Investigations by ZachXBT
Reports, news, & insights shared by ZachXBT
Donation address
EVM
0x9D727911B54C455B0071A7B682FcF4Bc444B5596
SOL
investigations.sol
Donation address
EVM
0x9D727911B54C455B0071A7B682FcF4Bc444B5596
SOL
investigations.sol
TGlist rating
0
0
TypePublic
Verification
Not verifiedTrust
Not trustedLocation
LanguageOther
Channel creation dateJun 27, 2023
Added to TGlist
Oct 17, 2024Latest posts in group "Investigations by ZachXBT"
30.03.202509:27
If you make either of these decisions it is your own personal choice to risk funds and I will NOT help you:
1). Deposit funds in a forked DeFi protocol on a new EVM chain that later gets exploited (team did not write original code; low amount of technical skills required)
2). Get rugged by a project with very few Kaito smart followers (at least do the bare minimum due diligence to not fall victim to fake followers or meaningless buzzwords)
1). Deposit funds in a forked DeFi protocol on a new EVM chain that later gets exploited (team did not write original code; low amount of technical skills required)
2). Get rugged by a project with very few Kaito smart followers (at least do the bare minimum due diligence to not fall victim to fake followers or meaningless buzzwords)
28.03.202512:58
It is suspected a Coinbase user was scammed yesterday for $34.9M (400.099 BTC).
Theft address
bc1qvlustvxhqzee9tgqers4tfungrg6c0fs4u76jf
After uncovering this theft I noticed multiple other suspected thefts from Coinbase users in the past two weeks bringing the total stolen this month to $46M+. Funds from each theft were bridged from Bitcoin to Ethereum via Thorchain / Chainfllip and swapped for DAI.
60.164 BTC - Mar 26
bc1qhc72zfqwqh3e6lns5ay084k29tmqlgw75jsxec
46.147 BTC - Mar 25
bc1qd6v3220v49j0xgmycksze59z90gru46dlxg8ff
20.028 BTC - Mar 16
bc1qd59e296yyr8x4gyr53xt4yjmmgukwemetalcuf
Coinbase has not flagged any of the theft addresses from these victims in compliance tools.
Last month I posted an investigation on X about how $65M was stolen from Coinbase users in December 2024 - January 2025 and talked about how Coinbase has quietly been facing a $300M / yr social engineering scam problem affecting its users.
Theft address
bc1qvlustvxhqzee9tgqers4tfungrg6c0fs4u76jf
After uncovering this theft I noticed multiple other suspected thefts from Coinbase users in the past two weeks bringing the total stolen this month to $46M+. Funds from each theft were bridged from Bitcoin to Ethereum via Thorchain / Chainfllip and swapped for DAI.
60.164 BTC - Mar 26
bc1qhc72zfqwqh3e6lns5ay084k29tmqlgw75jsxec
46.147 BTC - Mar 25
bc1qd6v3220v49j0xgmycksze59z90gru46dlxg8ff
20.028 BTC - Mar 16
bc1qd59e296yyr8x4gyr53xt4yjmmgukwemetalcuf
Coinbase has not flagged any of the theft addresses from these victims in compliance tools.
Last month I posted an investigation on X about how $65M was stolen from Coinbase users in December 2024 - January 2025 and talked about how Coinbase has quietly been facing a $300M / yr social engineering scam problem affecting its users.
27.03.202512:56
Community Alert: As Token 2049 approaches be careful of sponsors as little due diligence is done on them for conferences (just because someone is a title or platinum sponsor does not mean they are credible)
Title sponsor
-Spacecoin (botted project)
Platinum sponsor
-Bitunix (sketchy exchange)
-JuCoin (sketchy exchange)
-WEEX (sketchy exchange)
-DWF (sketchy market maker)
Note: These are the only teams I have on my radar and I suspect more would make the list
One of the easiest due diligence hacks for a centralized exchange is to verify if the team is public and has prior work history in the space. Bitunix, JuCoin, & WEEX all fail this test.
Example: In late 2023 a sketchy exchange JPEX was a Platinum sponsor for Token 2049 and the team was flagged by Hong Kong government during the conference for "suspicous features" and was later arrested after 1400 reports by victims to law enforcement and $100M+ was suspected stolen.
Title sponsor
-Spacecoin (botted project)
Platinum sponsor
-Bitunix (sketchy exchange)
-JuCoin (sketchy exchange)
-WEEX (sketchy exchange)
-DWF (sketchy market maker)
Note: These are the only teams I have on my radar and I suspect more would make the list
One of the easiest due diligence hacks for a centralized exchange is to verify if the team is public and has prior work history in the space. Bitunix, JuCoin, & WEEX all fail this test.
