Skip to content

person

ZachXBT

Pseudonymous on-chain investigator who traces cryptocurrency hacks and scams, publicly pressuring exchanges and attackers to return stolen funds.

Known aliases

  • @zachxbt
  • Zach XBT

Relationships

No evidence-backed relationships are recorded.

Current stories

invest6 publishers

ZachXBT staked $349.7K of his own money to pose as a client of North Korea's launderers

ZachXBT says he fronted $349.7K in USDC to pose as a client of the Chinese syndicate laundering North Korea's Bybit haul. The only recovery on record, a 442K USDT freeze by Tether, covers at most 3.7% of the $12M+ cluster he says the sting exposed.

Perspective Coverage

6 publishers
Builder
Builder 24%
Operator
Operator 51%
Investor
Investor 25%

Reality

Evidence45
Adoption
Insufficient
Hype gap+35
Incentives40
Confidence55
invest4 publishers

NEAR Intents recovers all $3.8 million lost to a bug in its deposit-and-withdrawal layer

NEAR Intents got back all $3.8 million drained through a bug between its Omni deposit-and-withdrawal layer and its contract, after encrypted talks. Whether that layer is safe now rests on the patch, since every user who lets the protocol choose a bridge depends on it.

Perspective Coverage

4 publishers
Builder
Builder 31%
Operator
Operator 45%
Investor
Investor 24%

Reality

Evidence74
Adoption55
Hype gap+15
Incentives60
Confidence72
invest5 publishers

Attacker drains $3.8 million from Near Intents via bug in Omni deposit and withdrawal layer

Near Intents halted its cross-chain swap service after a bug in its Omni deposit layer let an attacker take about $3.8 million. Crypto balances carry no deposit insurance, so affected users are relying on the operator's promise to repay them in full.

Perspective Coverage

5 publishers
Builder
Builder 23%
Operator
Operator 44%
Investor
Investor 33%

Reality

Evidence70
Adoption55
Hype gap+15
Incentives60
Confidence65
invest1 publisher

Grayscale's Zcash fund loses a tenth of its net inflows in a single day

Grayscale's Zcash ETF recorded a $30.25 million net outflow on Sept. 30, leaving cumulative net inflows near $268 million. With ZEC 21% below its late-September peak, the next flow prints will show whether the fund's buyers stay with the coin after its run.

Publishers:decrypt.co

Reality

Evidence45
Adoption35
Hype gap+10
Incentives
Insufficient
Confidence45
invest5 publishers

A fake Google and Gemini call delivered 94% of the thefts named in Malone Lam's plea

Prosecutors valued the take at 4,100 bitcoin, more than $245 million, drained after one Washington holder granted Google Drive access and read out security codes; every other victim named in the case totals about $14.8 million.

Perspective Coverage

5 publishers
Builder
Builder 19%
Operator
Operator 49%
Investor
Investor 32%

Reality

Evidence68
Adoption
Insufficient
Hype gap+20
Incentives
Insufficient
Confidence64
invest5 publishers

Revolut released passports and Bitcoin histories on an email that passed domain authentication

The request came from an unauthorized account on a real government domain, and Revolut acted on it. The company calls the number of affected customers limited, and it declined to say how many or name the agency.

Perspective Coverage

5 publishers
Builder
Builder 23%
Operator
Operator 55%
Investor
Investor 22%

Reality

Evidence68
Adoption
Insufficient
Hype gap+10
Incentives55
Confidence66
security8 publishers

Revolut handed over passports to a rogue account inside a real government domain

The fraudulent request passed domain authentication because it genuinely came from the agency's mail domain, sent by an account the agency had not authorised. Revolut found out only when it called the agency to check.

Perspective Coverage

8 publishers
Builder
Builder 11%
Operator
Operator 70%
Investor
Investor 19%

Reality

Evidence68
Adoption
Insufficient
Hype gap+5
Incentives55
Confidence66
invest3 publishers

Hackers priced 680 Revolut customer files at roughly $4,300 each

The group calling itself iamnotavillain wants 6,000 Monero within 24 hours and Revolut says no demand has reached it. The data went out through a government email account the bank was obliged to answer.

Perspective Coverage

3 publishers
Builder
Builder 22%
Operator
Operator 51%
Investor
Investor 27%

Reality

Evidence55
Adoption
Insufficient
Hype gap+10
Incentives60
Confidence55