TGViewer
Channel Public Channel
Investigations by ZachXBT

Investigations by ZachXBT

@zachxbt

Reports, news, & insights shared by ZachXBT

Useful links:
x.com/zachxbt
@investigations
Open in Telegram
Subscribers
107K
Photos
204
Videos
3
Links
164
Recent Posts 20 shown
Post #363 42.7K
Community alert: Revolut appears to have exposed personally identifiable information (PII) for a subset of users due to failing to detect a fraudulent government request.

Exposed data included:
-Copy of passport and/or driver's licence, plus the verification selfie
-Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin
-Full name, date of birth, occupation
-Home address, email, phone number

While the incident is likely limited in size it seems to have been targeted at high net worth users. 

An email alerting users was sent out to multiple Revolut users yesterday.
  • 😱 420
  • 😭 183
  • 🤣 175
  • ❤ 65
  • 👍 33
  • 🙈 27
  • 🔥 16
  • 🐳 13
  • 👎 11
  • 🎉 5
  • 😁 4
Post #362 52.8K
Community Alert: Multiple verified WooX users have reported withdrawals stuck in pending or processing over the past three days.

WooX was incubated by Kronos Research, and in Q4 2025 it was acquired by FusionX Digital, a firm which allegedly has ties to BitMart founder Sheldon Xia.

On July 26, 2026, BitMart announced it would cease operations and restructure. Its users have been left without access to millions in stuck funds, with complaints increasing on X. Sheldon Xia has published only vague statements claiming user assets are safe, and those claims still have not been independently verified.

As of this post, WooX has not yet issued a statement.
  • 🤣 1.3K
  • 🤯 98
  • ❤ 74
  • 😱 43
  • ✍ 21
  • 👍 18
  • 👻 12
  • ⚡ 7
  • 🙏 7
  • 🤝 5
  • 😁 4
Post #361 66.3K
Community Alert: I've reviewed evidence that two US based investment platforms: BitcoinIRA & iTrustCapital allegedly had data breaches this year but appear to have not disclosed the incidents publicly.

Leaked info: Personal details, Portfolio holdings, Banking details, Custodian details, Verification status, etc

Example: Threat actor ‘Tiffany’ targeted a BitcoinIRA user and stole $1.2M+ using the db in June 2026.

I reached out to both companies for comment on August 21 but have not heard back yet.
  • 🔥 309
  • 🤯 252
  • ❤ 103
  • 🤬 71
  • 👍 54
  • 😭 30
  • ⚡ 24
  • 🥴 19
  • 😁 18
  • 😈 11
  • 🥰 3
Post #359 87.5K
Bottom 5 jurisdictions globally for victims ranked in order:

🥇 Canada
🥈 UK
🥉 India
4). Nigeria
5). Morocco, Algeria, or Bangladesh

(If you contact me from any of these countries I will likely automatically decline the case)
  • 👎 1.5K
  • 🤣 1K
  • 😭 218
  • ❤ 127
  • 👍 108
  • 🔥 45
  • 🙈 32
  • 🦄 29
  • 👏 23
  • 🤝 17
  • ⚡ 15
Post #357 236K
Telegram keeps allowing scam ads to be displayed in my channel to subscribers.

If you are a premium user please consider using boosts for my channel https://t.me/boost/investigations so I can unlock the feature to disable ads (need to hit level 50).
  • 👎 2.5K
  • 🤣 752
  • 👍 259
  • ❤ 134
  • 😭 88
  • 🌚 31
  • 😁 26
  • 🙈 20
  • 👀 18
  • 🔥 11
  • 🥰 10
Post #356 88.8K
It appears the bridge TeleSwap had a $735K+ exploit on July 15, 2026 and still has not disclosed the incident publicly after five days.

Shortly after the suspicious outflows its Bitcoin hot wallet stopped processing transactions. Two hours ago the attacker deposited the funds to Tornado.

