Cryptocurrency transactions are often perceived as anonymous, but the public nature of blockchain makes it possible to track the movement of digital assets even after complex money-laundering schemes. One of the best-known specialists who uses this feature is the independent investigator ZachXBT. He exposes fraudulent projects, tracks millions of dollars in stolen funds, and helps link cryptocurrency addresses to real individuals involved in criminal schemes.
ZachXBT's investigations have repeatedly attracted the attention of law enforcement agencies, cryptocurrency exchanges, and international analytics companies. Among the most notable cases are the tracing of $243 million stolen from an investor, the identification of links between the Bybit hack and the North Korean group Lazarus, and the discovery of suspicious cryptocurrency transactions involving assets controlled by U.S. government agencies. His work demonstrates why blockchain transparency can become a serious obstacle for criminals.
Who Is ZachXBT and How Did He Become a Cryptocurrency Investigator
ZachXBT is the pseudonym of an independent blockchain researcher who specializes in analyzing suspicious transactions, fraud, and digital asset theft. He does not publicly reveal his identity, preferring to focus his audience's attention on the evidence and findings of his investigations.
His interest in cryptocurrency crime emerged after personal experiences with fraudulent projects. During the rapid development of NFTs and decentralized finance, he began analyzing suspicious activities involving investor deception, price manipulation, and the withdrawal of funds from projects.
Over time, individual publications evolved into full-scale investigations. ZachXBT began comparing blockchain transaction histories with information from social media, messages from members of the cryptocurrency community, and data from trading platforms. This made it possible to identify connections between addresses that initially appeared to belong to unrelated users.
X became the main platform for publishing his findings. The researcher posts detailed analyses containing wallet addresses, diagrams of fund movements, and explanations of suspected fraudulent mechanisms. Because many transactions can be independently verified, his work has gained recognition among blockchain security specialists.
Today, ZachXBT works with analytics companies, security teams at cryptocurrency projects, and law enforcement agencies. However, his public findings remain the results of investigations rather than court rulings. Establishing the criminal liability of a particular individual requires independent verification of the evidence by the competent authorities.
How ZachXBT Tracks Stolen Cryptocurrencies
The foundation of the researcher's work is on-chain analysis — the examination of information recorded on public blockchains. On Bitcoin, Ethereum, and other open networks, it is possible to examine sender and recipient addresses, transfer amounts, transaction timestamps, and interactions with smart contracts.
Criminals often assume that moving funds between dozens of wallets will make investigations more difficult. To achieve this, they use intermediary addresses, decentralized exchanges, cross-chain bridges, and cryptocurrency swaps into assets offering greater privacy.
However, every public transaction leaves a trace. An analyst can reconstruct the movement of funds step by step, identify clusters of related addresses, and locate points where digital assets reach centralized platforms.
ZachXBT's work typically involves several stages:
-
Identifying the initial transaction. The researcher establishes the address from which the funds were stolen and determines the initial transfer destinations.
-
Reconstructing the transaction chain. Intermediary wallets, token swaps, and transfers between blockchains are analyzed.
-
Identifying related addresses. Time intervals, characteristic amounts, recurring routes, and other indicators of common control are compared.
-
Cross-referencing external data. Public statements, domain information, social media materials, and other available evidence are used.
-
Sharing the findings. When sufficient grounds exist, information may be forwarded to exchanges, victims, and law enforcement agencies.
The final stage is particularly important. Simply locating stolen assets does not mean they can be recovered. If the funds are held at an address controlled by a criminal, an independent researcher cannot reverse the transaction. However, when assets reach a centralized exchange, it becomes possible to contact its security team to request an investigation and potentially have the funds frozen.
Investigation of the $243 Million Theft From a Genesis Creditor
One of ZachXBT's most prominent investigations involved the theft of approximately $243 million in Bitcoin in August 2024. The victim was a creditor of the bankrupt cryptocurrency company Genesis.
According to the investigation, the attackers used social engineering. They impersonated representatives of Google and the cryptocurrency exchange Gemini, persuading the victim to take actions that allowed them to gain access to his funds.
Following the successful attack, the criminals transferred more than 4,000 BTC out of the victim's control and began distributing the assets across numerous addresses. Transfers through different trading platforms and conversions between cryptocurrencies were used to conceal the origin of the funds.
Working with other specialists, ZachXBT reconstructed a significant portion of the routes taken by the funds. Additional evidence included recordings of conversations, messages from private communities, and materials allegedly linked to participants in the scheme.
The investigator publicly named several suspected perpetrators and described how the stolen assets had been distributed. In September 2024, U.S. law enforcement agencies announced the arrests of suspects in a major cryptocurrency fraud case.
This case demonstrated an important feature of digital crime investigations: even when stolen funds pass through numerous wallets, additional mistakes made by criminals can make it possible to identify them. Sometimes the decisive factor is not a sophisticated analytical algorithm but the comparison of blockchain data with information that the participants themselves disclose online.
