ZachXBT

{{Short description|Pseudonymous blockchain investigator}} {{Unreliable sources|date=March 2026}} {{Use mdy dates|date=March 2026}} {{Infobox person | name = ZachXBT | image = | image_size = | caption = | birth_name = Zachary Wolk<ref>{{cite web |last1=Greig |first1=Jonathan |title=Brazilian police arrest IT worker over $100 million cyber theft |url=https://therecord.media/brazil-police-arrest-worker-theft |website=The Record |access-date=14 March 2026 |date=July 7, 2025 |quote=On Telegram, prominent cryptocurrency investigator Zachary Wolk — who goes by the online alias ZachXBT — said he was tracking some of the stolen funds and saw about $30 million to $40 million converted into Bitcoin, Ethereum and USDT.}}</ref> | occupation = {{hlist|Blockchain investigator|OSINT researcher}} | employer = Paradigm (2025–present) | known_for = Independent cryptocurrency fraud investigations }}

'''ZachXBT''', also identified as '''Zachary Wolk<ref>{{cite web |title=Crypto Influencer Ansem Accused of Promoting Memecoin 'Pump and Dumps' By ZachXBT |url=https://finance.yahoo.com/news/crypto-influencer-ansem-accused-promoting-133112274.html |access-date=14 March 2026|date=October 7, 2024|website=Yahoo Finance|quote=Zachary Wolk, known as ZachXBT, has publicly accused crypto influencer Zion “Ansem” Thomas of promoting a series of low market cap memecoins, alleging that this behavior could lead to significant financial losses for his followers.}}</ref>''' is a pseudonymous American blockchain investigator and open-source intelligence (OSINT) researcher known for independent forensic investigations into cryptocurrency fraud, scams, and thefts. He has been active on X (formerly Twitter) since 2021, publishing detailed investigative threads that trace stolen funds, expose rug pulls, and identify perpetrators of crypto-related crime.<ref name="wired">{{cite web |last=Greenberg |first=Andy |title=Meet ZachXBT, the Masked Vigilante Tracking Down Billions in Crypto Scams and Thefts |url=https://www.wired.com/story/meet-zachxbt-243-million-crypto-theft/ |website=Wired |date=August 10, 2024 |access-date=March 6, 2026}}</ref><ref name="nyt">{{cite web |last=Moxley |first=Mitch |title=They Stole a Quarter-Billion in Crypto and Got Caught Within a Month |url=https://www.nytimes.com/2025/04/24/magazine/crybercrime-crypto-minecraft.html |website=The New York Times Magazine |date=April 24, 2025 |access-date=March 6, 2026}}</ref> His work has contributed to the recovery of hundreds of millions of dollars in stolen digital assets and has assisted law enforcement agencies in arrests across multiple countries.<ref name="nyt" /><ref name="bleeping-daghita">{{cite web |title=FBI arrests suspect linked to $46M crypto theft from US Marshals |url=https://www.bleepingcomputer.com/news/security/fbi-arrests-suspect-linked-to-46m-crypto-theft-from-us-marshals/ |website=Bleeping Computer |date=March 5, 2026 |access-date=March 6, 2026}}</ref>

''Wired'' has described ZachXBT as the most prolific independent crypto-focused detective in the world.<ref name="wired" /> He was named to CoinDesk's Most Influential 2024 list.<ref name="coindesk-profile">{{cite web |title=ZachXBT: Master Sleuth of Crypto |url=https://www.coindesk.com/tech/2024/12/10/zach-xbt-master-sleuth-of-crypto |website=CoinDesk |date=December 10, 2024 |access-date=March 6, 2026}}</ref> In February 2025, he joined the cryptocurrency investment firm Paradigm as an incident response advisor.<ref name="paradigm">{{cite web |title=Onchain sleuth ZachXBT joins crypto VC firm Paradigm as incident response advisor |url=https://www.theblock.co/post/343513/onchain-sleuth-zachxbt-joins-crypto-vc-firm-paradigm-as-incident-response-advisor |website=The Block |date=February 26, 2025 |access-date=March 9, 2026}}</ref>

