A Bitcoiner lost $91 million in a single transaction to a social engineering attack on Tuesday, with funds then sent to a privacy-focused Bitcoin wallet, according to blockchain investigator ZachXBT.

The victim was deceived by impostors posing as crypto exchange and hardware wallet support, losing 783 Bitcoin (BTC) in a single transaction, ZachXBT said in an X post on Thursday.

Blockchain data shows the theft occurred on Tuesday at 11:06 am UTC, and the exploiter started laundering the stolen funds a day later through the Bitcoin privacy-focused Wasabi Wallet to conceal the trail of the stolen funds, ZachXBT said. 

Social engineering attacks involve attackers tricking people into revealing sensitive information, such as their private keys or passwords, allowing attackers to steal the funds. These exploits have been rampant in crypto, targeting everyone from sophisticated crypto investors to the elderly. 

Asked how one can avoid being socially engineered, ZachXBT said to assume every call or email received is a “scam by default.”

ZachXBT rules out North Korea hackers

While ZachXBT didn’t name any suspects, he ruled out the notorious North Korean state-backed Lazarus Group as a potential culprit.

The attacker received the funds at a clean Bitcoin wallet address — ‘bc1qyxyk’ — before using Wasabi Wallet’s privacy features to try to conceal them.

ZachXBT added that, coincidentally, the attack occurred exactly one year after the $243 million Genesis creditor theft.

Scammers impersonating hardware crypto wallet providers

Scammers have frequently impersonated crypto hardware wallet providers such as Ledger and Trezor using sophisticated methods.

In late April, scammers impersonating Ledger sent out letters posing as the company, asking users for secret recovery phrases to crypto wallets in an attempt to take control of the device. 

They claimed a “critical security update” needed to be performed on their devices and that failure to comply may “result in restricted access to your wallet and funds.”

Related: Small setups, big wins: Is solo Bitcoin mining making a comeback?

In the same month, an elderly US citizen lost over $330 million worth of Bitcoin to a social engineering attack, sending shockwaves through the industry.

Crypto theft is still a multibillion-dollar industry

More than $2.1 billion was stolen from crypto-related attacks across the first five months of 2025, with the bulk of losses coming from wallet compromises and phishing attacks, blockchain security firm CertiK said in June.

The largest incident by far was the $1.4 billion exploit of crypto exchange Bybit in February, highlighting that even large, extensively audited crypto platforms remain at risk.

Magazine: Bitcoin’s long-term security budget problem: Impending crisis or FUD?

]]> https://earlybirdsinvest.com/bitcoiner-loses-91m-in-social-engineering-attack-zachxbt/feed/ 0 54462 https://earlybirdsinvest.com/grok-refuses-to-pick-winner-for-crypto-rover-competition-citing-zachxbt-pump-and-dump-evidence/ https://earlybirdsinvest.com/grok-refuses-to-pick-winner-for-crypto-rover-competition-citing-zachxbt-pump-and-dump-evidence/#respond Mon, 21 Jul 2025 09:05:58 +0000 https://earlybirdsinvest.com/grok-refuses-to-pick-winner-for-crypto-rover-competition-citing-zachxbt-pump-and-dump-evidence/

X’s Grok chatbot declined to select a winner for a $1,000 Ethereum giveaway organized by crypto influencer Crypto Rover, citing prior allegations of pump-and-dump activity detailed by on-chain investigator ZachXBT.

In replies to users participating in the weekend contest, Grok stated it was abstaining from choosing a winner due to “substantiated reports” implicating Rover in schemes that could compromise community safety.

The messages are now unavailable but circulated in screenshots showing Grok referencing ZachXBT’s findings and calling for caution. The interaction stemmed from a routine promotional giveaway in which Rover, who posts under @rovercrc and has over 1 million followers, invited users to like, repost, and follow his account for a chance to win the prize.

As ZachXBT reported, the allegations center on a project Rover was contracted to promote in May 2023. The deal included a $10,000 payment, a percentage of the project’s token supply.

