zachxbt

On-chain detective ZachXBT posted on his personal channel that Revolut allegedly leaked some users' personal identifiable information (PII) due to failing to recognize a forged government agency information request.According to his disclosure, Revolut previously received a request for customer information retrieval that appeared to come from a real government agency and was sent through the agency's official email domain. Because the email had valid domain authentication information, Revolut believed the request was legitimate and responded accordingly.The potentially involved data includes users' names, birth dates, occupations, addresses, email addresses, and phone numbers, as well as copies of passports or driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transaction records. Revolut stated in the notification sent to users that no biometric facial telemetry data was leaked.ZachXBT indicated that the scale of the incident may currently be limited, but it appears to primarily target high-net-worth users. Several Revolut users received notifications regarding the related security incident yesterday. Revolut officials had previously reminded users to verify suspicious information through in-app customer service to avoid providing personal or financial information.

According to on-chain detective ZachXBT's post on his personal channel, Revolut allegedly failed to identify a fraudulent request, resulting in the personal identification information (PII) of some users being leaked. The leaked information includes copies of passports or driver's licenses and verification selfies, account statements, IBANs, withdrawal records, complete transaction histories including Bitcoin transactions, as well as names, birth dates, occupations, home addresses, email addresses, and phone numbers.ZachXBT stated that the number of affected users may be limited, but it appears to target high-net-worth individuals. It is reported that several Revolut users received related security alert emails yesterday.

On-chain investigator ZachXBT posted on X accusing user "Mr Austin Fine" (account "@xmrfine") of exchanging the stolen cryptocurrency assets of victim Malone for luxury goods in exchange for fees, stating that he "may be a whistleblower." ZachXBT indicated that until the victim is compensated, he will consider him "disassociated," which will negatively impact all current and future brand collaborations.ZachXBT later added that he has traced part of the funds on-chain flowing through Monero to purchase cars from the luxury car dealer TBTFW in Los Angeles.

According to on-chain detective ZachXBT's monitoring, multiple verified WOO X users have recently reported that their withdrawals have remained in "pending" or "processing" status for the past three days. WOO X is incubated by Kronos Research and was acquired by FusionX Digital in the fourth quarter of 2025, which is reportedly associated with BitMart founder Sheldon Xia.Previously, BitMart announced the cessation of operations and restructuring on July 26, 2026, with some user funds still unable to be withdrawn, leading to an increase in related complaints on the X platform. Sheldon Xia has stated that user asset security is a priority, but this claim has not yet been independently verified. As of now, WooX has not issued a public statement regarding the withdrawal delay issue.

The cryptocurrency-themed comic creator Bold posted that their wallet was hacked, and all funds in the wallet were stolen. On-chain detective ZachXBT subsequently stated that some of the stolen funds' flow has been tracked.Approximately $51,000 was exchanged for ZEC, about $43,000 was exchanged for ETH; another approximately $43,000 was transferred from Solana to Ethereum via Mayan Finance, around 480 SOL was transferred via Near Intents, and about 51 ZEC was transferred to a blacklisted address via Near Intents.

On-chain detective ZachXBT stated that after reviewing relevant evidence, he found that two American investment platforms, BitcoinIRA and iTrustCapital, allegedly experienced data breaches this year, but neither seems to have publicly disclosed it yet. The leaked information reportedly includes personal details, portfolio, bank and custody account information, verification status, and more.He cited an example where the attacker "Tiffany" targeted a BitcoinIRA user using the relevant database in June this year and stole over $1.2 million. ZachXBT indicated that he contacted both companies for comments on August 21, but had not received a response by the time of publication.

BitMart founder Sheldon stated that regarding the public accountability statement released by a BitMart employee through the official Twitter account, he has completed the collection of evidence related to the content and claims that the information is all false. Sheldon indicated that he will report to the police during the day in the United States and send a lawyer's letter to the X platform, requesting technical and data evidence collection regarding the relevant content. Sheldon also stated that employee assets do not take precedence over customer assets, and everyone is a customer, with no privileges existing. Previously, BitMart employees publicly questioned the whereabouts of platform assets and related handling situations. Sheldon had previously stated that he would respond to the whereabouts of platform assets by the 19th.Blockchain investigator ZachXBT posted on the X platform questioning the BitMart exchange. In response to the relevant account, he stated that if BitMart indeed has sufficient liquidity, it should directly return the funds to all users instead of issuing vague statements. ZachXBT pointed out that BitMart's related actions have caused real users to be unable to use their funds normally, and there is insufficient transparency. This statement has raised market concerns about the safety of the exchange's funds and operational transparency.