== Early life and identity == ZachXBT maintains strict anonymity and has never publicly disclosed his full name or appearance.<ref name="wired" /> His online persona is represented by an avatar of a cartoon platypus wearing a detective's trench coat.<ref name="wired" /> In a 2024 interview with ''Wired'', he participated on the condition that the publication would not attempt to identify him.<ref name="wired" /> Court filings from a 2023 defamation lawsuit revealed his full name as Zachary Wolk and established that he resides within the jurisdiction of the United States District Court for the Western District of Texas.<ref>{{cite web |title=Huang v. Wolk, 1:23-cv-00683 ('Crypto Defamation') |url=https://www.courtlistener.com/docket/67506119/huang-v-wolk/ |website=CourtListener |access-date=14 March 2026 |date=June 15, 2023}}</ref><ref>{{cite web |title=Huang v. Wolk 1:2023cv00683 |url=https://dockets.justia.com/docket/texas/txwdce/1:2023cv00683/1172744890 |website=Justia Dockets & Filings |access-date=14 March 2026 |date=June 15, 2023}}</ref><ref>{{cite web |title=Jeffrey Huang v. Zachary Wolk |url=https://www.pacermonitor.com/public/filings/D65CIHKA/Huang_v_Wolk__txwdce-23-00683__0001.0.pdf |website=PacerMonitor |access-date=14 March 2026}}</ref>

According to his own account, ZachXBT entered the cryptocurrency space around 2017, during the initial coin offering boom. After losing money to multiple fraudulent projects, he began analyzing blockchain data and tracing the flow of stolen funds.<ref name="wired" /> He has stated that he has no formal training in investigations or law enforcement, describing his skills as self-taught through years of blockchain analysis.<ref name="wired" />

== Career ==

=== Independent investigations (2021–2025) === ZachXBT began publishing investigative threads on Twitter (now X) in 2021. In his early collaborations with law enforcement, he would keep his camera off during conference calls and use voice-changing software to protect his identity. Joe McGill, a United States Secret Service analyst who worked with ZachXBT, recalled that the practice was initially unusual but that the quality of ZachXBT's work warranted respect for his anonymity.<ref name="wired" />

He publishes findings primarily through detailed threads on X and maintains a Telegram channel for longer-form investigations.<ref name="coindesk-profile" /> ZachXBT generally provides investigative services without charge, though he has accepted paid engagements from victims of major thefts.<ref name="coindesk-profile" /><ref name="nyt" />

=== Paradigm (2025–present) === In February 2025, ZachXBT joined Paradigm, a cryptocurrency venture capital firm, as an incident response advisor, working with the firm on security matters.<ref name="paradigm" /> Paradigm co-founder Matt Huang stated that ZachXBT had helped recover more than $350 million for victims of hacks and scams.<ref name="cointelegraph-paradigm">{{cite web |last=O'Donnell |first=Alex |title=Paradigm taps ZachXBT as adviser |url=https://cointelegraph.com/news/paradigm-taps-zach-xbt-as-adviser |website=Cointelegraph |date=February 26, 2025 |access-date=March 6, 2026}}</ref>

== Investigative methods == ZachXBT's investigative approach combines blockchain forensics with open-source intelligence (OSINT) techniques.<ref name="ccn">{{cite web |title=ZachXBT: The Crypto Detective Uncovering Blockchain Scams |url=https://www.ccn.com/education/crypto/zachxbt-crypto-detective-uncovering-blockchain-scams/ |website=CCN |date=October 29, 2024 |access-date=March 6, 2026}}</ref> His methods include tracing fund flows across wallets and exchanges, address clustering to identify related accounts, and cross-referencing on-chain data with public records such as domain registrations, court filings, and social media activity.<ref name="ccn" /> He also monitors online forums and chat groups on Telegram and Discord where cybercriminals congregate, using social media intelligence to identify suspects.<ref name="nyt" />