According to the investigation, Rover made no promotional posts as agreed and later claimed he would delay content until “better market conditions,” while threatening legal action against the project’s team for attempting to call him out.

ZachXBT linked Rover’s wallet activity to subsequent token sales, generating roughly 40 ETH in profits. The funds were routed to a known Bybit deposit address previously associated with Rover.

The probe also identified 10 fresh wallets tied to the same promotional period that accumulated 9 percent of the token’s supply shortly before Rover posted about the asset. The project team behind the meme coin ceased communications shortly after, with no further updates beyond May 2023. In previous posts, Rover reportedly stated he could “pump projects from half a million to ten million easy,” a remark ZachXBT highlighted as part of a broader pattern of manipulative behavior.

Rover did not publicly address Grok’s specific decision and has continued to tag Grok for his next giveaway.

Not all of Grok’s responses refused to engage with Crypto Rover. Many replies to Crypto Rover and his followers affirmed that the bot would select a winner for the giveaway. However, per the latest posts, none was chosen by the bot.

Grok, developed by xAI, has previously drawn scrutiny for its erratic output, including unverified claims and inflammatory responses, though its creators position it as a “maximally truth-seeking” assistant.

ZachXBT’s forensic investigations have become a fixture in crypto accountability circles, with previous work cited in law enforcement actions and asset recoveries totaling over US $210 million, per a 2024 Wired profile.

Mentioned in this article

An investigation by top on-chain analyst ZachXBT has revealed how an alleged New York-based con artist stole millions of dollars from victims by pretending to be support staff from Coinbase.

In a thread on the social media platform X, the pseudonymous sleuth details how a man named Christian Nieves – who goes by “Daytwo” and “PawsOnHips” online – allegedly stole $4 million from Coinbase users by impersonating employees at the crypto exchange.

ZachXBT says that Nieves operates a small scam-call center group and also works as a caller. The group allegedly primarily coerces their victims into setting up a Coinbase wallet with an already compromised seed phrase on phishing sites.

Other people in Nieves’ circle also allegedly helped in separate thefts, including a henchman named Justin going as “Paranoia” who executed a $240,000 heist of an elderly victim’s Bitcoin (BTC) wallet.

According to ZachXBT, a portion of that $240,000 was deposited into crypto betting site Roobet, and the rest was converted into Monero (XMR).

“I traced out his casino deposit address which links onchain to 30+ suspected thefts.

I expect there’s many additional victims I am unable to directly link.

While there’s potentially overlap between multiple threat actors the vast majority of activity pertains to Daytwo… 

Daytwo has a gambling problem and you’ll see onchain how casino deposits get smaller as he loses funds.

Recently this escalated to the point where he started stealing cuts from accomplices.”

At time of writing, Nieves and his alleged accomplices have not been charged with anything by law enforcement, but given the amount of digital and on-chain evidence, ZachXBT says it should be a “rather easy” case for authorities.

However, most of the victims’ money is likely unrecoverable since it has been lost to gambling, the analyst says.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Featured Image: Shutterstock/Urboshi/Natalia Siiatovskaia

Crypto Journalist

Anas Hassan

Crypto Journalist

Anas Hassan

About Author

Anas is a crypto native journalist and SEO writer with over five years of writing experience covering blockchain, crypto, DeFi, and emerging tech.

Share

Last updated: 

June 17, 2025

Prominent blockchain investigator ZachXBT has uncovered evidence linking WhiteRock Finance project to the notorious $33 million ZKasino exit scam, exposing what appears to be an elaborate money laundering operation.

This scheme was designed to legitimize stolen funds through a seemingly legitimate real-world asset tokenization platform.

The investigation reveals direct on-chain connections between WhiteRock’s marketing wallets, ZKasino’s stolen presale funds, and a personal email address that ties key team members from both projects together.

What is ZKasino?

The ZKasino scandal originally erupted in April 2024 when the blockchain gambling project abruptly diverted $33 million worth of investor funds to Lido’s staking protocol instead of returning them as promised to presale participants.

