zachxbt

ZachXBT just linked North Korea-linked SquidSquad to $2.84 million stolen from an unnamed institutional wallet on BNB Chain on October 8.

The onchain trail is fresh: on October 20 the attacker pushed 1,111.2 $ETH through Tornado Cash, split it across three Ethereum addresses, then bridged to Tron via USDT0 and consolidated into two wallets. Both Tron wallets have exposure to addresses previously tied to North Korean operations. Minutes later the funds landed at addresses attributed to Chinese OTC dealers — ZachXBT reads that as a rush to cash out before Tether could freeze anything.

The attribution is onchain-only and unconfirmed; the victim is unnamed; the compromise method unknown. And there's context: the same day, wallets tied to the Drift exploit moved $61.6M through Tornado Cash — a different case, same laundering treadmill.

North Korean crews remain this industry's persistent tax. But here's the trader's question: does any of this actually move markets, or is mixer traffic now just background noise? NFA/DYOR.

#CryptoNews #Hack #NorthKorea #ZachXBT

On-chain investigator ZachXBT is sounding the alarm again ⚠️

He publicly called out CoinDCX, an Indian crypto exchange, alleging that its co-founder was involved in fraud and advising users to withdraw their funds as soon as possible.

The timeline is pretty bizarre:
🔸 The exchange initially denied that any assets had been stolen
🔸 It later disclosed that around $16 million had been stolen
🔸 On-chain data also showed user deposits flowing to undisclosed wallets

A reminder: Not your keys, not your coins.
Putting large sums on a small exchange means handing the risk over to someone else.

Would you spread your assets across several platforms?

#ZachXBT #CoinDCX #交易所安全 #On-chainData

🕵️ 15.99 million USDT transferred out. CoinDCX says “old addresses”; ZachXBT says they were “still in use in May”

Indian exchange CoinDCX has once again triggered on-chain alarm bells over the past couple of days.

According to on-chain security researcher Darcy, at 23:35 Beijing time on October 21, CoinDCX’s hot wallet and several deposit addresses transferred approximately 15.99 million USDT and 5,783.81 TRX to the same TRON address. The largest transfer was 15,819,002 USDT. Media outlets including BeInCrypto reported that the funds were subsequently split up and sent to deposit addresses at Binance, OKX, and Gate.

CoinDCX’s response: These addresses were created in January 2025 and compromised during the security incident that July. The company says it hasn’t used them since, and that users’ funds are safe. Co-founder Sumit Gupta also said the current wallets were unaffected.
(Additional context: CoinDCX lost approximately $44 million in July 2025.)

But ZachXBT isn’t convinced:
🔹 He says the deposit address TQKJQ was used for about 10 months after the incident last July
🔹 Deposits from users were still being consolidated into CoinDCX’s now-public hot wallet as recently as April and May this year
🔹 According to him, approximately $15.8 million in user deposits “was not accounted for by the team”

The two accounts don’t currently line up. I’m not taking sides and will wait for more on-chain evidence. But there are two things ordinary users should keep in mind:

First, “the address was abandoned long ago” and “the address is still receiving funds” are two different things. If an exchange abandons an address without fully disabling it on the user side, users can still send funds to it.

Second, don’t use “the address you saved last time” to make a deposit. Copy it afresh from the app every time and check the first and last few characters. It costs almost nothing to make this a habit.

When you make a deposit, do you copy the address again each time, or use a frequently used address? 👇

#CoinDCX #链上安全 #USDT #ZachXBT

ZachXBT: About 973,000 MORPHO tokens worth roughly $2.3 million were stolen from an organization, and the funds have entered Tornado Cash. A related address also lost about $3.5 million on October 9. Repeated thefts are usually not just bad luck—the access controls and custody chain haven’t been fully secured. Don’t skimp on audits for large positions. #MORPHO #安全 #ZachXBT

🕵️ On-chain detective strikes again: A “coin-swapping service” on Hyperliquid—are 87% of its funds dirty?

ZachXBT’s latest investigation called out a service called FreedomXMR.

It launched on Hyperliquid Core this August, offering centralized XMR (Monero) swaps. Sounds ordinary, but the numbers look bad:

🔹 He manually reviewed historical deposits of over $10,000 each
🔹 More than 87% of inflows were directly linked to illicit activity
🔹 Over $20 million in funds were traced to sources including ransomware, protocol hacks, malware, and social engineering scams
🔹 The reported sources of stolen funds included attacks involving DCENT wallets, Fetch.ai, and Axelar
🔹 Monero liquidity reportedly came from KuCoin

ZachXBT has already shared the data with Hyperliquid.

My take:
The upside of permissionless platforms is that anyone can join. The downside is the same: anyone can join. The blockchain itself takes no sides, but swapping into a privacy coin is often the final leg in laundering dirty money.

Interestingly, even the most privacy-focused routes can’t avoid the exchange deposit gateway—and that’s precisely the clue that makes them traceable.