How ZachXBT Helped Establish Lazarus's Involvement in the Bybit Hack
In February 2025, the cryptocurrency exchange Bybit suffered one of the largest thefts in the industry's history. Attackers stole digital assets worth approximately $1.5 billion by exploiting a compromise in the transaction-signing process.
The scale of the incident attracted international attention. To identify the source of the attack, the analytics platform Arkham Intelligence announced a reward for information that could help identify those responsible for the hack.
ZachXBT presented evidence linking the operation to Lazarus Group, a North Korean hacking organization known for attacks against cryptocurrency companies and financial institutions.
The investigation used data on test transfers, related addresses, timing patterns, and the movement of stolen assets. The analysis revealed overlaps with infrastructure previously associated with Lazarus.
Arkham considered the submitted evidence convincing. Subsequently, the U.S. Federal Bureau of Investigation also publicly attributed the Bybit hack to North Korean hackers.
The significance of this investigation extends beyond the individual exchange. It demonstrated that an independent specialist can quickly gather evidence relevant to the analysis of international cybercrime. At the same time, technically establishing connections between wallets and definitively determining the responsibility of specific individuals remain separate tasks.
Investigations Into Fraud Targeting Coinbase Users
Another area of ZachXBT's work involves social engineering. Unlike sophisticated technical hacks, such crimes often rely on psychological manipulation of cryptocurrency holders.
In 2025, the researcher published findings about a suspected group of scammers who impersonated Coinbase support staff. The attackers contacted users, reported fabricated security problems, and persuaded them to take actions that resulted in financial losses.
In one investigation, ZachXBT linked a suspected participant in the scheme to thefts totaling more than $4 million. The analysis showed that some of the stolen assets were transferred to cryptocurrency gambling platforms, while certain transactions were used to convert the funds into other digital currencies.
Such cases demonstrate the limitations of purely technical security measures. Even a secure blockchain cannot prevent a situation in which a user voluntarily provides confidential information to an attacker or approves a malicious transaction.
Investigating these crimes requires examining not only wallet addresses but also the methods used to communicate with victims, fake websites, telephone contact histories, and the financial routes taken after the theft.
Suspicious Transactions Involving Government Cryptocurrency Wallets
In January 2026, ZachXBT presented an investigation into the suspected theft of cryptocurrency linked to assets controlled by U.S. government agencies.
The investigation was prompted by materials posted on Telegram, where one participant demonstrated possession of large amounts of digital assets. The researcher analyzed the publicly displayed addresses and reconstructed the transactions associated with them.
As a result, transactions potentially involving tens of millions of dollars were identified, including funds originating from cryptocurrency assets previously seized by U.S. authorities.
ZachXBT also suggested a possible connection between the suspect and the family of an executive at a company contracted to manage seized cryptocurrencies. However, these allegations required further official verification and could not be regarded as proof of involvement established by a court.
The distinctive feature of this case is that the investigation focused on the infrastructure used to store government-held digital assets. It demonstrates that the risks of compromised keys, inadequate access controls, and abuse exist not only among private investors and cryptocurrency exchanges.
Why ZachXBT's Investigations Influence the Cryptocurrency Market
ZachXBT's publications often trigger rapid responses from the cryptocurrency community. After information about suspicious addresses emerges, exchanges may strengthen their checks, projects may warn users, and analytics companies may add the relevant wallets to their monitoring systems.
The researcher's influence is primarily linked to the public availability of evidence. Many of his reports contain specific transactions that other specialists can verify using blockchain explorers. This distinguishes a technical investigation from unsubstantiated accusations on social media.
However, public disclosure also creates risks. Incorrectly identifying the owner of an address can damage the reputation of an innocent person. Moreover, the movement of funds through a particular wallet does not always prove that its owner knew the assets were derived from criminal activity.
Therefore, high-quality blockchain analysis requires a clear distinction between verified facts, probabilistic connections, and assumptions. Definitively establishing a suspect's identity and role may require bank records, data from cryptocurrency exchanges, search results, and other evidence unavailable to an independent researcher.
How ZachXBT's Work Is Changing the Fight Against Cryptocurrency Crime
ZachXBT's work demonstrates how approaches to investigating financial crimes are changing. In the traditional banking system, much of the information about transfers is confidential and primarily accessible to financial institutions and government agencies. On public blockchains, transaction histories are open, allowing independent analysts to identify suspicious activity without prior access to banking databases.
At the same time, blockchain transparency does not automatically reveal a criminal's identity. A wallet address is a technical identifier, not a set of personal identification details. Identifying its owner requires combining transaction information with additional evidence.
ZachXBT became well known precisely because of his ability to combine these sources. His investigations show that cryptocurrency crimes can leave traces for many years, and attempts to obscure the movement of assets do not always eliminate the possibility of analyzing them.
The main significance of his work lies not only in uncovering individual multimillion-dollar thefts. It is helping establish a practice of independent financial investigation in which public blockchain data becomes a tool for monitoring the movement of digital assets. As the cryptocurrency market develops, the importance of such specialists will increase, because the industry's security depends not only on the reliability of its technologies but also on the ability to detect fraudulent schemes promptly and hold their organizers accountable.