The scheme led to the arrest of team member Elham Nourzai by Dutch financial crime authorities, while alleged co-conspirators Ildar Ilham and Lior Ben Zakan reportedly fled to the Middle East.

Following Nourzai’s release in late 2024, the stolen funds began moving through a sophisticated laundering network that employed chain-hopping across ZkSync, Starknet, EVM, and Solana networks.

Proceeds were converted to Monero through instant exchanges, cashed out via OTC brokers, and traded on perpetual platforms like Hyperliquid.

ZachXBT’s investigation reveals that WhiteRock emerged in late 2024 with immediate red flags, including an anonymous team without verifiable history, fabricated partnership claims, and funding sources linked to instant exchanges commonly used for money laundering.

The investigator traced funds from ZKasino’s stolen treasury directly to WhiteRock’s marketing wallet, which was subsequently used to pay influencers for promotional content.

Most damning, ZachXBT discovered that a personal email address associated with WhiteRock’s deployer wallet belongs to an account named “IldarTheGrandMaster” on Chess.com.

This directly links the project to Ildar Ilham, one of ZKasino’s alleged masterminds, who operates under the alias “Prometheus.”

From Presale Scam to RWA Revolution: The ZKasino Money Laundering Scheme

The ZKasino exit scam represents one of the most brazen betrayals of investor trust in recent crypto history. It began as a promising blockchain gambling platform that raised over $30 million through presales before revealing its true nature.

The project initially promised participants that their bridged Ethereum would be returnable, but when launch day arrived on April 20, 2024, ZKasino dramatically altered the terms.

Instead of honoring withdrawal requests, the team converted all 10,515 ETH to ZKAS tokens at a heavily discounted rate of $0.055, subject to a punitive 15-month vesting schedule that effectively trapped investor funds.

The deception deepened when investigators discovered that ZKasino’s supposed revolutionary blockchain was merely an Arbitrum Nitro chain lacking the zero-knowledge technology that formed the core of its marketing promises.

Following the collapse and subsequent arrests, the stolen funds underwent sophisticated laundering through multiple blockchain networks and financial instruments.

This multi-vector laundering strategy, explained by ZachXBT, mirrors tactics seen in other major crypto crimes.

Recent cases include Australian authorities uncovering a $190 million laundering network that mixed illicit crypto with legitimate business income and European investigations into OKX’s alleged role in laundering $100 million from the Bybit hack.

How Stolen Millions Funded WhiteRock’s Success Story

WhiteRock, launched on December 24, 2024, positioned itself as a revolutionary platform that would bring traditional markets onto the blockchain.

The platform quickly gained traction by promising to democratize access to traditionally exclusive wealth-building opportunities through its native WHITE token and USDX stablecoin.

However, ZachXBT’s investigation reveals that WhiteRock’s impressive growth metrics and partnership claims were built on fraudulent foundations.

The project’s marketing campaigns, funded directly through wallets containing ZKasino’s stolen funds, promoted fake partnerships with major financial institutions.

StoneX publicly denied WhiteRock’s partnership claims, while supposed collaborations with BlackRock and First Citizens Bank lacked any verifiable evidence.

The project’s most audacious claim involved rumors of a partnership with Saudi Aramco through Ripple to tokenize oil supply chains, which drove WHITE token prices up 110% on May 30 despite having no factual basis.

ZachXBT has called for major exchanges, including MEXC and Gate.io, to delist WHITE token and conduct enhanced due diligence.

Crypto Reporter

Shalini Nagarajan

Crypto Reporter

Shalini Nagarajan

About Author

Shalini is a crypto reporter who provides in-depth reports on daily developments and regulatory shifts in the cryptocurrency sector.

Share

Last updated: 

June 1, 2025

Silk Road founder Ross Ulbricht received a donation of 300 Bitcoin, worth over $31m, to his official donation wallet on Sunday.