Theft addresses
bc1pz95zv3qhpmt52yezs84a5zrddrk5jsxm8a60rln5kzlk06e87a3q8pf79l
0x2448cbaee50a67030692b7519a954e5550dc2718
0xfc5048fbba2f74ed482ffcd7663601f818c5bb47
0xf8706a51f8df01a71f408e50c901dd14916a12c7

TeleSwap Bitcoin hot wallet
bc1q5wnpn4k99wc587maaaa6eqnx27g4r6mduxg2s5
  • 😭 235
  • 🤣 121
  • ❤ 54
  • 👍 38
  • 🤬 33
  • 😱 22
  • 🐳 22
  • 👎 16
  • 🔥 15
  • 👏 10
  • 🙏 9
Post #355 116K
Hot take: All hardware wallets are complete garbage and l do not advise using them for important tasks like signing transactions or storing funds.

Much better to have a separate iPhone with its only purpose being to use as your hardware wallet.

Ledger is the worst and Ledger Live has regular updates for UI / apps for no good reason that break simple actions.

(Only do this if you are not low iq)
  • 😭 831
  • 👍 496
  • 💯 251
  • 👎 198
  • ❤ 162
  • 😱 73
  • 🤔 68
  • 😁 65
  • 🤨 51
  • 🔥 35
  • 🥴 34
Post #354 95K
Investigations by ZachXBT An entity previously received ESPORTS, RIVER, & LIGHT tokens via Sablier vesting contract and is also directly tied to a signer on three LAB multisigs. These four BSC tokens have experienced market manipulation incidents on centralized exchanges. I peviously…
Community alert: Over the past 48 hour an entity initially funded by the LAB team deposited 18.4M LAB ($18.3M) to Aster and began selling LAB spot on the DEX which has caused the LAB price to drop another -54% from $1.2 to $0.55.

The entity received 196M+ LAB from the LAB team in April 2026 and transferred LAB to four Bitget deposit addresses.

On April 8 100M LAB total was transferred by the entity to two Bitget deposit addresses:
0xe39f91a0daffc5547ada79a09be30b8556f7dfba
0x77156a0a621d2ac7a075c0ac3172707c2e4aa191

From April 23 to 25 96M LAB total was transferred by the entity to two Bitget deposit addresses:
0x6593aa6c31c88397c37f71259625ec92fe4ee0bf
0xdd77bfbdc11cd37fd255ae35a4ac39df1f9d570a

From May 11 to 12 ~100M LAB was withdrawn from Bitget to ten addresses as market data from the period did not support any independent party accumulating a position of that size. Thus indicates the same entity. The LAB withdrawn sat dormant until this week.

From July 10 to 11 the entity began transferring LAB to three Aster deposit addresses and currently still holds another 81.5M LAB:
0xaad30cab22f772c1658b7845b5837d35bf3a467a
0x76ccfde9819500204985580d235dd8326fa0b241
0x628dd74f428a81cd34ece11331a7f1593f76047a

In May 2026 I published an investigation on X detailing how the LAB team engaged in opaque private loans/OTC, unilateral vesting changes, >95% supply control, and irregular MM activity.

This week the LAB price collapsed shortly before the rumored unlocks were scheduled to begin. After the LAB team made a vague announcement stating it was due to "large market participants".

It is disappointing no action was taken by Bitget, Binance, or Gate for allowing blatant market manipulation on tokens against users.
  • ❤ 260
  • 👍 94
  • 🤯 45
  • 🍾 31
  • 😁 22
  • 👏 15
  • 👀 14
  • 🥱 13
  • 🗿 12
  • ✍ 6
  • 🦄 5
Post #353 64.6K
An early Solana whale tied to the initial Genesis block distribution appears to have likely had 180.9K SOL ($14.2M) stolen a few hours ago.

I began reviewing the irregular unstaking and bridging activity from Solana to Ethereum with @specterinvestigation who first spotted these movements.

