Who is ZachXBT?

ZachXBT is a pseudonymous blockchain investigator known on crypto X (formerly Twitter) for exposing scams, rug pulls, and thefts. Through detailed onchain analysis and open-source research, he publishes threads that trace stolen funds, unmask bad actors, and connect fraud across the ecosystem.

Operating independently, his investigations have helped recover hundreds of millions in stolen crypto and led to real legal consequences, including arrests and asset seizures. Wired has described him as the most prolific independent crypto-focused detective in the world, and CoinDesk named him to its Most Influential 2024 list.

He remains anonymous, represented by a cartoon platypus in a detective's trench coat that has become his signature. That anonymity works as both a personal safety measure and a defining feature of his role as crypto's unofficial, self-made investigator.

ZachXBT's Origin Story

ZachXBT's path into crypto began like many others: early optimism followed by painful lessons. During the 2017 ICO boom, he was a regular user who bought into hyped tokens and NFT projects, watching several collapse in classic rug pulls that would later shape his focus.

A wallet hack around 2018 cost him roughly $15,000, a personal low that redirected his attention. Rather than leaving the space, he began studying blockchain data closely, learning to trace wallets, follow fund flows, and understand exactly how crypto scams are built and executed.

By his own account, he has no formal training in investigations or law enforcement, describing his skills as entirely self-taught through years of onchain analysis. His early threads on phishing rings and NFT fraud built the reputation that would eventually make him crypto's go-to forensic voice.

How Does ZachXBT Investigate Scams?

To expose crypto fraud, ZachXBT combines blockchain forensics with open-source intelligence, tracing stolen funds, unmasking perpetrators, and linking scams across time. His methodology has grown more refined as thefts have shifted from smart-contract exploits toward social engineering.

Here is how his process typically breaks down:

• Blockchain analysis: He traces token flows using tools like Etherscan, Arkham, and Breadcrumbs, following transfers across wallets, exchanges, and mixers to map how funds move.
• Smart contract tracking: He inspects scam contract deployments for reused bytecode, recycled deployer wallets, and suspicious funding origins that betray repeat offenders.
• Wallet clustering: He links addresses through shared gas funding, synchronized transaction timing, and common endpoints such as centralized exchange deposit accounts.
• Social media intelligence: He correlates onchain activity with usernames, messages, and timestamps across X, Telegram, and Discord to identify recurring players.
• Leaked recordings: He increasingly relies on screen recordings from private group chats, where suspects inadvertently reveal wallets, names, or balances while boasting.
• Identity linkage: He cross-references domain registrations, court filings, and public records to connect blockchain activity to real names, emails, or other identifiers.
• Case presentation: He assembles findings into annotated X threads with token trails and receipts, often sharing evidence with law enforcement before publishing.

Major Investigations and Scams Exposed by ZachXBT

ZachXBT's record since 2021 spans billions in illicit flows and direct help recovering stolen assets. Paradigm co-founder Matt Huang has stated ZachXBT helped recover more than $350 million for victims of hacks and scams, across NFT rugs, phishing rings, DeFi exploits, and state-linked heists.

1. Bybit Hack (Feb 2025)

On February 21, 2025, Bybit lost roughly $1.5 billion in Ethereum assets, the largest single theft in crypto history at the time. Within hours, ZachXBT submitted evidence to Arkham identifying North Korea's Lazarus Group as the culprit, later confirmed by the FBI.

• Scam amount: Around $1.5 billion, drained from an Ethereum multisig cold wallet during a routine transfer.
• Key facts: He linked the attack to the earlier Phemex hack through commingled funds and matching laundering patterns.
• Result: He earned a 50,000 ARKM bounty (~$31,500); later seizures in Greece and Germany recovered portions of the funds.

2. Genesis Creditor Theft (2024-2025)

In August 2024, ZachXBT traced 4,064 BTC (~$243 million) stolen from a single Genesis creditor via Gemini. Attackers posed as Google and Gemini support, reset the victim's 2FA, and extracted private keys through remote access software.