The transaction, flagged by blockchain analysts and tracked by platforms such as Lookonchain and Arkham Intelligence, has sparked a wave of speculation across the crypto community.

The funds appear to have passed through Jambler, a centralized Bitcoin mixing service, rather than more widely used decentralized privacy tools like Wasabi or Samourai.

Blockchain investigator ZachXBT noted that two dormant addresses, active as far back as 2014 and 2019, deposited large sums into Jambler between April and May. These deposits coincided with the transfer to Ulbricht’s wallet, casting doubt on theories that the donation was a self-transfer from hidden pre-arrest funds.

ZachXBT Links Ross Ulbricht Donation to Flagged Bitcoin Address

According to ZachXBT, the donation likely was not a self-transfer as some had speculated, though it appears to have originated from a “questionable source.”

The unusually large size of the gift, coupled with its obscure origin, has raised eyebrows.

One of the addresses linked to the transaction, 1CNDW, had previously been flagged in compliance tools, adding to the concerns.

Ulbricht Reflects on Prison and Freedom

Ulbricht walked free in Jan. 2025 after serving 12 years of a double life sentence. His release followed a controversial pardon issued by US President Donald Trump.

Since then, Ulbricht has re-entered public life, speaking at the Bitcoin 2025 conference in Nashville and auctioning personal memorabilia, including prison-era art and possessions.

The donation arrived shortly after Ulbricht’s auction concluded, which had raised over $1.3m in Bitcoin. However, despite the timing, the 300 BTC transfer was not connected to the sale. This disconnect has only deepened the mystery surrounding its origin.

The donation wallet, managed by the FreeRoss.org campaign, funds legal advocacy and public education around sentencing reform. While the money greatly supports these causes, its unclear path, especially through a centralized mixer, has cast a shadow over what might have been a celebratory moment.

Meanwhile, Ulbricht addressed a packed audience in Nashville. He reflected on the dramatic shift in his life, recalling moments when he thought he might die in that “awful cage.” Still, he said he fought to find joy, even in the darkest times.

The thief behind the massive Coinbase exploit earlier this month has begun swapping their stolen crypto.

On Wednesday, pseudonymous on-chain investigator ZachXBT noted on Telegram that the exploiter had swapped $42.5+ million worth of Bitcoin (BTC) into Ethereum (ETH) via the decentralized liquidity protocol THORChain (RUNE).

ZachXBT also notes that the thief trolled him with an on-chain message that said “L bozo” and linked to a YouTube video of former NBA star James Worthy smoking a cigar.

The exploiter later swapped 8,697 ETH for 22 million of the stablecoin Dai (DAI), according to the blockchain security firm PeckShield.

PeckShield also notes that a different address that is “highly relevant to the threat actor” received 9,081 ETH from THORChain, then swapped that ETH for 23 million DAI.

That relevant address later received another 8,569 ETH (worth approximately $22.4 million) from THORChain.

Coinbase says criminals bribed a small group of overseas customer support agents to copy the data of less than 1% of the firm’s monthly transacting users. A recent filing with the Maine Attorney General’s Office indicates the breach impacted 69,461 people.

The exchange notes that hacked information includes names, addresses, phone numbers, email addresses, masked social security numbers (the last 4 digits only), masked bank-account numbers, some bank account identifiers, government-ID images, account data and limited corporate data.

Coinbase learned about the hack after receiving an email earlier this month demanding a $20 million BTC payoff in exchange for not releasing the illegally obtained info. The company refused to give in to the hackers’ demand and estimates it will pay $180 million to $400 million in remediation costs and voluntary customer reimbursements.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Ever since Bitcoin first emerged, Web3 has been a breeding ground of innovation, creativity and financial independence. However, it’s also seen its share of rogues, scammers and bad actors. One man has made it his mission to investigate these bad apples and bring them to justice. That person is ZachXBT.