Victim
HwtbQBNnLERakdUDuCCLWmUs2oETLFQZeHUWeQdPads

Theft address
Ffd1oB2aYM5UzMYUM7TmxULDRQb6KzgrBwmgj9U1C2bE
653pnn5fzF51FfotBwxua55Es4QXxTdaXJLbPczVmswp
0xaa5cfa4e96dda0f9aa30f4dc948b542a9b5817c6
0x536b4ee7507c41143e1b0bd1bf3f2b84be404836
0xbf11bdfbeb9ed137c352c81e45d191cacae6b0cf
  • 😭 258
  • 😱 121
  • ❤ 45
  • 👍 28
  • 🤣 22
  • 👀 20
  • 🤯 14
  • 🫡 14
  • 🔥 12
  • 😁 7
  • 🌚 7
Post #352 65K
Investigations by ZachXBT Update: AscendEX has not posted on X (Twitter) for 9 days since my post and user withdrawals are still not being processed while deposits are being accepted. I reviewed a case where a large victim has been getting no response from the AscendEX co-founder…
Update 2: AscendEX published the following announcement stating they will cease operations as the team blames current market conditions and MiCA.

AscendEX admits in its announcement withdrawals may or may not be processed.

Their public hot wallets still do not have liquid assets to process withdrawals for the multiple 7 figures in user claims I have verified.

Users with assets stuck should file a report with law enforcement and regulators in your country to hold its co-founder George (Jing) Cao responsible.
  • 😢 147
  • 😭 95
  • 🤬 56
  • ❤ 46
  • 👍 36
  • 🗿 17
  • 👏 12
  • 💊 9
  • 🤷‍♀ 8
  • 🤔 7
  • 😡 4
Post #351 54.3K
Over the past week multiple people created ZACHXBT meme coins on various chains using my likeness to take advantage of the recent narrative.

None of the tokens were promoted by myself as I have always stated I will never support or launch a meme coin.

All tokens sent to my donation wallet were market sold and the entire amount was sent to charity.

~$41K total was donated to Direct Relief & Give Directly via The Giving Block to support the Venezuela earthquake response.

Transaction reciepts:

1). 25K USDT sent to Give Directly on July 6, 2026 at 4:16 am UTC
0x687556d7011b0750f3daf9e3a9f800d04ba233c84362faf8c3851b40cd0f71ae

2). 5k USDT sent to Direct Relief on July 6, 2026 at 4:51 am UTC
0xc9146816d5c0d97b432d663b422b46854ba6e047ce7e9ea8073d43c1205ba070

3). 153 SOL ($11K) total sent to Direct Relief on June 28, 2026
44idg3MiJiprAnqBbt5fZM9K4deDzZdqnJ3dPtS6hFLqQk3omvqWz7LjgCapMX94q7Ba3NznoCsgpdWFUysjHHuX
4Cm8hrg9Fgwrgot6GkqNtNdhjb4o48dintU1Wz8DBuZBuvGsSQjv4VE5KAivTPy7okj1XxJtEyqAaecJr8xAiXhi
  • ❤ 689
  • 👍 139
  • 🔥 61
  • 😭 29
  • 😁 23
  • ❤‍🔥 21
  • 💯 12
  • 🤪 12
  • 🥰 11
  • ✍ 10
  • 🤯 10
Post #350 51.9K
Investigations by ZachXBT Community alert: KuCoin has sent legal threats to a victim whose stolen funds were laundered via KuCoin accounts with purchased mule KYC. The case involves a $250K Atomic stealer theft from August 18, 2025 where the stolen funds were transferred to multiple…
From July 2-3, 2026 a threat actor withdrew 3200 ETH from Tornado in relation to two large private key compromise thefts.

After $5.5M was laundered via Circle CCTP bridge and funds were transferred to seven Kucoin deposit addresses on Arbitrum.

Kucoin deposit addresses
0x85d7124a659fb0aeb7ccd283f3e24bc2364e7c55
0x764c80a719fdf932d4a5944e9e382f71958bffa3
0x83396ae682c821d56b0c51da86b536af0a4b9894
0x5dc523deceb53ff5e89e0f6683af77f274f51f56
0x295fdf140e7c706be5b9daffc68d97a224394cfe
0x4e6a42fa57392673580e15e35850324557f51467
0xe007625bf20387ed3c250e1dcf3d94d133480634
  • 😱 147
  • ❤ 55
  • 😭 52
  • 🔥 27
  • 👍 24
  • 🫡 18
  • 🤪 12
  • 👾 11
  • 😐 10
  • 🐳 9
  • ❤‍🔥 6
Post #349 59.9K
Investigations by ZachXBT Community alert: I have observed multiple reports that the centralized exchange AscendEX (formerly Bitmax) is delaying user withdrawals for days / weeks or not processing withdrawals. I reviewed known hot wallets on Arkham/TRM and its reserves appear to lack…
Update: AscendEX has not posted on X (Twitter) for 9 days since my post and user withdrawals are still not being processed while deposits are being accepted.

