Investigations that connect crypto thefts and scams to transaction trails, communications and public records.
Why read ZachXBT?
Read ZachXBT when you want to understand how stolen funds moved and what connects an incident to the people accused of carrying it out. His September 2024 investigation into a $243 million theft combines blockchain transactions with recordings and communications. A reused deposit address is one specific clue he explains: it connects the laundering trail back to stolen funds.
His Bybit and Phemex post offers a smaller example of the same approach: he identifies commingled funds as a connection between two incidents. Start with the transaction claim, then follow the case updates and the evidence used for attribution. His public researcher statement also explains his incident-response work and his advisory relationship with Paradigm.
Start with the original
Selected work
Investigation ·
The $243 million social-engineering theft investigation
How can a money trail help explain a theft? Start with the incident summary, then point 11b on a reused deposit address. The thread also shows why identifying people requires evidence beyond transaction links.
Investigation ·
An onchain connection between the Bybit and Phemex hacks
What connects two separate incidents? His post identifies an overlap address and commingled funds. It is a compact starting point for following the underlying tracing claim.
Projects & roles
Investigations by ZachXBT
His public channel for investigations, alerts and case updates, linked from his own researcher statement.
Paradigm
He announced an incident-response advisory role in February 2025.