Dedicating himself time to the task of probing on-chain fraud, ZachXBT has played a major role in uncovering some of the biggest scams, frauds and thefts in blockchain history. Whether relating to crypto, NFTs or digital collectibles, he has helped to shine a light on the more unsavoury elements of the industry, and assisted countless victims in recovering their funds.

ZachXBT is one of the most widely appreciated figures in Web3 – but how did he first emerge, what are some of his biggest investigations, and what can we expect from him in future?

Here’s our complete guide to ZachXBT.

Key Insights

• A pseudonymous Web3 investigator
• Played a major role in uncovering big Web3 scams and thefts
• Emerged as an on-chain investigator in 2018
• Has recovered or helped to seize over $500 million USD in assets
• One of the most widely appreciated figures in Web3

Who is ZachXBT?

ZachXBT is a pseudonymous cryptocurrency investor and Web3 fraud investigator.

Little is known about the person behind the name. We know that he has been a crypto investor for many years – since at least 2017 – and that he largely began to investigate on-chain activity in 2018.

Since then, ZachXBT has become arguably the most well-known blockchain sleuth in the world. His work has revealed multiple multi-million dollar scams, frauds and thefts, and his name has become synonymous with what’s ‘good’ in the Web3 industry.

His avatar – a cloaked four-eyed platypus – has become a symbol for justice, becoming a well-recognised positive symbol across the Web3 community.

Though we know little about ZachXBT personally, he has earned a peerless reputation for his detailed blockchain analysis, his investigative talent, and the dedication to his craft.

What does ZachXBT do?

In short, ZachXBT is a specialist in tracking stolen digital assets and exposing fraud within crypto and the NFT markets. Utilising his knowledge of blockchain, he follows on-chain trails, monitoring exchanges and networks to track ill-gotten funds.

Typically, his work involves:

• Tracking transactions: Keeping an eye on blockchain activity to spot transactions connected to theft or fraud
• Exposing scams: Identifying crypto projects and NFT collections that mislead investors or make unethical decisions
• Collaborating with authorities: ZachXBT works with law enforcement agencies to help recover stolen funds
• Publishing his investigations: ZachXBT posts detailed reports on social media, demonstrating the evidence he has collected

ZachXBT has largely operated on donations and grants from leading figures in the Web3 community, with his work described as a public service rather than a path to personal gain. In more recent times, ZachXBT has taken more official roles in the industry – though remains an independent investigator.

Since the inception of his work, ZachXBT’s investigations have led to the recovery or seizure of over $500 million USD, as well as the prosecution and arrest of many of the most notorious blockchain-based scammers.

How did ZachXBT emerge?

ZachXBT began like many others – as a crypto enthusiast exploring this new industry.

In 2017, he invested into a number of crypto tokens that would become rug pulls or outright scams. Additionally, 2018 saw one of his wallets be hacked, resulting in a loss of $15,000 USD in crypto.

These losses led ZachXBT to learn more about how blockchain technology works, how these scams and hacks work, and if there was a way to return his funds.

He began by tracking blockchain transactions, uncovering the patterns and methods used to conceal stolen funds. Realising that there were many like him who had also fallen victim to these losses, ZachXBT started to expose these scams in an effort to protect others.

ZachXBT has gone on to expose larger examples of fraud, and has garnered over 850,000 followers on X. Today, he is a full-time blockchain investigator, spending his time analysing fraud, raising awareness within the community, and obtaining justice for victims.

What are ZachXBT’s biggest investigations?

ZachXBT has played a key role in many high-profile Web3 investigations. Some of the most notable investigations include:

The Bitcoin Heist

August 2023 saw ZachXBT uncover one of the largest individual crypto thefts in blockchain history.

Whilst at an airport waiting for a flight, ZachXBT began to receive alerts on a set of Bitcoin transactions that came to a total of $243 million USD. Feeling that something was wrong, he began to track the funds and discovered that they originated from a wallet that hadn’t been active since 2012.

ZachXBT took his flight, and by the time it had landed, he’d identified the three leading suspects: Malone Lam, Jeandiel Serrano and Veer Chetal. Over the next few weeks, he tracked the stolen funds and gathered evidence, and today, all three suspects have been arrested.