For ordinary people, just remember this: a lot of that $20 million was stolen through social engineering. Don’t click unfamiliar links, and don’t approve signing requests in chats.

Do you think permissionless platforms should be responsible for the services operating on them? Or is “code innocent”? Share your thoughts in the comments 👇

#ZachXBT #Hyperliquid #链上安全 #XMR

FreedomXMR just launched on Hyperliquid, and ZachXBT traced the funds: 87% of the flow looks suspicious, linked to ransomware, exploits, and other illicit activity. Bringing stolen funds to an exchange—is the heat on-chain getting too intense, or do they want veteran crypto sleuths to catch them?

#FreedomXMR #Hyperliquid #ZachXBT

🚨 ZachXBT: Tracking Lazarus’s money through USDT on Tron

An investigation by on-chain investigator ZachXBT revealed how a group of intermediaries linked, according to his investigation, to laundering funds associated with Lazarus Group, the North Korean hacking group, used cryptocurrencies and OTC markets to move large sums of money.

🔎 What ZachXBT did

According to reports, he interacted directly with an alleged intermediary for the group, using approximately $349,700 of his own money to investigate how the operations worked.

The investigation yielded information about the people and entities involved and tracked transactions linked to funds from hacks.

💰 One related case was the February 2025 Bybit hack, one of the largest cryptocurrency thefts on record.

🧊 As a result of the information provided, Tether froze 442,000 USDT linked to the flow of funds under investigation.

⚠️ One particularly interesting detail is the use of USDT on the Tron network (TRC-20).

Tron plays a huge role in the stablecoin market and in P2P transactions, especially in Latin America. But the fact that a network is used by millions of legitimate users does not mean the network itself is connected to illicit activity.

The most important lesson:

On the blockchain, funds may appear anonymous, but transactions leave a public record. Investigators like ZachXBT can combine on-chain analysis with information gathered off-chain to reconstruct the movement of money.

💡 The blockchain does not necessarily hide money. Often, it makes it possible to track it.

#Bitcoin #USDT #TRX #ZachXBT
#BinanceSquare

🕵️ ZachXBT went undercover

He infiltrated a Chinese laundering group tied to the $1.5B Bybit hack, putting up about $350K of his own money to gain their trust.
His intel helped freeze about $75M in stolen funds.

#zachxbt #bybit #CryptoSecurity

ZachXBT says he put up $349,700 and took a 5% loss on every order to pose as a client of a Chinese laundering crew.

He says that crew has moved more than $1B for North Korea's Lazarus Group across several hacks, including the $1.5B Bybit theft in Feb 2025.

The wild part: the launderer told him a day ahead that funds would move to Solana. The next day they did.

His intel exposed a $12M+ cluster of Bybit funds hopping from Bitcoin to Ethereum to Solana to Tron. Tether later froze $442K of it.

These people weren't hiding in some dark corner. They were in public Telegram and Discord groups looking for orders.

Fair to note: the $1B figure and the crew's identity are his findings. The FBI and Treasury haven't confirmed them.

He funds this work with grants and donations. Should the exchanges he helps be paying him?

$BTC $ETH $SOL
#CryptoSecurity #Lazarus #ZachXBT
NFA. DYOR.

On-chain sleuth ZachXBT just revealed he fronted nearly $350k of his own capital to infiltrate an elite Chinese money laundering ring linked to the massive Bybit exploit. By posing as a high-net-worth client, he successfully extracted critical intelligence that ultimately led to freezing stolen user funds. This daring undercover operation highlights how decentralized investigators are taking matters into their own hands when institutional response times fall short. True on-chain heroism in action. #ZachXBT #Bybit #Security

A Crypto Detective Spent $350,000 of His Own Money to Catch Hackers

Most people who get scammed just report it and move on. ZachXBT went undercover instead.

The on-chain investigator revealed he personally fronted $349,700 to infiltrate a group of alleged Chinese money launderers connected to North Korea's Lazarus Group — the same hackers tied to the record-breaking Bybit hack earlier this year.

Think about what that actually means: this isn't a government agency with subpoena power or a company with a security budget. It's one independent researcher spending his own real money to buy his way into criminal networks laundering stolen crypto, just to gather evidence.

ZachXBT has built his entire reputation doing exactly this kind of work — tracing stolen funds through mixers, exchanges, and shell networks that professional investigators often can't touch fast enough. The Bybit hack alone moved over $1.4 billion in $ETH , making it one of the largest crypto thefts ever recorded.

What this reveals about crypto crime right now: the gap between how fast hackers move and how fast official law enforcement can respond is still wide enough that independent investigators are filling it with their own money and risk tolerance.

This is the same world where NEAR Intents got funds back through a public ultimatum, and where governments took months to formally attribute North Korea's $10.7M fake-recruiter campaign. Accountability in crypto increasingly comes from individuals, not institutions.