Example: In late 2023 a sketchy exchange JPEX was a Platinum sponsor for Token 2049 and the team was flagged by Hong Kong government during the conference for "suspicous features" and was later arrested after 1400 reports by victims to law enforcement and $100M+ was suspected stolen.
26.03.202521:11
Five addresses linked to the entity who manipulated JELLY on Hyperliquid still hold ~10% of the JELLY supply on Solana ($1.9M+). All JELLY was purchased since March 22, 2025.
Hc8gNSMaQiahiRiGjUfTaW8AXudRJHeGoeGpAn8WRcwq
GffAXdcDqi8gTXEsNBMyck3DMPkaJRY1Ng2chdSRFUDC
DWr1VNg6Lsn2sANVhtWVSHMgJTNU5W4kGutDP3KyBZgA
6Ld2XDxwXcwJ4bjayeP2TAY1MepTP1zEdBVsDo3Nzmoo
G2WrQENBmsKJciQCrxce5NbWw6sEGgQMjJrFXH7MYTsv
This entity sold JELLY in the last hour from two addresses
Gm35VHcLqnpow5PCHeLMvG2krJ2deGANKfc2xAuQmept
CWvCD7EfuMu3QMTPtFb4rCF663HsD35GuW5G1xjSuaHD
Hc8gNSMaQiahiRiGjUfTaW8AXudRJHeGoeGpAn8WRcwq
GffAXdcDqi8gTXEsNBMyck3DMPkaJRY1Ng2chdSRFUDC
DWr1VNg6Lsn2sANVhtWVSHMgJTNU5W4kGutDP3KyBZgA
6Ld2XDxwXcwJ4bjayeP2TAY1MepTP1zEdBVsDo3Nzmoo
G2WrQENBmsKJciQCrxce5NbWw6sEGgQMjJrFXH7MYTsv
This entity sold JELLY in the last hour from two addresses
Gm35VHcLqnpow5PCHeLMvG2krJ2deGANKfc2xAuQmept
CWvCD7EfuMu3QMTPtFb4rCF663HsD35GuW5G1xjSuaHD
25.03.202517:04
Update: Veer Chetal (Wiz) was arrested likely as part of his involvement in the $243M Genesis creditor theft.
Here’s the mug shot:
Here’s the mug shot:
25.03.202508:27
I regularly have people ask me about tools I use in my investigations so here’s a comprehensive list:
Cielo - Wallet Tracking (EVM, Bitcoin, Solana, Tron, etc)
TRM - Create graphs for addresses/transactions
MetaSuites - Chrome extension that adds additional data on block explorers
OSINT Industries - email/username/phone lookups
LeakPeek - db lookups
Snusbase - db lookups
Intelx - db lookups
Spur - IP lookups
Cavalier (Hudson Rock) - Infostealer lookups
Impersonator - Chrome extension to spoof login to dApps
MetaSleuth - Similiar to TRM but intended for retail users
Arkham - Multichain block explorer, entity labels, create graphs, alerts
Obsidian - Create flow charts / diagrams
Wayback Machine - archive web pages
Archive Today - archive web pages
Etherscan/Solscan - block explorer for EVM / Solana
Blockchair - bitcoin block explorer
Range - CCTP bridge explorer
Pulsy - bridge explorer aggregator
Socketscan - EVM bridge explorer
Dune - Analytics platform to query blockchain data
Mugetsu - X/Twitter username history & meme coin lookups
TelegramDB Search Bot - Basic Telegram OSINT
Discord[.]ID - Basic Discord account info
CryptoTaxCalculator -Track PNL for an address
Note: I am not paid by these platforms to mention them and do not have referral links to share
Cielo - Wallet Tracking (EVM, Bitcoin, Solana, Tron, etc)
TRM - Create graphs for addresses/transactions
MetaSuites - Chrome extension that adds additional data on block explorers
OSINT Industries - email/username/phone lookups
LeakPeek - db lookups
Snusbase - db lookups
Intelx - db lookups
Spur - IP lookups
Cavalier (Hudson Rock) - Infostealer lookups
Impersonator - Chrome extension to spoof login to dApps
MetaSleuth - Similiar to TRM but intended for retail users
Arkham - Multichain block explorer, entity labels, create graphs, alerts
Obsidian - Create flow charts / diagrams
Wayback Machine - archive web pages
Archive Today - archive web pages
Etherscan/Solscan - block explorer for EVM / Solana
Blockchair - bitcoin block explorer
Range - CCTP bridge explorer
Pulsy - bridge explorer aggregator
Socketscan - EVM bridge explorer
Dune - Analytics platform to query blockchain data
Mugetsu - X/Twitter username history & meme coin lookups
TelegramDB Search Bot - Basic Telegram OSINT
Discord[.]ID - Basic Discord account info
CryptoTaxCalculator -Track PNL for an address
Note: I am not paid by these platforms to mention them and do not have referral links to share
23.03.202511:24
Please stop trying to invite me as a speaker for conferences, podcasts, or interviews as the answer will be no.
