Investigations by ZachXBT
Reports, news, & insights shared by ZachXBT Useful links: x.com/zachxbt @investigations
- 24 hours
- +46
- 7 days
- –
- 30 days
- –
- Reactions
- 518
- Reposts
- –
- Comments
- –
Subscriber growth
Investigations by ZachXBT has 112,007 subscribers.
Daily numbers, last 30 days
| Date | Subscribers | Change | Posts | Avg. post views |
|---|---|---|---|---|
| 12 Nov | 112,007 | +35 | 0 | – |
| 11 Nov | 111,972 | – | 0 | – |
When it posts
Times in UTC. 16 posts in 90 days.
Recent posts
-
NEW: The US Treasury sanctioned eight Canadian OTCs on Friday (Nov 6), including Nia Nations (NNCE) & Million Exchange (MillionEX), five months after I replied to them on X suggesting they sanction the Iranian OTC brokers in Canada being abused by illicit actors. As I've stated before, Canada is a bottom-three jurisdiction globally with rampant abuse due to ineffective laws.
-
Update: I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident. A portion of the CEX withdrawals occurred after my initial disclosure. My working theory is a large financial institution in…
44.8K views 519 Reactions -
Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor. Over the past 24 hours the illicit actor has been aggressively…
45.3K views 433 Reactions -
Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor. Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains. While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators. Theft addresses: 0xADd95cD98E0288ba69785E3151E1db86adF8Dd58 0x29e9D7715D935e0D0D4B0DD0efC952A97E551020 0x378B4f150707C283574DC89...
-
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit. Exploiter address 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 Trsanction hash: 0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb6 0x410af166c81f9c0f26cc19b4d970c984f526225eeea2aea169179856fd615f70
55.3K views 705 Reactions -
Community Alert: Axis Robotics (AXIS) insiders received 76M+ AXIS ($12M+) from a Axis Team multisig and began market selling via DEX and transferring AXIS to Bitget causing the price to crash 40% over the past 24 hours. The AXIS token went live on October 21, 2026. A single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base: 0xcc279c2499bcf4bd0f169c2d3f333243473242f7 0x66612012c5ad9b2fed81d09a9ab429b5285b2c62 0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0 0x99cd3975c90b79ffdbe16425de033a605b814c49 0xbbed67fec9c7793218fa60c40fb9e6b059d86483 0xe69d8d6b9b7f9056eda455b76384e9748749f4d1 0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d
-
An institutional entity lost ~$2.3M (973K MORPHO) a few hours ago from two addresses and the funds were deposited to Tornado Cash: 0x4943b0c9959dcf58871a799dfb71bece0d97c9f4 0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4 On Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges stolen, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool: 0x24a9e00be5f169142c4f0797b41dacdf807d3e63 Both thefts from 0x4943 & 0x10bf involve EIP-7702 delegation transactions. 0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which reportedly lost eight figures due to a private key compromise in Sep 2023, after which the family office...
-
An institutional entity is suspected to have lost ~$2.84M to DPRK-linked SquidSquad on October 8, 2026 on BSC. Yesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses. Tornado withdrawal addresses: 0xb8b25f535a6e51d0b18c48941d791c7e83559d2b 0x35c72e26f6888b4cba8668c6cfa4143599680bfe 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848 From there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at: TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux Both consolidation addresses have exposure to previously attributed DPRK addresses. Within minutes, the funds moved through intermediary addresses to Chinese OTCs...
-
A new centralized laundering service FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026. More than 87% of its inflow volume is tied directly to illicit activity. A manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents, including: • DCENT Wallet exploit (Sep 2026) • Fetch[.]ai exploit (Sep 2026) • Axelar exploit (Sep 2026) • Unnamed ransomware payment (Sep 2026) • Gamdom exploit (Oct 2026) The admin sources XMR liquidity from KuCoin, with 3K+ deposits to KuCoin, and likely uses a swap model similar to Wagyu's. The FXMR ticker was bought in an HL auction on July 27, 2026 for 518.28 HYPE ($28...
-
The British threat actor Danny / Meech aka Danish Zulfiqar (Khan) appears to have likely been arrested by law enforcement and had crypto assets seized. $18.58M currently sits at 0xb37d617716e46511E56FE07b885fBdD70119f768 I previously was monitoring and had…
-
The British threat actor Danny / Meech aka Danish Zulfiqar (Khan) appears to have likely been arrested by law enforcement and had crypto assets seized. $18.58M currently sits at 0xb37d617716e46511E56FE07b885fBdD70119f768 I previously was monitoring and had…
-
Community Alert: Axis Robotics (AXIS) insiders received 76M+ AXIS ($12M+) from a Axis Team multisig and began market selling via DEX and transferring AXIS to Bitget causing the price to crash 40% over the past 24 hours. The AXIS token went live on October 21, 2026. A single insider currently holds 5.04M+ USDC across 8 wallets from the 42M AXIS it sold today via DEX on Base: 0xcc279c2499bcf4bd0f169c2d3f333243473242f7 0x66612012c5ad9b2fed81d09a9ab429b5285b2c62 0xf07e96abc54fea70ffeea8d3df7704401e7b0eb0 0x99cd3975c90b79ffdbe16425de033a605b814c49 0xbbed67fec9c7793218fa60c40fb9e6b059d86483 0xe69d8d6b9b7f9056eda455b76384e9748749f4d1 0x4ef72e67e6a7c37ea1378fe2adf811d711422e5d
-
An institutional entity lost ~$2.3M (973K MORPHO) a few hours ago from two addresses and the funds were deposited to Tornado Cash: 0x4943b0c9959dcf58871a799dfb71bece0d97c9f4 0x10bf1dcb5ab7860bab1c3320163c6dddf8dcc0e4 On Oct 9 the same 0x4943 entity had ~$3.5M claimed from old bridges stolen, which was bridged from Ethereum to Zcash via Near Intents and shielded into the Ironwood pool: 0x24a9e00be5f169142c4f0797b41dacdf807d3e63 Both thefts from 0x4943 & 0x10bf involve EIP-7702 delegation transactions. 0x4943 has onchain overlap with an address suspected to belong to Nima Capital, which reportedly lost eight figures due to a private key compromise in Sep 2023, after which the family office...
-
BREAKING: Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit. Exploiter address 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 Trsanction hash: 0x75e81a231a86e26a61e22dd2e6521504873a71a7ac1b2143c06e52796ceeedb6 0x410af166c81f9c0f26cc19b4d970c984f526225eeea2aea169179856fd615f70
55.3K views 705 Reactions -
Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor. Over the past 24 hours the illicit actor has been aggressively swapping USDC for ETH, transferring to instant exchanges (WellWallet, Kyrrex, etc), converting to XMR via Wagyu, and bridging across multiple chains. While the illicit actor remains unidentified, I can say with a high degree of confidence it is NOT Lazarus Group based on multiple laundering indicators. Theft addresses: 0xADd95cD98E0288ba69785E3151E1db86adF8Dd58 0x29e9D7715D935e0D0D4B0DD0efC952A97E551020 0x378B4f150707C283574DC89...
-
An institutional entity is suspected to have lost ~$2.84M to DPRK-linked SquidSquad on October 8, 2026 on BSC. Yesterday (Oct 20), the attacker deposited 1111.2 ETH into Tornado Cash and withdrew to three addresses. Tornado withdrawal addresses: 0xb8b25f535a6e51d0b18c48941d791c7e83559d2b 0x35c72e26f6888b4cba8668c6cfa4143599680bfe 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848 From there, all funds were bridged from Ethereum to Tron via USDT0 and consolidated at: TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux Both consolidation addresses have exposure to previously attributed DPRK addresses. Within minutes, the funds moved through intermediary addresses to Chinese OTCs...
-
A new centralized laundering service FreedomXMR (FXMR) appeared on Hyperliquid Core in August 2026. More than 87% of its inflow volume is tied directly to illicit activity. A manual review of all historical FXMR inflows above $10K traced $20M+ directly to ransomware, exploit, malware, and social engineering incidents, including: • DCENT Wallet exploit (Sep 2026) • Fetch[.]ai exploit (Sep 2026) • Axelar exploit (Sep 2026) • Unnamed ransomware payment (Sep 2026) • Gamdom exploit (Oct 2026) The admin sources XMR liquidity from KuCoin, with 3K+ deposits to KuCoin, and likely uses a swap model similar to Wagyu's. The FXMR ticker was bought in an HL auction on July 27, 2026 for 518.28 HYPE ($28...
-
Community Alert: An EU entity is suspected of losing $106M+ from multiple centralized exchange accounts yesterday (Nov 1). The suspected stolen funds were withdrawn as USDC & USDT by an illicit actor. Over the past 24 hours the illicit actor has been aggressively…
45.3K views 433 Reactions -
Update: I’ve identified an additional $27M+ of CEX withdrawals by the illicit actor bringing the total to $133M+ for the incident. A portion of the CEX withdrawals occurred after my initial disclosure. My working theory is a large financial institution in…
44.8K views 519 Reactions -
NEW: The US Treasury sanctioned eight Canadian OTCs on Friday (Nov 6), including Nia Nations (NNCE) & Million Exchange (MillionEX), five months after I replied to them on X suggesting they sanction the Iranian OTC brokers in Canada being abused by illicit actors. As I've stated before, Canada is a bottom-three jurisdiction globally with rampant abuse due to ineffective laws.
Questions about Investigations by ZachXBT
How many subscribers does Investigations by ZachXBT have?
Investigations by ZachXBT (@zachxbt) has 112,007 subscribers as of November 12, 2026.
Where does Investigations by ZachXBT rank?
By subscribers it is #187 among English channels, #225 worldwide.
Does Investigations by ZachXBT post ads?
None of its 10 posts in the last 30 days carried an ad label such as #ad or Sponsored. Unlabelled promotions can’t be detected.
When does Investigations by ZachXBT post?
Most often on Wednesday, around 12:00 UTC. It publishes about 2 posts a week.
Statistics updated 4 minutes ago.