I reviewed a case where a large victim has been getting no response from the AscendEX co-founder George (Jing) Cao on any of their concerns.

If you have funds stuck I encourage you to file a report with law enforcement and regulators in your country.
  • ❤ 223
  • 🤣 87
  • 👍 74
  • 👀 42
  • 😢 20
  • 😱 17
  • ✍ 11
  • 🔥 10
  • 😁 10
  • 👏 7
  • 👎 4
Post #348 62.8K
Community alert: KuCoin has sent legal threats to a victim whose stolen funds were laundered via KuCoin accounts with purchased mule KYC.

The case involves a $250K Atomic stealer theft from August 18, 2025 where the stolen funds were transferred to multiple KuCoin deposit addresses.

Theft address
0x6368D06895b7becdcAC0806F438EfA653fE0a68D

Kucoin deposit addresses
0x6043b2d79670a417fc523213155812846e893dc7
0xa0fdb49aa589538d5622b92e9122727873558a13
0x4a4b5c7db9aa8355a5e5abbfc1926cd6b2d9f610
0xe7bb69f6c0ae0c1418bd86ec9697af9914d6875e
0x35d65ec360347f7dc41a929cc7ce9f2485a4f833

In recent months I have provided warnings about KuCoin due to blocking legit users, enabling illicit activity (AudiA6, DNMs, etc), and have observed delayed responses to law enforcement for victims.
  • 🤬 275
  • ❤ 84
  • 👎 38
  • 👍 30
  • 🔥 24
  • 😭 16
  • 😱 15
  • 😁 14
  • 😡 12
  • 😢 5
  • 💔 5
Post #347 60.4K
One hour ago funds from the recent Humanity Protocol exploit and Kelp DAO exploit commingled suggesting potential overlap between the attackers for both incidents.

Transaction hash: 5d31655a905b1b39ce1a477268b5084cc821157371860b792e60a3fa4aa24931

On April 18, 2026 ~$292M was stolen from Kelp DAO's LayerZero bridge due to compromised infra and Lazarus Group was alleged as the attacker.

On June 9, 2026 ~$32M was stolen from Humanity Protocol team addresses and deployer after a developers device became compromised.

The H token previously raised concerns over insider supply control and active market making tactics on CEXs where the exploit coincided shortly before investor unlocks.

However I believe the new evidence from above rules out insiders as being behind the exploit.

H/t @specterinvestigation for helping flag these transactions.
  • ❤ 180
  • 👍 85
  • 😱 37
  • 🤣 11
  • 😭 11
  • 😁 8
  • 🤓 6
  • 👎 5
  • 🤔 5
  • ⚡ 1
Post #346 66K
Community alert: I have observed multiple reports that the centralized exchange AscendEX (formerly Bitmax) is delaying user withdrawals for days / weeks or not processing withdrawals.

I reviewed known hot wallets on Arkham/TRM and its reserves appear to lack large cap tokens such as ETH, USDT, USDT, SOL, etc indicating they likely are facing liquidity issues.

AscendEX (Bitmax) was founded by George (Jing) Cao & Ariel Ling in 2018. In December 2021 they were reportedly hacked by Lazarus Group for $78M.