Authorities seized or froze $79 million USD of the stolen funds from this theft – and as of writing, the remainder is still being tracked down.

Pixelmon

Pixelmon emerged in 2022, with the goal to build a 3D Pokémon-style game funded through an NFT collection.

The project raised roughly $70 million USD by selling high-quality, interactive 3D NFTs that promised to have utility in the game – but when the NFTs were revealed, their poor visual quality led to huge community outrage.

ZachXBT took a look at the project and discovered they had misappropriated much of the $70 million USD raised. This included spending 400 ETH on Bored Apes and Azuki NFTs. This backlash saw a new leadership team be installed in September 2022, starting a road to recovery that continues to this day.

Rogue Society

Rogue Society is a 15,777-piece NFT collection on Ethereum, with the goal to build a huge space-themed IP.

Released in September 2021, Rogue Society raised $5.5 million USD – but post-mint, they didn’t deliver on their promises. ZachXBT investigated the founder, Jahvin Bowman (@LecheTheMilky), and discovered that the project was a scam from the beginning.

ZachXBT would further uncover that the team had been holding fake pay-to-enter competitions, extracting even more funds from their community.

Logan Paul

At the height of altcoin season, infamous internet personality Logan Paul promoted several memecoins to his legions of followers.

ZachXBT took a look at these memecoins and found out that most of them were ‘pump-and-dump’ scams that saw Paul and the token creators earn huge amounts off the back of his fans.

These projects included DinkDoink, Elongate and $FLOKELON. Accusations of blockchain-based scams follow Paul to this day – with his failed CryptoZoo project continuing to receive major backlash.

BitBoy Crypto (Ben Armstrong)

For much of the initial explosion of interest in Web3, BitBoy Crypto was the #1 crypto influencer, with hundreds of thousands of followers receiving his tips on the latest crypto coins and assets on a daily basis.

ZachXBT investigated BitBoy Crypto and found that he had been paid significant fees – between $2,500 USD and $40,000 USD per project – to promote a variety of scams.

BitBoy claimed that he took a thorough look at any projects that paid him, however ZachXBT provided substantial evidence of his direct involvement in at least seven scam projects that defrauded investors. Future controversies would see BitBoy disappear from Web3 altogether.

Machi Big Brother

Machi Big Brother – real name Jeff Huang – is a Taiwanese entrepreneur and NFT collector.

ZachXBT investigated numerous suspect transactions involving Huang, leading to the publication of an article that accusing him of involvement in multiple fraudulent activities. This included the misappropriation of funds from blockchain treasury platform Formosa Financial.

Huang filed a defamation lawsuit against ZachXBT in June 2023, however leading Web3 names banded together to contribute to his legal defence, including companies such as Coinbase, Binance and OKX.

North Korean hackers

A substantial amount of ZachXBT’s time over the past year has been spent exposing North Korean activity in Web3. This includes a number of scams and hacks originating from the country, as well as citizens of North Korea that have infiltrated the development teams of leading Web3 projects.

These investigations have resulted in the discovery of over $200 million USD in stolen funds across a minimum of 25 thefts, with over half of these thefts yet to be public knowledge prior to ZachXBT’s involvement. His actions helped to freeze millions in stolen assets, and provided crucial knowledge into how North Korean hackers are infiltrating the industry.

What’s next for ZachXBT?

ZachXBT has – and will continue to have – an incredible impact on the Web3 industry.

His reputation as an investigator is unmatched, and thanks to his efforts, the blockchain industry is more secure, aware and transparent place today than ever before. Thanks to his actions and others like him, we’ve seen a noticeable decline in frauds and scams over the past few years – and those that do occur lead to prosecutions and recovered assets in more and more cases.

Though ZachXBT’s identity remains a mystery, his actions speak louder that many in Web3. His name is synonymous with community, support and justice – and long may it continue to be so.