On-chain detective ZachXBT posted that U.S. threat actor Tiffany Milanovich participated in the theft of approximately $5 million in crypto assets by impersonating hardware wallet and centralized exchange customer service.Her methods included disguising as Bitcoin IRA email support, during one attack transferring about $1.2 million in BTC and ETH from the victim's Trezor wallet, and in another case stealing about $500,000 in BTC from a Coinbase account. Tiffany induced victims to hand over access to their funds under the guise of "customer service calls," later boasting about the stolen money on social media and Telegram groups, mocking victims with recordings, and collaborating with other threat actors to launder money using phishing panels and instant exchange services, with some of the stolen funds still dormant on-chain.The threat actor codenamed "Tiffany" is suspected of participating in multiple crypto asset thefts, gambling the stolen funds at crypto casinos. The platform Shuffle has frozen related accounts based on evidence submitted by ZachXBT; Tiffany previously shared a search and seizure warrant from Connecticut, dated before some of the incidents involved.ZachXBT has obtained chat logs, recordings, and on-chain evidence, anticipating that this individual may face further legal consequences. This threat actor is also linked to the John Daghita (Lick) case, who is suspected of stealing over $46 million in crypto assets from a U.S. government-seized wallet.

On-chain data shows that cryptocurrency theft suspect Dritan Kapllani Jr laundered 126.7 ETH again on July 22, worth approximately $239,000.Previously, on-chain detective ZachXBT revealed that Dritan Kapllani Jr is suspected of stealing assets from cryptocurrency holders through social engineering techniques, with a total amount involved reaching $19 million. Dritan Kapllani Jr has long showcased a lifestyle featuring luxury cars, high-end watches, and private jets on social media, and publicly displayed assets worth $3.68 million in his Exodus wallet during a Discord call on April 23, 2026.

According to The Block, Trezor's Chief Business Officer Danny Sanders refuted recent criticisms of cryptocurrency hardware wallets made by blockchain investigator ZachXBT.Earlier this week, ZachXBT posted on Telegram, "All hardware wallets are complete garbage and I do not recommend using them for important tasks such as signing transactions or storing funds," and suggested that users use a dedicated iPhone to store funds and sign transactions.In response, Sanders acknowledged in an interview that firmware/software updates for hardware wallets can sometimes interfere with urgent or large transactions, and that the user experience can indeed be "clunky," understanding the users' frustration. However, he opposed ZachXBT's blanket statement: while hardware wallets may not be the best single solution for advanced users managing large amounts of funds, they are not garbage.He pointed out that compared to hardware wallets, the operating system and connectivity features of an iPhone present more "attack risks." For the average cryptocurrency user, hardware wallets remain the best self-custody option available.

On-chain detective ZachXBT updated on X that an entity initially funded by the LAB team deposited 18.4 million LAB into Aster, approximately 18.3 million USD, and sold it on the DEX spot market, causing the LAB price to drop again by 54%, from 1.2 USD to 0.55 USD.ZachXBT stated that this entity transferred LAB to 3 Aster deposit addresses between July 10 and 11, and currently holds about 81.5 million LAB. He added that the entity received over 196 million LAB from the LAB team in April 2026, subsequently transferred to a Bitget address, and withdrew from Bitget to 10 addresses between May 11 and 12.ZachXBT has previously questioned the existence of market manipulation and insider supply issues with LAB, claiming that one of the multi-signers from the LAB team had financial ties to addresses related to RIVER manipulation, and pointed out that nearly 226 million LAB was deposited into Bitget between March and April.

On-chain detective ZachXBT posted that an early whale address related to the initial allocation of the Solana genesis block was suspected to have been attacked a few hours ago, with approximately 180,900 SOL (about 14.2 million USD) stolen.ZachXBT stated that in collaboration with the on-chain investigation agency Specter Investigation, they discovered abnormal unstaking and cross-chain operations to Ethereum while tracking unusual fund flows, and subsequently confirmed that the related assets had been transferred.Currently, the involved victim address and several suspected theft addresses have been made public, and the specific method of attack and the whereabouts of the funds are still under further investigation.

