Connects transaction trails with malware analysis, archived exchange data and case documents to explain how a crypto investigation is built.
Why read Nick Bax?
Nick Bax is useful when a transaction graph does not tell you who controlled an address. His Electrum Atom case study moves from clipboard-hijacking malware to exchange records and documents obtained in a civil case. Read it to distinguish a visible transfer, a statistical connection and an allegation about a person. The article records that the defendants denied involvement.
His WannaCry repository exposes the data and code behind a historical tracing method. Start with the README's account of what each dataset contains, then inspect how the Python script combined Monero payment IDs with exchange responses. The exchange leak was fixed in 2021, so this is a method to study rather than a claim that any present-day Monero transfer can be traced. His 2023 article also discloses commercial expert-consulting work.
Start with the original
Selected work
-
Investigation ·
Anatomy of a Bitcoin Heist: The Electrum Atom Malware Saga
Follow the change from malware addresses to exchange records and corroborating documents. It explains evidence presented in an ongoing case as of publication, including disputed allegations.
Cite this selection
XFollowList, “Anatomy of a Bitcoin Heist: The Electrum Atom Malware Saga” reading notes in the Nick Bax profile. https://xfollowlist.com/people/nick-bax#work-5ca0c72d2477
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
-
Research repository
WannaCry Monero tracing: data and Menelaus proof of concept
Read the dataset descriptions before menelausXMR0.3.py. The README states that the ShapeShift leak was fixed in 2021 and the method no longer works as it did then.
Cite this selection
XFollowList, “WannaCry Monero tracing: data and Menelaus proof of concept” reading notes in the Nick Bax profile. https://xfollowlist.com/people/nick-bax#work-d6c437321092
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original publication date is unknown.
Profile-source checking date and references · Dated reading map
Projects & roles
WannaCry tracing research
His public research repository contains historical exchange data, consolidation transaction identifiers and proof-of-concept code.
Community rating
Sources & further reading
Profile sources checked . This describes checking these references, separately from the publication dates of selected works.
- Public GitHub profile under the name Nick Bax and owner of the research repository.
- His March 2026 Gist links x.com/bax1337.
- His bylined case study discloses Five I's LLC consulting and expert-witness services in its 2023 context.
Cite this profile’s source check
XFollowList, Nick Bax profile sources. Sources checked 2026-10-11. https://xfollowlist.com/people/nick-bax#sources-checked