Majority of the time they are only beneficial if you have something new to promote or can get exposure to a different audience.
You should always be skeptical of the projects who spend more time attending conferences or making podcast appearances rather than actually building their products
Majority of the time they are only beneficial if you have something new to promote or can get exposure to a different audience.
You should always be skeptical of the projects who spend more time attending conferences or making podcast appearances rather than actually building their products
18.03.202510:33
Spending long hours helping freeze funds for the Bybit hack has been eye opening.
This industry is unbelievably cooked when it comes to exploits/hacks and sadly idk if the industry is going to fix this itself unless the government forcibly passes regulations that hurt our entire industry.
Several “decentralized” protocols have recently had nearly 100% of their monthly volume/fees derived from DPRK and refuse to take any accountability.
Centralized exchanges end up being worse as when illicit funds flow through them a few take multiple hours to respond when it only takes minutes to launder.
KYT is completely flawed and easily evadable
KYC is just a honeypot for regular users bc of breaches/insiders and is useless in majority of cases due to purchased accounts.
DPRK laundering $1.4B from the recent hack has only exposed how broken it is.
This industry is unbelievably cooked when it comes to exploits/hacks and sadly idk if the industry is going to fix this itself unless the government forcibly passes regulations that hurt our entire industry.
Several “decentralized” protocols have recently had nearly 100% of their monthly volume/fees derived from DPRK and refuse to take any accountability.
Centralized exchanges end up being worse as when illicit funds flow through them a few take multiple hours to respond when it only takes minutes to launder.
KYT is completely flawed and easily evadable
KYC is just a honeypot for regular users bc of breaches/insiders and is useless in majority of cases due to purchased accounts.
DPRK laundering $1.4B from the recent hack has only exposed how broken it is.
14.03.202516:37
A high confidence Tornado Cash demix for the theft reveals funds from the DPRK hack purchased 437.6B PEPE ($3.1M) on March 11, 2025 after ETH was withdrawn from Tornado Cash
0x7A7DDa0eBFF13eB014F763D05e7784B36418022F
Edit: A closer analysis reveals DPRK got rugged by using a compromised Tornado Cash UI.
Three other instances of TC withdrawals that purchased PEPE which. One of them comes from a known TC UI theft.
0x5d3a17a828aeb89729299ba5dd72200295b00df0
0x921213AB8cB18E0487B41DfFf18E39836FD19f04
0x77793F723A5538972A566D701cc7FBd32770CC96
For the $3.1M DPRK theft the TC the amounts deposited was very unique (96 X 10 ETH, 4 X 100 ETH, etc) with matching withdrawals happening minutes after the deposits.
0x7A7DDa0eBFF13eB014F763D05e7784B36418022F
Edit: A closer analysis reveals DPRK got rugged by using a compromised Tornado Cash UI.
Three other instances of TC withdrawals that purchased PEPE which. One of them comes from a known TC UI theft.
0x5d3a17a828aeb89729299ba5dd72200295b00df0
0x921213AB8cB18E0487B41DfFf18E39836FD19f04
0x77793F723A5538972A566D701cc7FBd32770CC96
For the $3.1M DPRK theft the TC the amounts deposited was very unique (96 X 10 ETH, 4 X 100 ETH, etc) with matching withdrawals happening minutes after the deposits.
07.03.202514:54
A forfeiture complaint filed yesterday by US law enforcement revealed the cause for the ~$150M (283M XRP) hack of Ripple co-founder, Chris Larsen's wallet in Jan 2024 was the result of storing private keys in LastPass (password manager which was hacked in 2022).
Up to this point Chris Larsen had not publicly disclosed the cause of the theft.
Up to this point Chris Larsen had not publicly disclosed the cause of the theft.