On-chain investigator ZachXBT posted that the LAB token has dropped from $14 to less than $2 in the past 24 hours, a decline of about 85%, with the fully diluted valuation (FDV) significantly shrinking from about $14 billion.ZachXBT expressed disappointment that Binance, Bitget, and Gate failed to take measures in advance to prevent price manipulation, stating that if centralized exchanges truly valued user interests, they should at least return the profits from accounts suspected of manipulating the market to the users. He also pointed out that LAB investors were originally scheduled to start unlocking tokens later this month, but the vesting arrangements have been modified multiple times before, with insiders controlling almost the entire circulating supply and implementing extreme price manipulation through market makers on centralized exchanges. Therefore, he "does not recommend trading LAB under any circumstances."

On-chain detective ZachXBT stated on X that unless the case involves recent events, each victim has lost more than $250,000, the jurisdiction is favorable, the relevant chain supports their work, and it does not involve meme coins or prediction markets, they will not review or respond to related case requests.

On-chain detective ZachXBT disclosed on his personal channel that a hacker extracted approximately 3,200 ETH through Tornado Cash between July 2 and 3. The funds are related to two private key leakage incidents. The address subsequently used Circle's CCTP cross-chain bridge to launder approximately $5,500,000 in assets across chains and further transferred USDC to seven deposit addresses on the Arbitrum network.ZachXBT pointed out that the flow of funds exhibits a typical decentralized money laundering path, utilizing mixing tools and cross-chain infrastructure to reduce tracking difficulty. Currently, the related on-chain assets are still in circulation.

According to on-chain detective ZachXBT, multiple reports indicate that the centralized cryptocurrency exchange AscendEX (formerly Bitmax) has recently delayed or failed to process users' withdrawal requests for several days or even weeks, yet the platform continues to accept user deposits.As early as the initial warning on June 26, ZachXBT pointed out that, after reviewing on-chain data from Arkham and TRM, several known hot wallets of AscendEX (covering EVM, Tron, and Solana networks) severely lack major market cap tokens such as ETH, USDT, and SOL, indicating that the platform is likely facing a serious liquidity crisis.The latest situation shows that, in the 9 days since the first warning, the official X account of AscendEX has remained inactive, and the platform's co-founder George (Jing) Cao has not responded to inquiries from users with large amounts of trapped funds. Currently, ZachXBT strongly advises users unable to withdraw their funds to report to law enforcement and regulatory agencies in their respective countries or regions as soon as possible.It is reported that AscendEX was founded by George (Jing) Cao and Ariel Ling in 2018. In December 2021, the platform was attacked by the hacker group Lazarus Group, resulting in approximately $78 million in asset losses.

On-chain detective ZachXBT stated that during the migration from the traditional private messaging system to XChat, the X platform encountered multiple technical bugs. At the same time, the reliability of the platform's search function declined, affecting information retrieval efficiency. More importantly, the X platform's algorithm has a "traffic bottleneck" for cryptocurrency content, making it easier for content to be restricted within the cryptocurrency vertical, thereby reducing the ability to reach a broader audience.

According to on-chain detective ZachXBT's monitoring, it was found that signs of mixing appeared in the funds stolen from the Humanity Protocol and Kelp DAO vulnerability attacks one hour ago, indicating that there may be an overlap between the attackers of these two incidents.Based on this new evidence, it can be largely ruled out that the theft case of Humanity Protocol was committed by an insider.

ZachXBT released a community alert on platform X, reporting that the centralized exchange AscendEX (formerly Bitmax) has been reported by multiple users for withdrawal delays ranging from days to weeks, and in some cases, withdrawals cannot be processed at all. ZachXBT checked the known hot wallets of the exchange through Arkham and TRM and found that its reserves lack mainstream large-cap tokens such as ETH, USDT, and SOL, which may indicate liquidity issues.AscendEX was founded by George Cao and Ariel Ling in 2018 and was hacked by the Lazarus Group in December 2021, resulting in a loss of approximately $78 million.

According to "On-Chain Detective" ZachXBT's post on his personal channel, Polish social engineering attacker Wojtek Kulisz (online name "Merry") was recently suspected of being raided by Polish law enforcement, along with three others being taken away.Although the official press release did not disclose his name or photo, several designer clothing and jewelry items displayed on his public Instagram account "wojtekk" are highly consistent with the items seized during the police operation. The related case is led by the Polish Central Cyber Crime Fighting Department (CBZC) and has received assistance from agencies such as the FBI and HSI.