In August 2025, ZachXBT was announced as a launch partner for the Beacon Network, a real-time communication network created by blockchain intelligence firm TRM Labs. The network allows investigators, cryptocurrency exchanges, and custodians to collaborate instantly to freeze stolen funds. ZachXBT's role involves providing incident response and research to help mitigate the impact of active exploits.<ref>{{cite web |title=TRM Labs Launches Beacon Network, the First Real-time Crypto Crime Response Network |url=https://www.trmlabs.com/resources/blog/trm-labs-launches-beacon-network-the-first-real-time-crypto-crime-response-network |website=TRM Labs |access-date=14 March 2026 |date=August 20, 2025}}</ref><ref>{{cite web |title=TRM Labs debuts real-time crypto crime platform |url=https://www.scworld.com/brief/trm-labs-debuts-real-time-crypto-crime-platform |website=SC Media |access-date=14 March 2026 |date=August 27, 2025}}</ref>

He publishes his findings primarily through detailed threads on X and maintains a Telegram channel for longer-form investigations.<ref name="coindesk-profile" /> ZachXBT generally provides his investigative services without charge, though he has accepted paid engagements from victims of major thefts.<ref name="coindesk-profile" /><ref name="nyt" />

Cryptocurrency investigator Nick Bax, founder of the firm Five I's, has described ZachXBT's work rate as extraordinary, noting an instance in which ZachXBT manually analyzed 500 transactions in approximately 12 hours.<ref name="wired" /> Taylor Monahan, a security researcher at MetaMask and a frequent collaborator, has stated that ZachXBT's published findings increasingly carry direct consequences for their subjects, often leading to arrests.<ref name="wired" />

== Notable investigations ==

=== Bored Ape Yacht Club phishing ring (2021) === In 2021, ZachXBT tracked a phishing operation targeting owners of Bored Ape Yacht Club (BAYC) non-fungible tokens. The scheme involved a fraudulent service that purported to animate users' BAYC NFTs but instead directed them to a phishing site designed to steal the NFTs from their wallets. ZachXBT identified the five-person crime ring behind the operation, which had stolen more than $2.5 million in NFTs. His findings assisted French authorities in arresting and convicting all five individuals.<ref name="cmc-profile">{{cite web |title=Who Is ZachXBT? Crypto's Pseudonymous Scam Hunter |url=https://coinmarketcap.com/academy/article/who-is-zachxbt-cryptos-anonymous-scam-hunter |website=CoinMarketCap |date=March 22, 2024 |access-date=March 6, 2026}}</ref>

=== $243 million Genesis creditor theft (2024) === On August 19, 2024, ZachXBT received an alert about an unusually large Bitcoin transaction while preparing to board a flight.<ref name="nyt" /> He began tracing the funds back to a wallet holding approximately $243 million in Bitcoin, some dating back to 2012, belonging to a single creditor of the defunct trading firm Genesis who held assets through the Gemini exchange.<ref name="nyt" /><ref name="theblock-genesis">{{cite web |title=Blockchain sleuth ZachXBT alleges three attackers involved in $243 million theft of single Genesis creditor |url=https://www.theblock.co/post/317349/blockchain-sleuth-zachxbt-alleges-three-perps-involved-in-243-million-theft-of-single-genesis-creditor |website=The Block |date=September 19, 2024 |access-date=March 6, 2026}}</ref>

The attackers had used social engineering to impersonate Google and Gemini support staff, convincing the victim to reset two-factor authentication settings and install remote desktop software, which allowed them to extract private keys from the victim's Bitcoin Core wallet.<ref name="coindesk-genesis">{{cite web |title=Police Arrest Two People Related to $243M Crypto Heist Targeting Genesis Creditor |url=https://www.coindesk.com/business/2024/09/19/police-arrests-two-people-related-to-243m-crypto-heist-targeting-genesis-creditor |website=CoinDesk |date=September 19, 2024 |access-date=March 6, 2026}}</ref> ZachXBT traced the stolen 4,064 BTC as it was split across more than 15 exchanges and converted between Bitcoin, Litecoin, Ethereum, and Monero to obscure the trail.<ref name="theblock-genesis" />