03.03.202508:55
With the announcement of the US Crypto Reserve here's your reminder that XRP addresses activated by Chris Larsen (co-founder of Ripple) still hold 2.7B+ XRP ($7.18B) and these addresses tied to him transferred $109M+ worth of XRP to exchanges in January 2025.
2.7B XRP address list from dormant addresses activated by Chris Larsen (rB5TihdPbKgMrkFqrqUC3yLdE8hhv4BdeY)
rPoJNiCk7XSFLR28nH2hAbkYqjtMC3hK2k
rD6tdgGHG7hwGTA6P39aE7W89fbqxXRjzk
rDfrrrBJZshSQDvfT2kmL9oUBdish52unH
r476293LUcDqtjiSGJ5Dh44J1xBCDWeX3
r44CNwMWyJf4MEA1eHVMLPTkZ1LSv4Bzrv
rhREXVHV938ToGkdJQ9NCYEY4x8kSEtjna
(disclaimer: multiple of these addresses have been dormant for 6-7 yrs so it's possible he lost access or sent funds to other people in Feb 2013. He was also hacked for $112M early last year)
2.7B XRP address list from dormant addresses activated by Chris Larsen (rB5TihdPbKgMrkFqrqUC3yLdE8hhv4BdeY)
rPoJNiCk7XSFLR28nH2hAbkYqjtMC3hK2k
rD6tdgGHG7hwGTA6P39aE7W89fbqxXRjzk
rDfrrrBJZshSQDvfT2kmL9oUBdish52unH
r476293LUcDqtjiSGJ5Dh44J1xBCDWeX3
r44CNwMWyJf4MEA1eHVMLPTkZ1LSv4Bzrv
rhREXVHV938ToGkdJQ9NCYEY4x8kSEtjna
(disclaimer: multiple of these addresses have been dormant for 6-7 yrs so it's possible he lost access or sent funds to other people in Feb 2013. He was also hacked for $112M early last year)
01.03.202511:54
An unknown victim is suspected of being hacked by Lazarus Group on Tron for ~$3.1M on Feb 28, 2025.
Theft addresses
TYQ3455gFNeqyw3sqdcWuiARq4UTMqk4D4
0xcced1276382f4dd0a6d0e73b07f43294733981ae
The funds were bridged from Tron to Ethereum and ETH was split between ten addresses before it was deposited to Tornado Cash (96 X 10 ETH, 4 X 100 ETH, 78 X 1 ETH, 5 X 0.1 ETH)
The attacker however reused a theft address from the Fantom exec hack in October 2023 which had been previously attributed to Lazarus Group as part of a spearphishing campaign in a March 2024 report published by the UN.
Theft addresses
TYQ3455gFNeqyw3sqdcWuiARq4UTMqk4D4
0xcced1276382f4dd0a6d0e73b07f43294733981ae
The funds were bridged from Tron to Ethereum and ETH was split between ten addresses before it was deposited to Tornado Cash (96 X 10 ETH, 4 X 100 ETH, 78 X 1 ETH, 5 X 0.1 ETH)
The attacker however reused a theft address from the Fantom exec hack in October 2023 which had been previously attributed to Lazarus Group as part of a spearphishing campaign in a March 2024 report published by the UN.
01.03.202511:54
28.02.202520:41
Fun fact: For some reason DPRK launderers like gooning while they launder funds.
>See TG account ask for help in TG group for a service due to delays
>They share txn hash revealing they are laundering from DPRK hack
>Perform OSINT on that TG account
>Realize they are in Chinese NSFW / adult TG groups
This exact scenario has happened many times
>See TG account ask for help in TG group for a service due to delays
>They share txn hash revealing they are laundering from DPRK hack
>Perform OSINT on that TG account
>Realize they are in Chinese NSFW / adult TG groups
This exact scenario has happened many times
26.02.202516:19
Notably for these attacks it is likely not the fault of either the Pump Fun or Jupiter teams.
I suspect a threat actor is social engineering employees at X with fraudulent documents / emails or a panel is being exploited.
I suspect a threat actor is social engineering employees at X with fraudulent documents / emails or a panel is being exploited.
Records
22.04.202500:26
75KSubscribers28.02.202523:59
5100Citation index21.02.202516:00
74.6KAverage views per post31.01.202523:59
12.6KAverage views per ad post26.03.202513:52
12.51%ER21.02.202516:00
137.28%ERR25.03.202517:04
Update: Veer Chetal (Wiz) was arrested likely as part of his involvement in the $243M Genesis creditor theft.
Here’s the mug shot:
Here’s the mug shot:
Log in to unlock more functionality.