Does crypto need more people like ZachXBT operating independently, or should this kind of high-risk investigation be left entirely to law enforcement? 👇

#ZachXBT #Lazarus #ETH #Zyverra #CryptoSecurity

ZachXBT paid Lazarus launderers 5% of every transaction. Himself, with his own money

Since late February 2025, he played the role of a client
put 349700 $USDC
into their network

and knowingly lost 5% on every order until they began to trust him

Trust there, it turns out, costs 5%. Pay up—and they’ll tell you themselves where the stolen money goes

What came of it:
- a cluster containing over $12 million in funds from the Bybit hack
- Tether froze 442000 USDT

By his estimate, the network laundered "$1B+" for Lazarus. That’s his figure, not the police’s. He only revealed all this on October 5, 2026

Some of my stablecoins in Flexible are in USDT too, so it’s nice to see stolen USDT actually getting frozen

Laundering is a service with a fee, like an exchange. ZachXBT simply paid that fee to get inside

#zachxbt #Lazarus #bybit

🚨 $1B+ laundered for North Korea's Lazarus Group?

On-chain sleuth ZachXBT just pulled back the curtain on a Chinese organized crime network that allegedly washed over $1 billion for Lazarus 🕵️‍♂️

Hacks don't end when funds leave the exchange — the real game is the cash-out pipeline. Every exposure like this makes the next exploit harder to monetize.

Security is still the #1 narrative nobody talks about until it's too late. 🔐

Do you keep your $BTC and $ETH in self-custody, or on exchange? 👇

#Crypto #Security #ZachXBT

On-chain sleuth ZachXBT infiltrated a Chinese organized crime group that laundered billions for Lazarus Group hackers. Risking his own $350k, he helped freeze $75 million.

What does this mean for Price Action? The hackers were offloading stolen coins through BTC, ETH, SOL, and TRX in real time. These hidden volumes put pressure on price levels and throw retail indicators off. A clean chart reveals this selling pressure through anomalous bars, while RSI stays silent. The freeze saved the market from a dump and a break below local support levels.

Takeaway: Big money is waging a volume war behind the scenes. Our job is to calmly read their traces on a clean chart.

#bitcoin #zachxbt #priceaction #крипта

On-chain sleuth ZachXBT has gone undercover, infiltrating a massive $1 billion syndicate to track down Lazarus Group operations. By analyzing private chats and 2025 trading data, his intel recently helped freeze 442,000 USDT tied to the infamous Bybit exploits. This deep-cover approach shows how proactive intelligence is shifting the power balance, proving that even sophisticated state-sponsored hackers are struggling to outrun dedicated blockchain investigators. #ZachXBT #Security #CryptoNews

ZachXBT just took on-chain sleuthing to an entirely new level. By fronting nearly $350K and eating heavy fees to pose as a client of a Chinese money-laundering syndicate, he managed to track stolen Lazarus Group funds in real time. This undercover operation highlights the extreme lengths independent investigators go to when tracing stolen assets across global networks. It is a bold move that exposes just how deeply sophisticated syndicates operate behind the scenes of major exploits. #ZachXBT #Security #CryptoNews

ZachXBT said on October 5 that he posed as a client to infiltrate a Chinese network accused of laundering over $1 billion in stolen crypto for Lazarus Group.

After the $1.5 billion Bybit hack in February 2025, he identified over 15 accounts seeking transfer help in public Telegram and Discord groups.

On March 6, he began trading with “Jimmy Green,” swapping Ethereum $USDC for Tron $USDT . He committed $349,700 and accepted a 5% loss per trade to build trust. Green’s address received transaction-fee funding from a Bybit-linked wallet.

Green shared planned Bybit transfers, including a Solana move observed the next day. A transfer screenshot also matched a THORChain order. Three Solana addresses enabled tracing across Bitcoin, Ethereum, Solana, and Tron. ZachXBT also identified laundering through low-activity Uniswap pools.

The conversations helped trace over $12 million in Bybit funds. Tether later froze 442,000 USDT. Further links involved 332,000 USDC stolen from Poloniex and $3 million in fraud proceeds traced to a Huione Guarantee wallet.

After the $387 million Bitget hack in September 2026, similar public requests appeared. ZachXBT linked one account to the $292 million Kelp DAO exploit.

He shared findings with investigators and law enforcement, delaying publication because of the case’s sensitivity. He says his work has helped secure over $75 million in freezes tied to North Korean incidents since 2022 and requested continued funding.

#zachxbt #investigation #CryptoNews #scam #LazarusGroup

Smart money has its eye on AI tonight 👽 ZACHXBT surged +55.47% in 24h, but its market cap is only $7.0K—a tiny token with just 30 people trading it. Smart money net inflows are only around $76, which looks more like a test position. This one’s better for watching from the sidelines; putting real money in could quickly turn you into exit liquidity 😅 Do you trade based on smart money signals? #链上数据 #聪明钱 #BSC
#ZACHXBT +55.47%

🚨 ZachXBT publicly seeks assistance: We are tracking a suspected money-laundering group believed to be involved in the $387 million Bitget attack.

#加密货币 #区块链安全 #ZachXBT #Bitget