A source provided ZachXBT with screen recordings of a Discord chat session made during the heist, in which one of the suspects inadvertently revealed his real name.<ref name="nyt" /><ref name="krebs-genesis">{{cite web |last=Krebs |first=Brian |title=Lamborghini Carjackers Lured by $243M Cyberheist |url=https://krebsonsecurity.com/2024/10/lamborghini-carjackers-lured-by-243m-cyberheist/ |website=Krebs on Security |date=October 9, 2024 |access-date=March 6, 2026}}</ref> ZachXBT identified three suspects and shared his findings with U.S. law enforcement. The United States Department of Justice subsequently charged Malone Lam and Jeandiel Serrano, who were arrested in Miami and Los Angeles on September 18, 2024.<ref name="coindesk-genesis" /> A third suspect, Veer Chetal, whose parents were subsequently targeted in a violent kidnapping attempt in Danbury, Connecticut connected to the stolen funds, was arrested in March 2025.<ref name="nyt" /><ref name="krebs-genesis" /> A fourth suspect, identified by ZachXBT as Danish Zulfiqar, was reportedly taken into custody in Dubai in December 2025.<ref name="theblock-dubai">{{cite web |title=Crypto sleuth ZachXBT claims British threat actor tied to $243 million Genesis creditor theft 'likely arrested' |url=https://www.theblock.co/post/381481/crypto-sleuth-zachxbt-claims-british-threat-actor-tied-to-243-million-genesis-creditor-theft-likely-arrested |website=The Block |date=December 5, 2025 |access-date=March 6, 2026}}</ref> Cryptoforensic Investigators, zeroShadow, and Binance Security froze more than $9 million in stolen funds, with over $500,000 returned to the victim.<ref name="coindesk-genesis" />

=== Bybit hack and Lazarus Group attribution (2025) === On February 21, 2025, the cryptocurrency exchange Bybit suffered a security breach resulting in the loss of approximately $1.5 billion in Ethereum-related assets, the largest single theft in cryptocurrency history at the time.<ref name="theblock-bybit">{{cite web |title=North Korea's Lazarus Group responsible for Bybit hack resulting in losses of over $1.5 billion: Arkham |url=https://www.theblock.co/post/342769/north-koreas-lazarus-group-responsible-for-bybit-hack-resulting-in-losses-of-over-1-5-billion-arkham |website=The Block |date=February 21, 2025 |access-date=March 6, 2026}}</ref> Within hours, ZachXBT submitted evidence to blockchain analytics platform Arkham Intelligence identifying North Korea's Lazarus Group as the perpetrators, based on analysis of test transactions and connected wallets used ahead of the exploit, as well as forensic graphs and timing analyses linking the attack to prior Lazarus Group operations against other exchanges.<ref name="decrypt-bybit">{{cite web |title=North Korea's Lazarus Group Behind Bybit's $1.4 Billion Ethereum Hack: Arkham |url=https://decrypt.co/307304/north-korea-lazarus-group-bybit-hack-arkham |website=Decrypt |date=February 22, 2025 |access-date=March 6, 2026}}</ref> The Federal Bureau of Investigation subsequently confirmed the Lazarus Group's responsibility.<ref name="fbi-bybit">{{cite web |title=FBI confirms Lazarus hackers were behind $1.5B Bybit crypto heist |url=https://www.bleepingcomputer.com/news/security/fbi-confirms-lazarus-hackers-were-behind-15b-bybit-crypto-heist/ |website=Bleeping Computer |date=February 27, 2025 |access-date=March 6, 2026}}</ref>