• Scam amount: Roughly $243 million in Bitcoin, some of it dormant since 2012.
• Key facts: A leaked Discord recording exposed a suspect's real name; funds were split across 15+ exchanges and multiple coins.
• Result: Suspects Malone Lam, Veer Chetal, and Jeandiel Serrano faced US prosecution; a further suspect was reportedly arrested in Dubai in late 2025.

3. Coinbase Social Engineering Wave (2024-2025)

ZachXBT repeatedly flagged that Coinbase users were losing an estimated $300 million a year to support-impersonation scams. The problem traced back to a bribery-driven insider breach that exposed data on nearly 70,000 users.

• Scam amount: Around $300 million annually across users; Coinbase estimated $180-400 million in breach-related costs.
• Key facts: He identified a Canadian actor, "Haby," who allegedly stole over $2 million and flaunted proceeds on social media.
• Result: An outsourced support agent was arrested in India in December 2025; the DOJ opened an investigation into the breach.

4. USMS "Lick" Investigation (Jan-Mar 2026)

In early 2026, ZachXBT alleged that a figure known as "Lick" had stolen more than $46 million from wallets managed by the US Marshals Service. The lead surfaced from a leaked Telegram dispute where a participant screen-shared control of government-linked addresses.

• Scam amount: Over $46 million tied to seized digital assets under federal custody.
• Key facts: He identified the suspect as John Daghita, whose father's firm held a USMS custody contract awarded in 2024.
• Result: The FBI arrested Daghita in Saint Martin in March 2026; the case raised alarm over outsourced custody of seized crypto.

5. Other Notable Investigations

Beyond the headline cases, ZachXBT has uncovered dozens of smaller yet damaging schemes across influencers, exchanges, and social-engineering crews operating within circles known online as "The Com."

• Axiom insider trading (Feb 2026): He named trading platform Axiom, alleging employees abused internal support tools to view private wallet data after generating $390M+ in revenue.
• Dritan Kapllani Jr. (May 2026): He linked an 18-year-old to roughly $19 million in social-engineering thefts, using Discord "flex" recordings and unsealed court filings as evidence.
• DPRK IT worker network (Apr 2026): He exposed a North Korean operation generating about $1 million monthly through fake identities, forged documents, and crypto-to-fiat conversions.
• Machi Big Brother (2022-2023): He alleged Jeff Huang withdrew 22,000 ETH from a treasury wallet; Huang sued for defamation but later dropped the case.
• Influencer pump-and-dumps (2022): In a 17-part thread, he documented how figures like Lark Davis received token allocations, hyped them, and sold for undisclosed profits.
• DeGods NFT recovery (2023-2024): He traced a stolen 99 ETH NFT, followed the attacker's wallet, and helped recover most of the value for the victim.

ZachXBT and the Lazarus Group

ZachXBT has become central to tracing funds tied to Lazarus Group, the North Korean unit behind many of crypto's largest exploits. His involvement deepened in 2022 as Lazarus targeted cross-chain bridges, and it reached a peak with the Bybit attribution in 2025.

In mid-2022 he analyzed the $100 million Horizon Bridge hack, showing how funds moved through Tornado Cash and dispersed across fresh wallets. His visual breakdowns helped the public understand how state-linked actors weaponize DeFi tools to launder crypto and evade sanctions.

By 2025 and 2026, his work had scaled to sovereign-level threats. Beyond the Bybit case, he mapped how DPRK groups stole an estimated $2.02 billion in 2025 alone, per Chainalysis, roughly 60% of all crypto theft that year, and exposed the fake-identity IT worker schemes funding the regime.

Why Attribution Matters

Attributing hacks to Lazarus is not just a technical exercise; it shapes real-world response. Fast, credible attribution lets exchanges freeze funds, informs government sanctions, and warns the wider market, which is why ZachXBT's rapid Bybit submission carried weight far beyond a bounty.

