zachxbt

A South Korean trader @solyfw34 accused the cryptocurrency trading platform LBank of restricting account withdrawals and trading after he profited from contract trading, resulting in some positions being unable to be manually closed and ultimately being forcibly liquidated. Currently, approximately 1 million USDT remains inaccessible. The user stated that LBank did not provide specific evidence of abnormal trading.On November 10, LBank responded that it would not restrict accounts solely due to user profits, and that the relevant accounts were suspected of violating internal rules. The user's invested principal has been fully withdrawn, and the restricted funds have been identified as related to abnormal trading. LBank has hired a South Korean law firm and stated that it will take legal action against false and defamatory statements. On-chain investigator ZachXBT criticized LBank as an offshore low-quality centralized exchange and questioned several KOLs for using highly similar rhetoric to defend the platform.

On-chain detective ZachXBT stated that the $16 billion in illegal transactions involving the cryptocurrency exchange MEXC, as pointed out by the U.S. Financial Crimes Enforcement Network (FinCEN), may be overstated. He noted that MEXC's past anti-money laundering and customer identification policies have been relatively lax, but he hopes to see relevant data, the proportion of suspected illegal transaction amounts to MEXC's total trading volume, and comparisons with other exchanges.ZachXBT also questioned why some offshore exchanges, which have almost no business in the U.S., quickly cut off channels for MEXC users to transfer assets, and who these measures are actually protecting.

On November 4, the French banking group Crédit Mutuel Arkéa announced details of a previously disclosed theft of funds revealed by ZachXBT. The bank stated that the attackers gained access through a platform of an unnamed third-party service provider, and then used the bank's own accounts to transfer funds to other financial institutions, with the related funds potentially being exchanged for cryptocurrency through specialized platforms.The bank denied that the attack entry point was located in its online bank Fortuneo and stated that customer assets were unaffected. Regarding the previously reported stolen amount of approximately 118 million euros (133 million dollars), the bank did not confirm the specific figure but acknowledged its magnitude, with some funds already frozen and the final loss still being assessed.

French crypto journalist and co-founder of The Big Whale, Grégory Raymond, stated that the French cooperative bank Crédit Mutuel Arkéa suffered at least $133 million in fraud, with funds being transferred to a crypto trading platform and then moved. This information was disclosed overnight by on-chain investigator ZachXBT, and Raymond indicated that he had been following the matter since the previous day.Raymond cited sources close to the case, stating that the transferred assets were not crypto assets directly held by the bank, but rather fiat currency, which was then converted into crypto assets for transfer. The source described this method as unprecedented and characterized it as an organized network relying on a large number of mule accounts, with funds flowing to multiple trading platform accounts, including Crypto.com. Raymond contacted the bank around 6 PM Paris time the previous evening, and they responded that they could not confirm the relevant information at this stage and did not provide further comments.According to the anonymous source, Arkéa realized its involvement later and was unprepared to respond. Raymond wrote that due to the bank's lack of official confirmation, the trading platforms and stablecoin issuers failed to freeze the funds in time. ZachXBT pointed out on Sunday that an unnamed European entity had transferred over $106 million in USDC and USDT, and on Tuesday raised the estimated amount to $133 million, with some transfers occurring after the initial warning. ZachXBT expressed high confidence in ruling out the involvement of North Korea's Lazarus group and estimated that if the incident had been reported quickly, over $30 million could have been frozen.

On-chain investigator ZachXBT updated the investigation, stating that over $27 million in abnormal withdrawals from centralized exchanges have been discovered related to European institutions that were previously suspected of being hacked, bringing the total amount of funds involved in the incident to over $133 million. Some withdrawals from the exchanges occurred after the initial disclosure of the incident.ZachXBT proposed an unverified hypothesis that the incident may involve a large financial institution located in Western Europe that has been attacked, and the relevant situation may currently be covered up. It also stated that due to the lack of proper incident disclosure, over $30 million has been transferred for laundering, and EU law enforcement agencies may have had the opportunity to freeze this portion of the funds.

On-chain detective ZachXBT issued a community alert based on personal judgment, stating that a certain EU entity was suspected to have been attacked on November 1, with multiple centralized exchange accounts being hacked, resulting in losses exceeding $106 million. The attacker withdrew the stolen funds in the form of USDC and USDT.Monitoring has shown that in the past 24 hours, the attacker has continuously exchanged USDC for ETH and transferred it to instant exchange platforms such as WellWallet and Kyrrex, then converted the funds into Monero (XMR) through Wagyu, while also utilizing cross-chain bridges to transfer funds across multiple blockchain networks. ZachXBT disclosed 11 involved addresses and reminded the community to pay attention to the relevant flow of funds.

According to on-chain detective ZachXBT, approximately 45 minutes ago, about $6.3 billion in stolen funds from Binance and about $388 million in stolen funds from Bitget were transferred via THORChain and mixed at the same address, indicating that the two incidents may have been carried out by the same attacker.ZachXBT stated that the Bitget incident was previously linked to the North Korea-related TraiderTraitor, which also overlaps with cases such as Kelp DAO. The mixing address is 0x151....eb7.

Crypto KOL Kuai Dong (entered the industry in 2016) stated that on-chain tracker ZachXBT speculated that the party responsible for the attack on Binance and the theft of $5.875 billion is the Lazarus Group, which is under the Reconnaissance General Bureau of the Korean People's Army.Kuai Dong also listed past theft results related to this organization, including approximately $300 million from Japan's DMM exchange, about $230 million from India's WazirX exchange, around $1.5 billion from Bybit, approximately $292 million from the on-chain protocol Kelp DAO, and about $380 million from Bitget.He also mentioned that Binance has recovered about half of the assets, but the recovery of Bitcoin, Ethereum, and others is more challenging, and stated that the hackers' ultimate goal is to funnel the assets into North Korea. ZachXBT responded in related discussions that this incident is likely related to the North Korean Lazarus Group. Public information shows that around October 30, there was a massive outflow of assets from Binance's hot wallets, with cross-chain statistics estimating between $5.5 billion to $6.2 billion. Zhao Changpeng stated that it indeed looked like they were hacked and mentioned that the actual net loss might be slightly above $1 billion, but they would cover the full amount.

According to monitoring by ZachXBT, the Arbitrum Security Council has executed a transaction to freeze approximately 30.5 million dollars in funds from the Binance exploit.

According to on-chain detective ZachXBT, insiders at Axis Robotics (AXIS) obtained over 76 million AXIS tokens (worth over 12 million USD) from a multi-signature wallet, then sold them off via DEX and transferred some tokens to Bitget exchange. As a result, the AXIS price plummeted by 40% in the past 24 hours.One of the insiders sold 42 million AXIS tokens and currently holds over 5.04 million USDC across their 8 wallet addresses.

On-chain detective ZachXBT posted that a certain institution was allegedly hacked by the North Korean-linked organization SquidSquad on October 8, resulting in the theft of approximately 2.84 million USD on the BNB Smart Chain (BSC).According to its tracking, the attackers deposited 1,111.2 ETH into Tornado Cash on October 20, then withdrew it to three addresses, and subsequently transferred the funds from Ethereum to Tron via USDT, consolidating them into two addresses. The aforementioned consolidation addresses are all financially linked to addresses previously attributed to North Korea. The funds were then directed to Chinese over-the-counter (OTC) traders through intermediary addresses within minutes, and ZachXBT believes this move may be to evade potential fund freezes by Tether.

On-chain detective ZachXBT stated that in August 2026, a centralized money laundering service named FreedomXMR (FXMR) appeared on Hyperliquid Core (HL Core). Over 87% of its incoming funds are directly related to illegal activities.Through manual verification, it was found that among all historical inflows over $10,000 to FXMR, more than $20 million directly originated from ransomware attacks, exploits, malware, and social engineering attacks, including: the DCENT wallet exploit incident (September 2026), the Fetch.ai exploit incident (September 2026), the Axelar exploit incident (September 2026), a certain ransomware payment (September 2026, specific source undisclosed), and the Gamdom exploit incident (October 2026). The operators of this service obtained XMR liquidity from KuCoin (over 3,000 deposits), suspected of using a similar exchange model to Wagyu.The token name (ticker) FXMR was acquired by the operators at an HL auction on July 27, 2026, for 518.28 HYPE (approximately $28,000). Several such centralized money laundering services had previously appeared on HL Core, exploiting the chain's "permissionless" design features and its wide application for illegal money laundering activities. Relevant data tables have been shared with the Hyperliquid team.

On-chain detective ZachXBT responded to the XRP Ledger Foundation regarding security fixes, stating that the foundation's treasury holds billions of dollars but only paid $250,000 to the white hat hacker who discovered the serious vulnerability of "infinite XRP issuance." He claimed that this would encourage attackers to choose not to report vulnerabilities in good faith but instead exploit them to steal hundreds of millions of dollars.ZachXBT also stated that because of this, it is difficult for people to view the XRP Ledger or Ripple as legitimate institutions. Previously, the XRP Ledger Foundation clarified that the relevant vulnerability did not lead to the issuance of additional XRP, and the patch was driven by community consensus.

"On-Chain Detective" ZachXBT stated that he once disguised himself as a client to infiltrate a criminal gang suspected of laundering money for the North Korean-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack incident.ZachXBT indicated that after Bybit was attacked for $1.5 billion in February 2025, he discovered over 15 accounts seeking help with transactions related to the stolen funds in public Telegram and Discord groups. He then contacted a Telegram user using the alias "Jimmy Green" and built trust through multiple transactions.According to his disclosure, on March 6, 2025, he transferred $3.497 million USDC to an Ethereum address for exchanging USDC with TRON chain USDT. The Gas funds for that address trace back to the Bybit attack funds and have been publicly marked as a Bybit attack blacklist address.ZachXBT stated that in subsequent communications, the other party revealed that their team had participated in handling the stolen funds from Bybit and disclosed in advance that the funds would be transferred on chains such as Solana. By matching transaction times, amounts, and on-chain data, he discovered a wallet cluster involving over $12 million of Bybit attack funds, with funding paths including BTC→ETH→SOL→TRON and others, among which approximately 442,000 USDT had been frozen by Tether. The gang also attempted to launder money through Uniswap liquidity pools and low liquidity tokens.In addition, the other party revealed that they had helped other clients handle approximately $3 million in scam proceeds, and ZachXBT tracked the related funds flowing to sanctioned Huione Guarantee-related wallets.ZachXBT disclosed that during this investigation, he initially invested $3.497 million and bore about 5% loss risk for each transaction. The intelligence obtained was promptly provided to relevant investigative agencies and law enforcement. Since 2022, he has assisted in freezing over $75 million related to North Korea-related incidents.

ZachXBT posted on platform X that UPay may allow the sanctioned illegal market Xinbi to issue its Visa crypto card and requested UPay to clarify the situation.ZachXBT stated that Xinbi is mainly involved in pig butchering scams, fraud, money laundering, and human trafficking.

CoinBureau cites on-chain investigator ZachXBT, stating that suspected North Korean attackers are using Zcash to obscure the stolen funds from Bitget. Approximately 2,700 ZEC, worth about 3.8 million dollars, have begun to be transferred to Zcash's Ironwood.These stolen ZEC are being moved into a shielding pool, where transaction details can be hidden. In a security incident involving various assets totaling about 388 million dollars, approximately 18,900 ZEC, worth about 28.3 million dollars, were stolen. Previously, Bitget's CEO Gracy Chen expressed that she is "not very optimistic" about recovering the stolen funds.

According to on-chain analyst ZachXBT, the recently launched 10K PFP NFT project zkSNARKs on the Zcash chain is suspected of being a rug pull. The project attracted a total of 16,971 bids through a blind auction, ultimately settling at a clearing price of 1.5 ZEC (approximately $2,190) for 8,000 allocations, with a total transaction volume reaching 25,305 ZEC (approximately $36.94 million), and refunds of 13,309 ZEC (approximately $1.943 million) have been gradually returned.ZachXBT pointed out that the project raised about $17 million, while reserving 10% for the team, 5% for royalties, and approximately $2,000 for minting fees, yet it has no practical value, resembling the common "money grab and run" tactics used in the Ordinals series.

On-chain detective ZachXBT posted that the wallet address associated with 7zarc has received 4,870 ETH (approximately 15 million USD), with the funds originating from addresses related to the Raidparty project's approximately 70 million USD "exit scam." Subsequently, this portion of ETH was transferred to recharge addresses of several centralized exchanges.ZachXBT pointed out that 7zarc disappeared from public view in 2022 and only became active again in September 2026. Based on this, he publicly questioned the need for an explanation regarding the flow of the related funds.

On-chain detective ZachXBT posted on his personal channel that Revolut allegedly leaked some users' personal identifiable information (PII) due to failing to recognize a forged government agency information request.According to his disclosure, Revolut previously received a request for customer information retrieval that appeared to come from a real government agency and was sent through the agency's official email domain. Because the email had valid domain authentication information, Revolut believed the request was legitimate and responded accordingly.The potentially involved data includes users' names, birth dates, occupations, addresses, email addresses, and phone numbers, as well as copies of passports or driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transaction records. Revolut stated in the notification sent to users that no biometric facial telemetry data was leaked.ZachXBT indicated that the scale of the incident may currently be limited, but it appears to primarily target high-net-worth users. Several Revolut users received notifications regarding the related security incident yesterday. Revolut officials had previously reminded users to verify suspicious information through in-app customer service to avoid providing personal or financial information.