=== U.S. Marshals Service seized crypto theft (2026) === In late January 2026, ZachXBT published an investigation alleging that an individual operating under the online handle "Lick" had stolen more than $46 million in cryptocurrency from wallets managed by the United States Marshals Service (USMS).<ref name="coindesk-daghita-jan">{{cite web |title=U.S. marshals investigate claim of $40 million crypto theft by son of federal crypto custodian |url=https://www.coindesk.com/business/2026/01/26/u-s-marshals-investigate-claims-that-son-of-government-contractor-stole-usd40-million-of-seized-crypto |website=CoinDesk |date=January 26, 2026 |access-date=March 6, 2026}}</ref> The investigation originated after ZachXBT obtained a recording of a dispute in a private Telegram group chat, in which two individuals attempted to prove who controlled more cryptocurrency. During the exchange, one participant screen-shared a wallet holding approximately $2.3 million and then transferred $6.7 million in ether in real time, inadvertently demonstrating control over addresses that ZachXBT traced back to government wallets.<ref name="trmlabs-daghita">{{cite web |title=ZachXBT Uncovers Crypto Theft Network Linked to US Government Seizure Funds |url=https://www.trmlabs.com/resources/blog/zachxbt-uncovers-crypto-theft-network-linked-to-us-government-seizure-funds |website=TRM Labs |access-date=March 6, 2026}}</ref><ref name="theblock-daghita">{{cite web |title=Individual behind $40 million government wallet theft is son of seized-crypto contractor executive: ZachXBT |url=https://www.theblock.co/post/386945/individual-behind-40-million-government-wallet-theft-is-son-of-seized-crypto-contractor-executive-zachxbt |website=The Block |date=January 25, 2026 |access-date=March 6, 2026}}</ref>

ZachXBT identified the individual as John Daghita, the son of Dean Daghita, president of Command Services & Support (CMDSS), a Virginia-based firm awarded a USMS contract in October 2024 to manage and dispose of certain categories of seized digital assets.<ref name="theblock-daghita" /> After ZachXBT reported his findings to authorities, the USMS opened an investigation.<ref name="coindesk-daghita-jan" /> Daghita reportedly taunted ZachXBT on Telegram and sent small amounts of allegedly stolen cryptocurrency to ZachXBT's public wallet address in what is known as a dust attack.<ref name="bleeping-daghita" />

On March 5, 2026, FBI director Kash Patel announced that Daghita had been arrested on the island of Saint Martin in a joint operation between the FBI and the French Gendarmerie's elite tactical unit.<ref name="coindesk-daghita-arrest">{{cite web |title=Son of contractor managing seized crypto for U.S. Marshals arrested in France over alleged $46m theft |url=https://www.coindesk.com/business/2026/03/05/son-of-u-s-government-contractor-accused-of-stealing-millions-in-seized-crypto-arrested-in-france |website=CoinDesk |date=March 5, 2026 |access-date=March 6, 2026}}</ref><ref name="gizmodo-daghita">{{cite web |title=FBI Arrests Man Who Allegedly Stole $46 Million Worth of Crypto from U.S. Government Stockpile |url=https://gizmodo.com/fbi-arrests-man-who-allegedly-stole-46-million-worth-of-crypto-from-u-s-government-stockpile-2000730134 |website=Gizmodo |date=March 5, 2026 |access-date=March 6, 2026}}</ref> Law enforcement seized cash, hard drives, and security keys during the arrest.<ref name="bleeping-daghita" /> The case drew scrutiny to the USMS's reliance on outside contractors for custody of seized digital assets.<ref name="theblock-daghita" />

== See also == * Blockchain analysis * Cryptocurrency and crime * Open-source intelligence

== References == {{reflist}}

== External links == * {{Official website|zachxbt.live}} * [https://x.com/zachxbt ZachXBT] on X * [https://t.me/investigations ZachXBT] on Telegram

{{DEFAULTSORT:ZachXBT}} Category:American whistleblowers Category:Blockchains Category:Living people Category:Open-source intelligence Category:People associated with Bitcoin Category:People associated with cryptocurrency Category:Year of birth missing (living people)