ZachXBT
Independent crypto investigator
Investigations that connect crypto thefts and scams to transaction trails, communications and public records.
Why read ZachXBT?
Read ZachXBT when you want to understand how stolen funds moved and what connects an incident to the people accused of carrying it out. His September 2024 investigation into a $243 million theft combines blockchain transactions with recordings and communications. A reused deposit address is one specific clue he explains: it connects the laundering trail back to stolen funds.
His Bybit and Phemex post offers a smaller example of the same approach: he identifies commingled funds as a connection between two incidents. Start with the transaction claim, then follow the case updates and the evidence used for attribution. His public researcher statement also explains his incident-response work and his advisory relationship with Paradigm.
Selected work
-
The $243 million social-engineering theft investigation
How can a money trail help explain a theft? Start with the incident summary, then point 11b on a reused deposit address. The thread also shows why identifying people requires evidence beyond transaction links.
Cite this selection
XFollowList, “The $243 million social-engineering theft investigation” reading notes in the ZachXBT profile. https://xfollowlist.com/people/zachxbt#work-751c17bf1a5d
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
-
An onchain connection between the Bybit and Phemex hacks
What connects two separate incidents? His post identifies an overlap address and commingled funds. It is a compact starting point for following the underlying tracing claim.
Cite this selection
XFollowList, “An onchain connection between the Bybit and Phemex hacks” reading notes in the ZachXBT profile. https://xfollowlist.com/people/zachxbt#work-c6cc610b86b7
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
Projects & roles
Investigations by ZachXBT
His public channel for investigations, alerts and case updates, linked from his own researcher statement.
Paradigm
He announced an incident-response advisory role in February 2025.
Sources & further reading
Profile sources checked . This describes checking these references, separately from the publication dates of selected works.
- His own account of his research, incident response and public channels.Link to this source note
- A readable copy of his September 2024 investigation.Link to this source note
- The September 2026 legal update on Malone Lam's guilty plea in the broader criminal enterprise.Link to this source note
Cite this profile’s source check
XFollowList, ZachXBT profile sources. Sources checked 2026-10-09. https://xfollowlist.com/people/zachxbt#sources-checked