Markets
BTC
ETH
BNB
XRP
SOL
ZEC
HYPE
DOGE
LINK
TON
AVAX
SUI
TAO
AAVE
PUMP
MORPHO
ARB
LIT--:-- UTC
Research/Market structure
ZachXBT is the pseudonymous onchain investigator whose public cases have preceded arrests in major crypto thefts. Learn how he traces funds, who pays for his work and what he is investigating now.
By Alpha Finance Editorial Team
Fact-checked by Vince Dioquino
Every figure, platform detail and regulatory claim on this page was traced to a primary source by the named fact checker before publication, and is re-checked when those facts change. The review date moves only when a person has re-read the page.
The editorial policy → Editorial policy Report an errorZachXBT is a pseudonymous blockchain investigator who follows stolen and misused crypto across public ledgers, publishing evidence that anyone can check. In Feb 2025, Paradigm co-founder Matt Huang said ZachXBT had returned more than $350 million to victims of hacks and scams.
He works without a firm behind him. His 2026 cases have shifted from lone scammers towards insiders at trading platforms, token teams and exchanges, alongside the syndicates laundering North Korea's thefts.
The one-sentence version
ZachXBT is a self-taught investigator who traces crypto thefts in public, with findings that have preceded arrests in the United States, France and the Caribbean.
Behind the cartoon persona is one person who learned to investigate outside any police force or analytics firm. ZachXBT started buying crypto tokens around 2017 and lost money as many collapsed. These were often rug pulls, where creators sell their tokens and leave buyers holding worthless coins. According to a 2024 Wired profile, those losses prompted him to teach himself how to read blockchain data.
His investigations first appeared on Twitter, now X, in 2021. He agreed to speak to Wired only if the magazine would not try to identify him, and his avatar is a platypus in a detective's trench coat.
A legal name and place of residence appeared in court filings for Huang v. Wolk, a 2023 defamation case brought in a Texas federal court. Decrypt reported that the filings had put a spotlight on his identity, but ZachXBT has not publicly confirmed any name.
CoinDesk included him on its Most Influential 2024 list. Its profile noted that he generally does not charge victims and had himself been a victim of crypto fraud.
Every transfer on a public blockchain leaves a permanent record. That gives investigators a trail to follow from a theft to an attempt to cash out.
ZachXBT combines onchain analysis, the reading of those transaction records, with open-source research. Social media accounts and offline records of luxury purchases can help connect wallet activity to people. As CCN's breakdown of his methods explains, he traces funds between wallets and uses address clustering to group addresses that appear to share an owner.
Returning the money requires more than tracing it. An exchange must freeze an account, or a stablecoin issuer must block tokens at an address. Stablecoins such as Tether's USDT and Circle's USDC are designed to hold a steady $1 value, and their issuers can freeze them. In Apr 2026, ZachXBT accused Circle of acting too slowly in 15 cases involving more than $420 million. Circle replied that it freezes assets when legally required.
TRM Labs named ZachXBT among the security researchers monitoring threats for its Beacon Network at its Aug 2025 launch. The network allows investigators to coordinate freezes with exchanges and custodians in real time. His own findings appear as short threads on X and longer cases on his Telegram channel.
Large, unusual transfers have been the starting point for his most consequential cases. They often ended with a suspect bragging online and evidence passed to police.
Early investigations included thefts of NFTs, or non-fungible tokens, which record ownership of unique digital items such as profile pictures.
| Year | Case | What ZachXBT found | What followed |
|---|---|---|---|
| 2022 | Bored Ape Yacht Club NFT phishing | A ring stealing NFTs through a fake animation website | French arrests; the national cybercrime unit credited his research |
| 2024 | Genesis creditor theft | 4,064 bitcoin by his count, about $243M, taken through fake support calls | Two arrests in Sep 2024 and a guilty plea in Sep 2026 |
| 2025 | Bybit exchange hack | Wallet links to North Korea's Lazarus Group | FBI attribution of the $1.5B theft to North Korea |
| 2025 | Leveraged Hyperliquid trader | Wallets that had received phishing proceeds | Trader named as a British hacker (unverified) |
| 2026 | US Marshals Service theft | $46M of seized crypto allegedly taken by a contractor's son | Arrest in Saint Martin on 4 Mar 2026 |
| 2026 | Axiom insider trading | Staff allegedly viewing private wallet data | Axiom removed staff access to the tools |
While waiting for a flight on 19 Aug 2024, ZachXBT spotted an unusually large $600,000 bitcoin sale. He traced it back to a $243 million fortune, according to CoinDesk's profile of him. The victim later hired him to work with the authorities, marking the first time he accepted a fee.
The victim was a creditor of Genesis, the collapsed crypto lender. Thieves had posed as Google and Gemini support staff to take over his accounts. Tricking someone into handing over access, rather than breaking the software, is called social engineering.