EVM hot wallets
0x983873529f95132BD1812A3B52c98Fb271d2f679
0x4240781A9ebDB2EB14a183466E8820978b7DA4e2

Tron hot wallet
TP523ZC2721Dnu6nxYSFi14cWUBfu8YTXG

Solana hot wallets
Cv7hXMfMh5eu2WBtyZXogYDPj55Xo1Ufsuwn7oeG6Epy
6iVBAsquJRaLsXbojb18kqTW1d5iVLspVjCtsReZBKhY
  • 😱 224
  • ❤ 87
  • 🥴 35
  • 🔥 26
  • 😭 22
  • 👍 11
  • 👏 8
  • 🙈 8
  • 😁 7
  • 🤨 7
  • 🕊 6
Post #345 54.2K
Investigations by ZachXBT The Polish social engineering threat actor Wojtek Kulisz aka 'Merry' appears to have been recently raided by Poland law enforcement along with three other people. While the press release today did not share his name or photo, multiple designer clothes and…
Here's a video of the raid posted by Polish LE
  • 🍾 196
  • 😭 77
  • 🤣 62
  • ❤ 19
  • 👍 17
  • 🔥 8
  • 😁 8
  • 👎 7
  • 😱 3
  • 👏 2
  • 🤝 2
Post #344 55.4K
The Polish social engineering threat actor Wojtek Kulisz aka 'Merry' appears to have been recently raided by Poland law enforcement along with three other people.

While the press release today did not share his name or photo, multiple designer clothes and jewelry items flexed from his public Instagram account 'wojtekk' match items seized during the raid.
  • 🤣 232
  • ❤ 58
  • 👍 46
  • 👏 15
  • 🔥 13
  • 😁 12
  • 😭 8
  • 🫡 6
  • 😢 4
  • 🍾 4
  • 💔 1
Post #343 52K
A few hours ago the price of M (MemeCore) suddenly crashed >75% on centralized exchanges from $14B to $3.8B FDV falling outside of the top 25 tokens ranked by market cap.

Myself, Mlm, & Wazz previously highlighted a number of red flags on X about MemeCore with inorganic supply concentration and deceptive practices by its team to boost user numbers.

According to data on Arkham there's not been a single transfer >$50k onchain in 2+ weeks on BSC.

Dexscreener data indicates there's <$100K total liquidity onchain on BSC.

The community needs answers from Binance & Bybit about why M was listed for perps and why Kraken & Bitget listed M spot as these highly manipulated tokens continue to give our industry a bad reputation and extract from retail.
  • 👍 410
  • ❤ 117
  • 🤣 66
  • 👏 32
  • 😁 11
  • 🤬 11
  • 👎 10
  • 🤨 9
  • 🦄 7
  • 🤷‍♀ 6
  • 🎉 1
Post #342 53K
Three hours ago 10.6K ETH ($18.5M) moved from an address linked to the $575M Hashflare investment fraud after sitting dormant onchain for 3.5 yrs.

In 2025 both co-founders Sergei Potapenko and Ivan Turogin plead guilty and forfeited $450M of assets to the US government.

The entity began laundering funds via HiFiSwap and Near Intents from Ethereum to Bitcoin and began using two instant exchanges.

H/t to Cyvers for helping first flag these movements to me.

Hashflare address
0xff575a22975cc413771825eb84c163189a4d5d22
Hashflare transfer
0xd0eafd5c03b24c2f54c579745cacbffe4c6df2d19973e55d52a5f40aa1d089e0
Recipient address
0xc82f007bb4096a47d14ed0d46ee8143d37539d04
0x3297a41f528345c3b97af8c6ffe1401cc07b2527
  • ❤ 160
  • 👍 86
  • 🔥 29
  • 😱 23
  • 🙏 14
  • 😭 12
  • 🗿 12
  • 😁 11
  • 🕊 8
  • 🤔 6
  • 🐳 6
Older posts →

About this channel

How can I read @zachxbt without a Telegram account?
TGViewer shows the public web preview Telegram publishes for Investigations by ZachXBT: recent posts, photos, videos and the subscriber count, with no app, login or account.
How many subscribers does Investigations by ZachXBT have?
Investigations by ZachXBT (@zachxbt) has 107K subscribers on Telegram, refreshed roughly every 30 minutes.
Does Investigations by ZachXBT know I viewed it here?
No. Public channel previews carry no viewer identity, and TGViewer has no accounts or tracking of what you look up.
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →