zachxbt

On-chain detective ZachXBT posted that U.S. threat actor Tiffany Milanovich participated in the theft of approximately $5 million in crypto assets by impersonating hardware wallet and centralized exchange customer service.Her methods included disguising as Bitcoin IRA email support, during one attack transferring about $1.2 million in BTC and ETH from the victim's Trezor wallet, and in another case stealing about $500,000 in BTC from a Coinbase account. Tiffany induced victims to hand over access to their funds under the guise of "customer service calls," later boasting about the stolen money on social media and Telegram groups, mocking victims with recordings, and collaborating with other threat actors to launder money using phishing panels and instant exchange services, with some of the stolen funds still dormant on-chain.The threat actor codenamed "Tiffany" is suspected of participating in multiple crypto asset thefts, gambling the stolen funds at crypto casinos. The platform Shuffle has frozen related accounts based on evidence submitted by ZachXBT; Tiffany previously shared a search and seizure warrant from Connecticut, dated before some of the incidents involved.ZachXBT has obtained chat logs, recordings, and on-chain evidence, anticipating that this individual may face further legal consequences. This threat actor is also linked to the John Daghita (Lick) case, who is suspected of stealing over $46 million in crypto assets from a U.S. government-seized wallet.

On-chain data shows that cryptocurrency theft suspect Dritan Kapllani Jr laundered 126.7 ETH again on July 22, worth approximately $239,000.Previously, on-chain detective ZachXBT revealed that Dritan Kapllani Jr is suspected of stealing assets from cryptocurrency holders through social engineering techniques, with a total amount involved reaching $19 million. Dritan Kapllani Jr has long showcased a lifestyle featuring luxury cars, high-end watches, and private jets on social media, and publicly displayed assets worth $3.68 million in his Exodus wallet during a Discord call on April 23, 2026.

According to The Block, Trezor's Chief Business Officer Danny Sanders refuted recent criticisms of cryptocurrency hardware wallets made by blockchain investigator ZachXBT.Earlier this week, ZachXBT posted on Telegram, "All hardware wallets are complete garbage and I do not recommend using them for important tasks such as signing transactions or storing funds," and suggested that users use a dedicated iPhone to store funds and sign transactions.In response, Sanders acknowledged in an interview that firmware/software updates for hardware wallets can sometimes interfere with urgent or large transactions, and that the user experience can indeed be "clunky," understanding the users' frustration. However, he opposed ZachXBT's blanket statement: while hardware wallets may not be the best single solution for advanced users managing large amounts of funds, they are not garbage.He pointed out that compared to hardware wallets, the operating system and connectivity features of an iPhone present more "attack risks." For the average cryptocurrency user, hardware wallets remain the best self-custody option available.

On-chain detective ZachXBT updated on X that an entity initially funded by the LAB team deposited 18.4 million LAB into Aster, approximately 18.3 million USD, and sold it on the DEX spot market, causing the LAB price to drop again by 54%, from 1.2 USD to 0.55 USD.ZachXBT stated that this entity transferred LAB to 3 Aster deposit addresses between July 10 and 11, and currently holds about 81.5 million LAB. He added that the entity received over 196 million LAB from the LAB team in April 2026, subsequently transferred to a Bitget address, and withdrew from Bitget to 10 addresses between May 11 and 12.ZachXBT has previously questioned the existence of market manipulation and insider supply issues with LAB, claiming that one of the multi-signers from the LAB team had financial ties to addresses related to RIVER manipulation, and pointed out that nearly 226 million LAB was deposited into Bitget between March and April.

On-chain detective ZachXBT posted that an early whale address related to the initial allocation of the Solana genesis block was suspected to have been attacked a few hours ago, with approximately 180,900 SOL (about 14.2 million USD) stolen.ZachXBT stated that in collaboration with the on-chain investigation agency Specter Investigation, they discovered abnormal unstaking and cross-chain operations to Ethereum while tracking unusual fund flows, and subsequently confirmed that the related assets had been transferred.Currently, the involved victim address and several suspected theft addresses have been made public, and the specific method of attack and the whereabouts of the funds are still under further investigation.

On-chain investigator ZachXBT posted that the LAB token has dropped from $14 to less than $2 in the past 24 hours, a decline of about 85%, with the fully diluted valuation (FDV) significantly shrinking from about $14 billion.ZachXBT expressed disappointment that Binance, Bitget, and Gate failed to take measures in advance to prevent price manipulation, stating that if centralized exchanges truly valued user interests, they should at least return the profits from accounts suspected of manipulating the market to the users. He also pointed out that LAB investors were originally scheduled to start unlocking tokens later this month, but the vesting arrangements have been modified multiple times before, with insiders controlling almost the entire circulating supply and implementing extreme price manipulation through market makers on centralized exchanges. Therefore, he "does not recommend trading LAB under any circumstances."

On-chain detective ZachXBT stated on X that unless the case involves recent events, each victim has lost more than $250,000, the jurisdiction is favorable, the relevant chain supports their work, and it does not involve meme coins or prediction markets, they will not review or respond to related case requests.

On-chain detective ZachXBT disclosed on his personal channel that a hacker extracted approximately 3,200 ETH through Tornado Cash between July 2 and 3. The funds are related to two private key leakage incidents. The address subsequently used Circle's CCTP cross-chain bridge to launder approximately $5,500,000 in assets across chains and further transferred USDC to seven deposit addresses on the Arbitrum network.ZachXBT pointed out that the flow of funds exhibits a typical decentralized money laundering path, utilizing mixing tools and cross-chain infrastructure to reduce tracking difficulty. Currently, the related on-chain assets are still in circulation.

According to on-chain detective ZachXBT, multiple reports indicate that the centralized cryptocurrency exchange AscendEX (formerly Bitmax) has recently delayed or failed to process users' withdrawal requests for several days or even weeks, yet the platform continues to accept user deposits.As early as the initial warning on June 26, ZachXBT pointed out that, after reviewing on-chain data from Arkham and TRM, several known hot wallets of AscendEX (covering EVM, Tron, and Solana networks) severely lack major market cap tokens such as ETH, USDT, and SOL, indicating that the platform is likely facing a serious liquidity crisis.The latest situation shows that, in the 9 days since the first warning, the official X account of AscendEX has remained inactive, and the platform's co-founder George (Jing) Cao has not responded to inquiries from users with large amounts of trapped funds. Currently, ZachXBT strongly advises users unable to withdraw their funds to report to law enforcement and regulatory agencies in their respective countries or regions as soon as possible.It is reported that AscendEX was founded by George (Jing) Cao and Ariel Ling in 2018. In December 2021, the platform was attacked by the hacker group Lazarus Group, resulting in approximately $78 million in asset losses.

On-chain detective ZachXBT stated that during the migration from the traditional private messaging system to XChat, the X platform encountered multiple technical bugs. At the same time, the reliability of the platform's search function declined, affecting information retrieval efficiency. More importantly, the X platform's algorithm has a "traffic bottleneck" for cryptocurrency content, making it easier for content to be restricted within the cryptocurrency vertical, thereby reducing the ability to reach a broader audience.

According to on-chain detective ZachXBT's monitoring, it was found that signs of mixing appeared in the funds stolen from the Humanity Protocol and Kelp DAO vulnerability attacks one hour ago, indicating that there may be an overlap between the attackers of these two incidents.Based on this new evidence, it can be largely ruled out that the theft case of Humanity Protocol was committed by an insider.

ZachXBT released a community alert on platform X, reporting that the centralized exchange AscendEX (formerly Bitmax) has been reported by multiple users for withdrawal delays ranging from days to weeks, and in some cases, withdrawals cannot be processed at all. ZachXBT checked the known hot wallets of the exchange through Arkham and TRM and found that its reserves lack mainstream large-cap tokens such as ETH, USDT, and SOL, which may indicate liquidity issues.AscendEX was founded by George Cao and Ariel Ling in 2018 and was hacked by the Lazarus Group in December 2021, resulting in a loss of approximately $78 million.

According to "On-Chain Detective" ZachXBT's post on his personal channel, Polish social engineering attacker Wojtek Kulisz (online name "Merry") was recently suspected of being raided by Polish law enforcement, along with three others being taken away.Although the official press release did not disclose his name or photo, several designer clothing and jewelry items displayed on his public Instagram account "wojtekk" are highly consistent with the items seized during the police operation. The related case is led by the Polish Central Cyber Crime Fighting Department (CBZC) and has received assistance from agencies such as the FBI and HSI.

"On-chain detective" ZachXBT published a case analysis stating that in a cryptocurrency asset case involving an Indian scam gang, the relevant individuals reported the case to law enforcement after their assets were frozen, drawing attention. The incident began when a user sought help, claiming that approximately 5.73 BTC (about $475,000) was frozen on Changelly in March 2025.Subsequent on-chain analysis revealed that these funds could be traced back to multiple social engineering attacks and theft cases related to Bitcoin ATMs targeting U.S. users, with a total amount involved exceeding $1 million and several elderly victims. The investigation showed that the individual provided multiple changing explanations for the source of the funds, including "loan," "boss transfer," and "investment from 2014-2015," and there were significant contradictions in the evidence chain.More concerning is that this user had previously filed a police report in India in December 2025, attempting to recover the frozen funds (case number 3207-P/2025). Subsequent on-chain evidence collection and email data analysis indicated that they might be a "mule" for transferring funds, with some bank documents inconsistent with their identity information. ZachXBT noted that such cases demonstrate that social engineering attacks and cross-border fund transfers continue to occur and remind users to avoid interacting with funds from suspicious sources to prevent triggering compliance freezes or legal risks.

According to monitoring by ZachXBT, the address starting with TA6YHq received 120.2 million USDT on the Tron chain, then transferred over 12 million dollars to a Kucoin deposit address, and moved 8 million dollars to several instant exchanges. This entity created Monero orders, causing its price to briefly surge from 330 dollars to 420 dollars. Additionally, over 8 million dollars was transferred from Tron to Bitcoin and Ethereum via Near Intents.Previously, it was reported that Tether froze 72 million USDT in the address starting with TBzrPE, which is directly related to TA6YHq.

On-chain detective ZachXBT posted on platform X, stating that the demands from the crypto community for its investigative work are often difficult to meet.ZachXBT mentioned that when it publishes token manipulation investigations before insiders exit, it gets accused of shorting related projects, such as RAVE, M, and LAB; whereas when it releases investigation results after events occur, it is criticized for failing to issue warnings in advance.He stated that continuously facing such doubts has gradually diminished his motivation to regularly publish investigation reports, as he prefers to continue conducting investigations privately rather than endure public pressure. ZachXBT also criticized some community members for overly relying on its investigative results instead of conducting their own research.

On-chain detective ZachXBT released an update on the Humanity $31 million security incident. After further analysis of the flow of funds, ZachXBT believes that the team is likely not involved in "self-theft" or "self-directed performance." The official announcement regarding the private key leak is true, but before the unlocking, the price of H tokens was artificially pumped, resulting in hackers taking advantage of the situation. The private key leak and the previous abnormal price pump should be considered independent events.ZachXBT also questioned whether the team artificially inflated the price of H tokens through suspicious market-making agreements and large over-the-counter transactions before the token unlocking, in order to smoothly offload or alleviate selling pressure ahead of the upcoming unlocking for investors/early contributors (around June 25).

Regarding the incident of "Humanity being stolen over 31 million dollars," on-chain detective ZachXBT stated, "It's unclear whether this is a hacker theft or malicious behavior from the project team. From the K-line chart, given the concentration of supply, the H team is likely collaborating with an active market maker. However, all H tokens were sold on decentralized exchanges (on-chain), not centralized exchanges."

In response to Radha Stirling's claims about multiple Dubai crypto figures being abused in UAE detention centers, on-chain investigator ZachXBT stated that the individuals referred to as "crypto entrepreneurs" are actually threat actors suspected of involvement in high-impact social engineering crypto scams and data extortion. Law enforcement has seized $18.9 million in stolen funds.

On-chain detective ZachXBT posted questioning BitMEX co-founder Arthur Hayes for frequently changing his views and selling tokens in a short period, asking how much exit liquidity he had received from followers in the past few days.ZachXBT pointed out that before WLD, Arthur Hayes had expressed bullish views on tokens such as NEAR, HYPE, and ZEC, and in his latest operation, after publicly expressing a strong bullish stance on Worldcoin (WLD) multiple times and giving a target far above the current price, he chose to liquidate his position in a short time.In response, Arthur Hayes stated that he was simply selling assets at market prices to buyers willing to take over according to his trading targets, and if the price continued to rise, outsiders would think his sale was a wrong decision, "this time it just happened to be a correct judgment."Subsequently, ZachXBT posted again, sharing Arthur Hayes's previous bullish comments on WLD and questioning his rapid exit from the position after loudly promoting it, sparking discussions in the community about the influence of opinion leaders on the market and the issue of "exit liquidity."Previously, Arthur Hayes had stated that he had liquidated his WLD position, claiming that the price trend was "not right," and announced his exit from that position.