZachXBT
10 Jul, 13:13edited
An early Solana whale tied to the initial Genesis block distribution appears to have likely had 180.9K SOL ($14.2M) stolen a few hours ago.I began reviewing the irregular unstaking and bridging activity from Solana to Ethereum with @specterinvestigation who first spotted these movements.Victim HwtbQBNnLERakdUDuCCLWmUs2oETLFQZeHUWeQdPadsTheft address Ffd1oB2aYM5UzMYUM7TmxULDRQb6KzgrBwmgj9U1C2bE 653pnn5fzF51FfotBwxua55Es4QXxTdaXJLbPczVmswp 0xaa5cfa4e96dda0f9aa30f4dc948b542a9b5817c6 0x536b4ee7507c41143e1b0bd1bf3f2b84be404836 0xbf11bdfbeb9ed137c352c81e45d191cacae6b0cfInvestigations by ZachXBT
8 Jul, 12:32edited
Update: AscendEX has not posted on X (Twitter) for 9 days since my post and user withdrawals are still not being processed while deposits are being accepted. I reviewed a case where a large victim has been getting no response from the AscendEX co-founderInvestigations by ZachXBT
6 Jul, 10:14
Over the past week multiple people created ZACHXBT meme coins on various chains using my likeness to take advantage of the recent narrative.None of the tokens were promoted by myself as I have always stated I will never support or launch a meme coin.All tokens sent to my donation wallet were market sold and the entire amount was sent to charity.~$41K total was donated to Direct Relief & Give Directly via The Giving Block to support the Venezuela earthquake response.Transaction reciepts:1). 25K USDT sent to Give Directly on July 6, 2026 at 4:16 am UTC 0x687556d7011b0750f3daf9e3a9f800d04ba233c84362faf8c3851b40cd0f71ae2). 5k USDT sent to Direct Relief on July 6, 2026 at 4:51 am UTC 0xc9146816d5c0d97b432d663b422b46854ba6e047ce7e9ea8073d43c1205ba0703). 153 SOL ($11K) total sent to Direct Relief on June 28, 2026 44idg3MiJiprAnqBbt5fZM9K4deDzZdqnJ3dPtS6hFLqQk3omvqWz7LjgCapMX94q7BaInvestigations by ZachXBT
5 Jul, 08:57edited
Community alert: KuCoin has sent legal threats to a victim whose stolen funds were laundered via KuCoin accounts with purchased mule KYC. The case involves a $250K Atomic stealer theft from August 18, 2025 where the stolen funds were transferred to multiple
Links
A feedback bot for your channel — free
Followers write to the bot, you answer by reply, your account stays hidden. Created in one tap.
How it works →Related Channels
Other channels in the same section of the catalogue.