His speed is part of the story. Fellow investigator Nick Bax has described ZachXBT manually analyzing around 500 transactions in roughly 12 hours, an output rate that lets him publish credible attributions while stolen funds are still moving and potentially recoverable.

What Is ZachXBT Working On in 2026?

ZachXBT's 2026 focus has shifted from isolated scams toward systemic problems: insider misconduct at profitable firms, industrial-scale laundering, and gaps in how exchanges and governments handle custody. His reach now extends into formal industry infrastructure.

Key threads defining his recent work include:

• Exchange accountability: He has publicly pressured platforms he accuses of ignoring illicit flows, including sharp criticism of KuCoin and disputes over funds he says exchanges withheld.
• Institutional partnerships: In February 2025 he joined Paradigm as an incident response advisor, and in August 2025 became a launch partner for TRM Labs' real-time Beacon Network.
• Insider trading: His Axiom probe spotlighted how employees at fast-growing firms can exploit internal data, a theme he warns is now the industry's biggest under-covered risk.
• Prediction market spillover: His teased investigations increasingly move Polymarket odds, with the Axiom teaser alone drawing tens of millions in speculative volume.
• Jurisdiction pushback: In mid-2026 he said he would stop taking Canadian fraud cases, citing weak enforcement and labeling Toronto a leading cybercrime hub.
• AI-driven fraud: He has flagged how deepfakes and automated phishing kits are industrializing scams, raising the stakes for both victims and investigators.

ZachXBT's Net Worth and Funding

ZachXBT has no confirmed net worth and previously denied a $250 million claim built on a misattributed exchange wallet. His income derives from community donations, legal crowdfunding exceeding $1 million, bounties, and occasional paid engagements from major theft victims.

Documented rewards include a $150,000 Arkham bounty for exposing Martin Shkreli as the DJT token creator, the ~$31,500 ARKM bounty for the Bybit attribution, and 150,000 OP tokens from Optimism's RetroPGF. He generally provides investigative work without charge, reserving fees for large incident-response cases.

ZachXBT Challenges and Controversies

It has not all been wins and praise. Being crypto's most visible investigator has drawn lawsuits, community scrutiny, taunts from criminals, and, most recently, pointed questions about his own independence and funding relationships.

Here are some of the most notable challenges he has faced:

• Defamation lawsuit: In 2023, Jeff "Machi" Huang sued him over the 22,000 ETH report; the case was dropped after edits and over $1 million in legal donations.
• Identity exposure: Court filings from that case named him as Zachary Wolk of Texas, and a viral May 2026 thread claimed to confirm his identity through open-source research.
• Conflict-of-interest claims: The same thread alleged he stopped critical coverage of Hyperliquid after receiving 10,000 HYPE tokens, an accusation he and supporters dispute as unverified.
• Token controversy: In early 2025 he withdrew roughly $3.9 million from a tribute memecoin pool, drawing accusations of hypocrisy despite saying the tokens were unsolicited.
• Information asymmetry: Critics noted that wallets bet against Axiom on Polymarket hours before his report, raising questions about leaks during his standard pre-publication outreach.
• Threats from scammers: In 2024, a hacker behind a $243 million theft mocked him with an onchain message, showing that the criminals he tracks sometimes respond directly.

Final Thoughts

ZachXBT's rise from an anonymous scam victim to the industry's most trusted fraud tracker is a rare kind of crypto folklore. With no formal training, he has helped unravel cases worth billions using little more than curiosity, blockchain data, and a relentless refusal to let stolen funds disappear quietly.

What stands out to us in 2026 is how his story has matured into something more complicated. The same visibility that lets him freeze Lazarus funds and trigger arrests now turns the lens back on him, forcing an uncomfortable but healthy question about who watches the watchdog.

That tension may be the truest sign of his impact. As long as scams move onchain, ZachXBT will be there to follow the trail, and as long as he holds real influence, the industry will keep asking him to meet the same standard of transparency he demands of everyone else.