Over the past week multiple people created ZACHXBT meme coins on various chains using my likeness to take advantage of the recent narrative.
None of the tokens were promoted by myself as I have always stated I will never support or launch a meme coin.
All tokens sent to my donation wallet were market sold and the entire amount was sent to charity.
~$41K total was donated to Direct Relief & Give Directly via The Giving Block to support the Venezuela earthquake response.
Transaction reciepts:
1). 25K USDT sent to Give Directly on July 6, 2026 at 4:16 am UTC
0x687556d7011b0750f3daf9e3a9f800d04ba233c84362faf8c3851b40cd0f71ae
2). 5k USDT sent to Direct Relief on July 6, 2026 at 4:51 am UTC
0xc9146816d5c0d97b432d663b422b46854ba6e047ce7e9ea8073d43c1205ba070
3). 153 SOL ($11K) total sent to Direct Relief on June 28, 2026
44idg3MiJiprAnqBbt5fZM9K4deDzZdqnJ3dPtS6hFLqQk3omvqWz7LjgCapMX94q7Ba3NznoCsgpdWFUysjHHuX
4Cm8hrg9Fgwrgot6GkqNtNdhjb4o48dintU1Wz8DBuZBuvGsSQjv4VE5KAivTPy7okj1XxJtEyqAaecJr8xAiXhi
None of the tokens were promoted by myself as I have always stated I will never support or launch a meme coin.
All tokens sent to my donation wallet were market sold and the entire amount was sent to charity.
~$41K total was donated to Direct Relief & Give Directly via The Giving Block to support the Venezuela earthquake response.
Transaction reciepts:
1). 25K USDT sent to Give Directly on July 6, 2026 at 4:16 am UTC
0x687556d7011b0750f3daf9e3a9f800d04ba233c84362faf8c3851b40cd0f71ae
2). 5k USDT sent to Direct Relief on July 6, 2026 at 4:51 am UTC
0xc9146816d5c0d97b432d663b422b46854ba6e047ce7e9ea8073d43c1205ba070
3). 153 SOL ($11K) total sent to Direct Relief on June 28, 2026
44idg3MiJiprAnqBbt5fZM9K4deDzZdqnJ3dPtS6hFLqQk3omvqWz7LjgCapMX94q7Ba3NznoCsgpdWFUysjHHuX
4Cm8hrg9Fgwrgot6GkqNtNdhjb4o48dintU1Wz8DBuZBuvGsSQjv4VE5KAivTPy7okj1XxJtEyqAaecJr8xAiXhi
❤692👍140🔥62😭29😁23❤🔥21💯13🤪12🥰11✍10🤯10
Investigations by ZachXBT
Update: AscendEX has not posted on X (Twitter) for 9 days since my post and user withdrawals are still not being processed while deposits are being accepted. I reviewed a case where a large victim has been getting no response from the AscendEX co-founder…
Update 2: AscendEX published the following announcement stating they will cease operations as the team blames current market conditions and MiCA.
AscendEX admits in its announcement withdrawals may or may not be processed.
Their public hot wallets still do not have liquid assets to process withdrawals for the multiple 7 figures in user claims I have verified.
Users with assets stuck should file a report with law enforcement and regulators in your country to hold its co-founder George (Jing) Cao responsible.
AscendEX admits in its announcement withdrawals may or may not be processed.
Their public hot wallets still do not have liquid assets to process withdrawals for the multiple 7 figures in user claims I have verified.
Users with assets stuck should file a report with law enforcement and regulators in your country to hold its co-founder George (Jing) Cao responsible.
😢147😭95🤬56❤46👍37🗿17👏12💊9🤷♀8🤔7😡5
An early Solana whale tied to the initial Genesis block distribution appears to have likely had 180.9K SOL ($14.2M) stolen a few hours ago.
I began reviewing the irregular unstaking and bridging activity from Solana to Ethereum with @specterinvestigation who first spotted these movements.
Victim
Theft address
I began reviewing the irregular unstaking and bridging activity from Solana to Ethereum with @specterinvestigation who first spotted these movements.
Victim
HwtbQBNnLERakdUDuCCLWmUs2oETLFQZeHUWeQdPads
Theft address
Ffd1oB2aYM5UzMYUM7TmxULDRQb6KzgrBwmgj9U1C2bE
653pnn5fzF51FfotBwxua55Es4QXxTdaXJLbPczVmswp
0xaa5cfa4e96dda0f9aa30f4dc948b542a9b5817c6
0x536b4ee7507c41143e1b0bd1bf3f2b84be404836
0xbf11bdfbeb9ed137c352c81e45d191cacae6b0cf😭260😱121❤47👍29🤣22👀20🤯14🫡14🔥12😁7🌚7
Investigations by ZachXBT
An entity previously received ESPORTS, RIVER, & LIGHT tokens via Sablier vesting contract and is also directly tied to a signer on three LAB multisigs. These four BSC tokens have experienced market manipulation incidents on centralized exchanges. I peviously…
Community alert: Over the past 48 hour an entity initially funded by the LAB team deposited 18.4M LAB ($18.3M) to Aster and began selling LAB spot on the DEX which has caused the LAB price to drop another -54% from $1.2 to $0.55.
The entity received 196M+ LAB from the LAB team in April 2026 and transferred LAB to four Bitget deposit addresses.
On April 8 100M LAB total was transferred by the entity to two Bitget deposit addresses:
From April 23 to 25 96M LAB total was transferred by the entity to two Bitget deposit addresses:
From May 11 to 12 ~100M LAB was withdrawn from Bitget to ten addresses as market data from the period did not support any independent party accumulating a position of that size. Thus indicates the same entity. The LAB withdrawn sat dormant until this week.
From July 10 to 11 the entity began transferring LAB to three Aster deposit addresses and currently still holds another 81.5M LAB:
In May 2026 I published an investigation on X detailing how the LAB team engaged in opaque private loans/OTC, unilateral vesting changes, >95% supply control, and irregular MM activity.
This week the LAB price collapsed shortly before the rumored unlocks were scheduled to begin. After the LAB team made a vague announcement stating it was due to "large market participants".
It is disappointing no action was taken by Bitget, Binance, or Gate for allowing blatant market manipulation on tokens against users.
The entity received 196M+ LAB from the LAB team in April 2026 and transferred LAB to four Bitget deposit addresses.
On April 8 100M LAB total was transferred by the entity to two Bitget deposit addresses:
0xe39f91a0daffc5547ada79a09be30b8556f7dfba
0x77156a0a621d2ac7a075c0ac3172707c2e4aa191From April 23 to 25 96M LAB total was transferred by the entity to two Bitget deposit addresses:
0x6593aa6c31c88397c37f71259625ec92fe4ee0bf
0xdd77bfbdc11cd37fd255ae35a4ac39df1f9d570aFrom May 11 to 12 ~100M LAB was withdrawn from Bitget to ten addresses as market data from the period did not support any independent party accumulating a position of that size. Thus indicates the same entity. The LAB withdrawn sat dormant until this week.
From July 10 to 11 the entity began transferring LAB to three Aster deposit addresses and currently still holds another 81.5M LAB:
0xaad30cab22f772c1658b7845b5837d35bf3a467a
0x76ccfde9819500204985580d235dd8326fa0b241
0x628dd74f428a81cd34ece11331a7f1593f76047aIn May 2026 I published an investigation on X detailing how the LAB team engaged in opaque private loans/OTC, unilateral vesting changes, >95% supply control, and irregular MM activity.
This week the LAB price collapsed shortly before the rumored unlocks were scheduled to begin. After the LAB team made a vague announcement stating it was due to "large market participants".
It is disappointing no action was taken by Bitget, Binance, or Gate for allowing blatant market manipulation on tokens against users.
❤261👍95🤯45🍾31😁22👏16👀14🥱13🗿12✍6🦄5
Hot take: All hardware wallets are complete garbage and l do not advise using them for important tasks like signing transactions or storing funds.
Much better to have a separate iPhone with its only purpose being to use as your hardware wallet.
Ledger is the worst and Ledger Live has regular updates for UI / apps for no good reason that break simple actions.
(Only do this if you are not low iq)
Much better to have a separate iPhone with its only purpose being to use as your hardware wallet.
Ledger is the worst and Ledger Live has regular updates for UI / apps for no good reason that break simple actions.
(Only do this if you are not low iq)
😭841👍506💯254👎200❤165😱73🤔72😁66🤨52🔥36🥴34
It appears the bridge TeleSwap had a $735K+ exploit on July 15, 2026 and still has not disclosed the incident publicly after five days.
Shortly after the suspicious outflows its Bitcoin hot wallet stopped processing transactions. Two hours ago the attacker deposited the funds to Tornado.
Theft addresses
TeleSwap Bitcoin hot wallet
Shortly after the suspicious outflows its Bitcoin hot wallet stopped processing transactions. Two hours ago the attacker deposited the funds to Tornado.
Theft addresses
bc1pz95zv3qhpmt52yezs84a5zrddrk5jsxm8a60rln5kzlk06e87a3q8pf79l
0x2448cbaee50a67030692b7519a954e5550dc2718
0xfc5048fbba2f74ed482ffcd7663601f818c5bb470xf8706a51f8df01a71f408e50c901dd14916a12c7TeleSwap Bitcoin hot wallet
bc1q5wnpn4k99wc587maaaa6eqnx27g4r6mduxg2s5😭236🤣122❤57👍38🤬33😱22🐳22👎16🔥15👏10🙏9
Telegram keeps allowing scam ads to be displayed in my channel to subscribers.
If you are a premium user please consider using boosts for my channel https://t.me/boost/investigations so I can unlock the feature to disable ads (need to hit level 50).
If you are a premium user please consider using boosts for my channel https://t.me/boost/investigations so I can unlock the feature to disable ads (need to hit level 50).
👎2.53K🤣762👍265❤135😭89🌚31😁26🙈20👀19🔥11🥰10
Bottom 5 jurisdictions globally for victims ranked in order:
🥇 Canada
🥈 UK
🥉 India
4). Nigeria
5). Morocco, Algeria, or Bangladesh
(If you contact me from any of these countries I will likely automatically decline the case)
🥇 Canada
🥈 UK
🥉 India
4). Nigeria
5). Morocco, Algeria, or Bangladesh
(If you contact me from any of these countries I will likely automatically decline the case)
👎1.48K🤣1.06K😭228❤131👍108🔥46🙈33🦄29👏24🤝17⚡15
Community Alert: I've reviewed evidence that two US based investment platforms: BitcoinIRA & iTrustCapital allegedly had data breaches this year but appear to have not disclosed the incidents publicly.
Leaked info: Personal details, Portfolio holdings, Banking details, Custodian details, Verification status, etc
Example: Threat actor ‘Tiffany’ targeted a BitcoinIRA user and stole $1.2M+ using the db in June 2026.
I reached out to both companies for comment on August 21 but have not heard back yet.
Leaked info: Personal details, Portfolio holdings, Banking details, Custodian details, Verification status, etc
Example: Threat actor ‘Tiffany’ targeted a BitcoinIRA user and stole $1.2M+ using the db in June 2026.
I reached out to both companies for comment on August 21 but have not heard back yet.
🔥317🤯254❤108🤬75👍57😭32⚡24😁19🥴19😈11🥰3
Community Alert: Multiple verified WooX users have reported withdrawals stuck in pending or processing over the past three days.
WooX was incubated by Kronos Research, and in Q4 2025 it was acquired by FusionX Digital, a firm which allegedly has ties to BitMart founder Sheldon Xia.
On July 26, 2026, BitMart announced it would cease operations and restructure. Its users have been left without access to millions in stuck funds, with complaints increasing on X. Sheldon Xia has published only vague statements claiming user assets are safe, and those claims still have not been independently verified.
As of this post, WooX has not yet issued a statement.
WooX was incubated by Kronos Research, and in Q4 2025 it was acquired by FusionX Digital, a firm which allegedly has ties to BitMart founder Sheldon Xia.
On July 26, 2026, BitMart announced it would cease operations and restructure. Its users have been left without access to millions in stuck funds, with complaints increasing on X. Sheldon Xia has published only vague statements claiming user assets are safe, and those claims still have not been independently verified.
As of this post, WooX has not yet issued a statement.
🤣1.26K🤯103❤85😱44✍24👍22👻13⚡8🙏7🤝5😁4
Community alert: Revolut appears to have exposed personally identifiable information (PII) for a subset of users due to failing to detect a fraudulent government request.
Exposed data included:
-Copy of passport and/or driver's licence, plus the verification selfie
-Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin
-Full name, date of birth, occupation
-Home address, email, phone number
While the incident is likely limited in size it seems to have been targeted at high net worth users.
An email alerting users was sent out to multiple Revolut users yesterday.
Exposed data included:
-Copy of passport and/or driver's licence, plus the verification selfie
-Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin
-Full name, date of birth, occupation
-Home address, email, phone number
While the incident is likely limited in size it seems to have been targeted at high net worth users.
An email alerting users was sent out to multiple Revolut users yesterday.
😱458😭202🤣186❤90👍37🙈29🐳17🔥16👎15🎉5😁4
The alleged DPRK attackers have just begun shielding ~2.7K ZEC ($3.8M) total from the Bitget exploit into the Ironwood pool.
~18.9K ZEC ($28.3M) total was stolen from the Bitget hot wallet on September 24, 2026.
One of the arguments used by competing privacy projects was threat actors do not use ZEC thus XYZ is better.
IronWood deposit transactions
Theft source address
~18.9K ZEC ($28.3M) total was stolen from the Bitget hot wallet on September 24, 2026.
One of the arguments used by competing privacy projects was threat actors do not use ZEC thus XYZ is better.
IronWood deposit transactions
9bf8d13474eff83ee9fcb214a3df7e1d1acbb745a0f820c837c08eb35e1e4e1a
61d2cb335127636f2854e587dd41fecf2ec31c9c1e9e5e5b543c3a416048b258
64e5a66cce034745dfe1447b4779ce37b910d99365d0583cef65eb0504b573a2Theft source address
t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG🤣195🔥140❤57😱30👎25🗿22👀17🤯10🥰8😁4🥴3
Community Alert: Near Intents was exploited for $3.8M+ after its BSC hot wallet saw multiple irregular outflows a few hours ago.
Near Intents hot wallet 0x233c has since stopped processing transactions and the site status shows an ongoing incident impacting multiple EVM chains.
The funds were immediately transferred to Kucoin and bridged to Bitcoin.
BSC theft address
Near Intents hot wallet 0x233c has since stopped processing transactions and the site status shows an ongoing incident impacting multiple EVM chains.
The funds were immediately transferred to Kucoin and bridged to Bitcoin.
BSC theft address
0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37🤣309😱107❤103🔥33👍26🥴26👀23🙈19🗿15👎6✍5
Investigations by ZachXBT
The British threat actor Danny / Meech aka Danish Zulfiqar (Khan) appears to have likely been arrested by law enforcement and had crypto assets seized. $18.58M currently sits at 0xb37d617716e46511E56FE07b885fBdD70119f768 I previously was monitoring and had…
Update: A few hours ago UAE law enforcement published a press release confirming legal action against multiple cybercriminals with $54M+ seized and 33 arrests.
Social engineering threat actors such as Danish Zulfiqar (Danny), Ibrahim Mustafa (Krust), & Cameron Cureton (CX) were all featured in the video posted.
Social engineering threat actors such as Danish Zulfiqar (Danny), Ibrahim Mustafa (Krust), & Cameron Cureton (CX) were all featured in the video posted.
❤418🔥165👍79🤣69🍾66😭42👀20🐳14😢11🎉8🤯6
A new centralized laundering service FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026. More than 87% of its inflow volume is tied directly to illicit activity.
A manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents, including:
• DCENT Wallet exploit (Sep 2026)
• Fetch[.]ai exploit (Sep 2026)
• Axelar exploit (Sep 2026)
• Unnamed ransomware payment (Sep 2026)
• Gamdom exploit (Oct 2026)
The admin sources XMR liquidity from KuCoin, with 3K+ deposits to KuCoin, and likely uses a swap model similar to Wagyu's.
The FXMR ticker was bought in an HL auction on July 27, 2026 for 518.28 HYPE ($28K).
HL Core has seen several centralized laundering services, such as b1exch, abuse the chain’s permissionless design and adoption.
A spreadsheet with source data has been shared with the HL team.
FXMR hot wallet
FXMR admin
A manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents, including:
• DCENT Wallet exploit (Sep 2026)
• Fetch[.]ai exploit (Sep 2026)
• Axelar exploit (Sep 2026)
• Unnamed ransomware payment (Sep 2026)
• Gamdom exploit (Oct 2026)
The admin sources XMR liquidity from KuCoin, with 3K+ deposits to KuCoin, and likely uses a swap model similar to Wagyu's.
The FXMR ticker was bought in an HL auction on July 27, 2026 for 518.28 HYPE ($28K).
HL Core has seen several centralized laundering services, such as b1exch, abuse the chain’s permissionless design and adoption.
A spreadsheet with source data has been shared with the HL team.
FXMR hot wallet
0x51687f549b9a4607e8e6f7714a0b986c0dbcdef2FXMR admin
0x1b7fb7709b146d74aad0b2b853bc741d8885bdb2
0x06ecb2a427c3d51a66c29d9b4fb1960107d10b19
0xecbb61b2aabd32da2082acd989218b0911b79406❤227👏67👍31🍾23🔥19🐳14👾9😁8✍7🗿7🥰5
An institutional entity is suspected to have lost ~$2.84M to DPRK-linked SquidSquad on October 8, 2026 on BSC.
Yesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses.
Tornado withdrawal addresses:
From there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at:
Both consolidation addresses have exposure to previously attributed DPRK addresses.
Within minutes, the funds moved through intermediary addresses to Chinese OTCs, likely to evade any potential Tether freeze.
Victim address:
Theft address:
Yesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses.
Tornado withdrawal addresses:
0xb8b25f535a6e51d0b18c48941d791c7e83559d2b
0x35c72e26f6888b4cba8668c6cfa4143599680bfe
0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848From there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at:
TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU
TVxzjnx3GPDTciiuagXPaUbU5f5y13VouxBoth consolidation addresses have exposure to previously attributed DPRK addresses.
Within minutes, the funds moved through intermediary addresses to Chinese OTCs, likely to evade any potential Tether freeze.
Victim address:
0x579be84d2a0f7bcfc34b4b3883153adec84ff153Theft address:
0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80❤103😭64👏24🕊15🤣14😢11🐳6💔6💯5👎3🗿3
An institutional entity lost ~$2.3M (973K MORPHO) a few hours ago from two addresses and the funds were deposited to Tornado Cash:
On Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges stolen, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool:
Both thefts from 0x4943 & 0x10bf involve EIP-7702 delegation transactions.
0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which reportedly lost eight figures due to a private key compromise in Sep 2023, after which the family office allegedly exited crypto.
0x4943b0c9959dcf58871a799dfb71bece0d97c9f4
0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4On Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges stolen, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool:
0x24a9e00be5f169142c4f0797b41dacdf807d3e63Both thefts from 0x4943 & 0x10bf involve EIP-7702 delegation transactions.
0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which reportedly lost eight figures due to a private key compromise in Sep 2023, after which the family office allegedly exited crypto.
❤125😭57🔥36🤣28🍾17✍15🤓8🤔5🗿4👏3💊3
Community Alert: Axis Robotics (AXIS) insiders received 76M+ AXIS ($12M+) from a Axis Team multisig and began market selling via DEX and transferring AXIS to Bitget causing the price to crash 40% over the past 24 hours.
The AXIS token went live on October 21, 2026.
A single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base:
The AXIS token went live on October 21, 2026.
A single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base:
0xcc279c2499bcf4bd0f169c2d3f333243473242f7
0x66612012c5ad9b2fed81d09a9ab429b5285b2c62
0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0
0x99cd3975c90b79ffdbe16425de033a605b814c49
0xbbed67fec9c7793218fa60c40fb9e6b059d86483
0xe69d8d6b9b7f9056eda455b76384e9748749f4d1
0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d🤣287😭70❤58🔥32👍22🤬20😁17🤯14🐳9🌚5🦄5
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit.
Exploiter address
Trsanction hash:
Exploiter address
0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5Trsanction hash:
0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb60x410af166c81f9c0f26cc19b4d970c984f526225eeea2aea169179856fd615f70❤271👏113🤣106🔥59😭47👀27🌚18😐16👍15😢8🙊6
Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor.
Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.
While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.
Theft addresses:
Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains.
While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators.
Theft addresses:
0xADd95cD98E0288ba69785E3151E1db86adF8Dd58
0x29e9D7715D935e0D0D4B0DD0efC952A97E551020
0x378B4f150707C283574DC89739608D29036D57d5
0x795a9d22F233024487161Fe6daFf73397c162621
0x730Bcb1296758c377149d7409f98f041cf723992
0x12D9012731eb0D54871A31Af5566Eb9ECCa351Db
0x5A154f77852ed274Fd6F4c324a1Ee27809052FF7
0xA1096A66f9ed58A9594A6A1ad67A5472C0907224
0x90F0b6D51ed2FE2348A45b2C49BC441E959bc557
0x8A97BC406180e28b11C5495fA099BF5119c6C6B0
0xd010cba790a6ab0048da18f2fbe8e3faf463a16a😭201😱110❤57👍33🤣32👀18🔥17🤔13😁9👏5🐳5