On 18 Sep 2024, the FBI arrested Malone Lam and Jeandiel Serrano. Prosecutors charged them with conspiring to steal and launder more than $230 million, including over 4,100 bitcoin taken from one victim. Lam pleaded guilty to a racketeering conspiracy on 8 Sep 2026. Prosecutors say that enterprise stole and laundered more than $245 million.
An anonymous trader made about $20 million on Hyperliquid and GMX in Mar 2025 by trading perpetual futures. These contracts track a coin's price and have no expiry date. The trader used up to 50x leverage, borrowing money to multiply potential gains and losses by as much as 50 times.
On 12 Mar 2025, the trader let a roughly $200 million ether position be forcibly closed. A Hyperliquid pool that takes the other side of trades lost about $4 million.
A phone number linked to a payment from the trader's wallet led ZachXBT to name the trader as William Parker. He described Parker as a British hacker who had served time for fraud and been arrested in 2024 over a $1 million casino theft. Cointelegraph said it had not independently verified the claim.
Because Hyperliquid records every position onchain, traders could follow the account live. Our tracker of Hyperliquid positions over $1M shows each large account's entry price, leverage and the price at which it would be forcibly closed.
A recording obtained by ZachXBT in late Jan 2026 captured two people in a Telegram group arguing over who controlled more crypto. One shared his screen and moved funds in real time. As The Block reported, ZachXBT traced those addresses to wallets holding crypto seized by the US government after the 2016 Bitfinex hack.
ZachXBT identified the man as John Daghita, known online as Lick. His father headed CMDSS, a Virginia firm contracted by the US Marshals Service to manage some seized crypto. Days later, the Marshals Service confirmed it was investigating.
The FBI and France's gendarmerie arrested Daghita on Saint Martin on 4 Mar 2026, seizing cash, hard drives and hardware keys. He was charged with stealing about $46 million after taunting ZachXBT on Telegram and dusting his public wallet. Dusting means sending tiny amounts of crypto, in this case allegedly stolen funds, to a wallet. Daghita is presumed innocent unless proven guilty.
Since 2024, much of ZachXBT's work has followed North Korea's state hackers from the initial theft through their efforts to convert stolen crypto into cash.
Attackers drained about $1.5 billion from Bybit on 21 Feb 2025. Within hours, ZachXBT submitted evidence to Arkham's bounty program linking wallets and test transactions to the Lazarus Group, the umbrella name for North Korea's hacking units.
The FBI confirmed North Korea's responsibility five days later. By then, it said, the hackers had spread part of the haul across thousands of addresses.
His investigations also cover North Korean IT workers who take remote developer jobs under false identities and send their pay home. Files he published in Aug 2025 from a compromised worker's device showed five workers running more than 30 fake identities. He linked one of their wallets to a $680,000 exploit of the Favrr marketplace.
In Apr 2026, ZachXBT released data from an internal North Korean payment server, including 390 accounts alongside chat logs and crypto transactions. Tether had frozen one linked wallet on the Tron blockchain in Dec 2025.
On 5 Oct 2026, he disclosed that he had posed as a client of a Chinese laundering syndicate that has moved more than $1 billion for Lazarus. Beginning in Mar 2025, he fronted 349,700 USDC of his own money and lost about 5% on each order to gain the group's trust.
One job described by the group led to a Huione Guarantee hot wallet, the always-online wallet a platform uses for daily payments. FinCEN had cut its parent, Huione Group, off from the US financial system in Oct 2025 for laundering proceeds from North Korean cyber heists. ZachXBT says his investigations have helped freeze more than $75 million tied to North Korean incidents since 2022.
Most of ZachXBT's 2026 cases concern people working inside crypto companies. Those accusations are harder to dismiss as the work of anonymous hackers.
On 26 Feb 2026, ZachXBT alleged that Broox Bauer and other Axiom staff had used internal support tools since early 2025 to inspect users' private wallet activity and trade ahead of them. He published the findings to roughly 977,500 followers. Bettors backing Axiom traded more than $9.7 million on a Polymarket contract asking which company he would name.
Axiom said it was "shocked and disappointed" and removed staff access to the tools. About $1.2 million went to the contract's eight most profitable wallets. An onchain researcher quoted by Cointelegraph suspected that someone had traded with advance knowledge of the findings.
Prediction market shares pay out if a specified event happens, and their prices reflect the crowd's estimate of the odds. Our terminal displays live prediction market odds for crypto, macro and politics.
LAB, the token of an AI trading terminal, rose more than 350% in under 72 hours in May 2026 before falling more than 65% within hours. According to Bitcoin.com News, it reached a $6 billion fully diluted valuation, calculated by multiplying the token's price by its entire supply.
ZachXBT alleged that insiders controlled more than 95% of LAB's supply and worked with Bitget insiders and an unnamed market maker, a firm paid to maintain buy and sell orders on an exchange. He also highlighted changes to LAB's vesting schedule, which determines when team and investor tokens are released. Our token unlock calendar tracks those schedules for other projects.
He offered a $10,000 bounty for LAB founder Vova Sadkov's ID or insider details about LAB's market maker. Earlier, he had described the price action of tokens including RAVE, SIREN and RIVER as highly questionable. These remain his allegations. None has been proven in court.
Social engineering crews remain a recurring target. ZachXBT profiled Tiffany Milanovich in Aug 2026, tying the US-based threat actor to at least $5 million stolen from people who thought they were speaking to hardware wallet or exchange support.
He had flagged $520,000 drained from two Polymarket contracts in May 2026. Polymarket attributed the incident to a compromised key for an internal rewards wallet and said user funds were safe.
Plans for a website to manage requests for help followed in Aug 2026. ZachXBT said it would likely decline cases from Canada, the UK, India, Nigeria, Morocco, Algeria and Bangladesh, which he ranked as the weakest jurisdictions for crypto scam victims.
ZachXBT generally does not charge victims. Donations and blockchain grants fund much of his work, supplemented by a few paid roles.
Wired reported that he had received about $1.3 million in crypto donations since 2021. At the time, his own figures put direct recoveries at about $210 million, and his work had helped trigger roughly $225 million in additional seizures, according to the same Wired profile.
On 26 Feb 2025, he announced on X that he would advise Paradigm's portfolio companies on incident response, helping contain hacks while they happen. He said the role allowed him to continue publishing freely.
BNB Chain, the blockchain launched by Binance, announced support for his investigations in Nov 2025. ZachXBT wrote that grants from chains are one of the main ways he funds his work.
He has no token. In Dec 2023, he warned followers against buying memecoins carrying his name. These are tokens with no product that trade on jokes and attention. He said he would never launch a coin, reiterating in Jul 2026 that he will never support or launch a meme coin.
Publishing evidence for anyone to check has not shielded ZachXBT from the costs of naming people before courts rule.
Entrepreneur Jeffrey Huang, known online as Machi Big Brother, sued him in June 2023 over a 2022 article accusing Huang of embezzling 22,000 ether from Formosa Financial. In under three days, supporters donated $1.1 million towards ZachXBT's legal defence.
After ZachXBT altered the article's embezzlement claim, Huang dropped the suit in Aug 2023. ZachXBT said he would return unused donations.
His BNB Chain deal prompted accusations of hypocrisy. As CCN reported, the criticism partly reflected donations to his 2023 legal fund from Binance founder Changpeng Zhao and Tron founder Justin Sun. Supporters argued that he continues to investigate activity across many blockchains.
Some of the conduct he targets is legal. In Oct 2024, he accused influencer Ansem of promoting low-value memecoins to followers. Ansem replied that those coins attracted most of retail traders' attention, according to Cointelegraph.
A thread is not a conviction, and people ZachXBT names may never be charged. His posts can move token prices and prediction markets before the accused have responded. Recoveries still require action by an exchange or stablecoin issuer. The countries he expects to turn away suggest that those efforts often fail.
Not investment advice
This article explains market data. Nothing on this page is a recommendation to buy, sell or leverage any asset. Digital assets are volatile and you can lose everything you put in. If you are unsure whether a trade is appropriate for you, a licensed adviser in your jurisdiction is the right next step.
Fact checked by
Verifies every figure against primary sources before publication. Meet the team
ZachXBT has never publicly confirmed his real name, although filings in the 2023 defamation case Huang v. Wolk listed a legal name and place of residence for him. He keeps his face hidden. His agreement to a Wired interview was conditional on the magazine not identifying him.
Donations and blockchain ecosystem grants fund his work. He describes those grants as one of his main sources of income. According to The Block, he has also advised venture firm Paradigm since Feb 2025. The 2024 Genesis creditor investigation was the first case in which a victim paid him.
Police arrested two suspects within a month of the $243 million Genesis creditor theft. Ringleader Malone Lam later pleaded guilty on 8 Sep 2026. In another case, John Daghita was arrested on Saint Martin in Mar 2026 after ZachXBT linked him to $46 million taken from the US Marshals Service.
ZachXBT has no token and has said he will never launch a coin. Tokens using his name are not his. Treat any coin claiming an association with him as a likely scam.
Hang up if someone claiming to be exchange or wallet support calls and asks you to move funds. ZachXBT estimated that these impersonation scams cost Coinbase users more than $300 million a year. Coinbase later disclosed that bribed support agents had leaked customer data. Before buying a new token, use a DEX screener with token risk flags to check how concentrated its supply is.
He does not accept every case. In Aug 2026, he said his planned request website would likely decline cases from seven countries. First report the theft to local police and, in the US, to the FBI's Internet Crime Complaint Center. Be wary of anyone who contacts you offering to recover stolen crypto for a fee.