ArticlePropose editHistory

ZachXBT

From memecoin.wiki, the free memecoin encyclopedia
ZachXBT
ZachXBT
Image: X profile avatar of @zachxbt
handle@zachxbt
roleon chain investigator
known forBybit Lazarus attribution, the 243 million dollar Genesis creditor theft case, exposing scam promoters

ZachXBT is a pseudonymous on chain investigator whose unpaid forensic work has led to arrests and convictions in major crypto thefts, and whose threads on scam influencers and celebrity coins are treated as the closest thing the trenches have to law enforcement.

Contents
  1. 1 Investigations
  2. 2 The trenches beat
  3. 3 Controversies
  4. 4 References

ZachXBT is a pseudonymous American blockchain investigator who has become the de facto internal affairs department of crypto. According to his Wikipedia biography, he entered the space around 2017, lost money to fraudulent ICO era projects, taught himself blockchain analysis, and began publishing investigative threads on X in 2021. His investigations are usually free and crowdfunded by donations, and in February 2025 he joined the venture firm Paradigm as an incident response advisor. Court filings from 2023 cited in later reporting identify him as Zachary Wolk, though he continues to operate under the pseudonym.

Investigations

His casework spans the entire crypto crime landscape. An early investigation into a Bored Ape Yacht Club phishing ring that stole 2.5 million dollars in NFTs led to arrests and convictions in France. In August 2024 he noticed an unusually large Bitcoin movement and unraveled the theft of about 243 million dollars from a Genesis creditor, tracing 4,064 BTC across more than fifteen exchanges; the work contributed to the arrests of Malone Lam and Jeandiel Serrano in September 2024, Veer Chetal in March 2025, and Danish Zulfiqar in December 2025. Within hours of the February 21, 2025 Bybit hack he submitted evidence attributing the 1.5 billion dollar theft to North Korea's Lazarus Group, an attribution later confirmed by the FBI. In January 2026 he investigated the theft of 46 million dollars in crypto seized by the US Marshals Service, identifying the alleged thief as John Daghita, alias "Lick," who was arrested that March. He has also quantified that Coinbase users were losing roughly 300 million dollars a year to social engineering scams.

His 2026 casework continued at the same pace. On August 10, 2026 he linked US resident Tiffany Milanovich to at least 5 million dollars in exchange support impersonation thefts, an allegation from his own investigation. He tied a teenager, Dritan Kapllani Jr, to about 19 million dollars in social engineering thefts, and reported that 95 percent of the Bitget promoted LAB token supply was insider controlled, calling it a multi front retail rug, again per his own findings.

The trenches beat

For the trenches, ZachXBT matters most as the standing audit of KOL culture. He has documented paid promotions and pump and dump patterns around celebrity tokens, including the wave of hijacked and rented celebrity accounts associated with Sahil Arora in 2024, and his investigation tied the May 2024 hack of GCR's X account to the team behind a Solana memecoin. When a launch like the LIBRA scandal or a suspicious insider pattern hits, "wait for Zach" is a stock response on Crypto Twitter. CoinDesk named him among its Most Influential figures of 2025.

His most trench relevant case broke on February 26, 2026, when he alleged that employees of Axiom, the dominant trench trading terminal, a Y Combinator W25 company reporting over 390 million dollars in revenue, had abused internal support tools to access users' private wallet data. He named a senior business development employee, "Broox," who in recordings ZachXBT cited described tracking any user by referral code, wallet, or user id, researching wallets slowly "so it does not look that suspicious," compiling the private wallets of KOLs, and helping a colleague profit 200,000 dollars from the access. Axiom said it was "surprised and disappointed," cut internal tool access, and pledged accountability.

Controversies

His stature has drawn scrutiny of his own finances. In early 2025 he withdrew roughly 3.9 million dollars from the liquidity pool of an unsolicited tribute memecoin created in his name, which critics called hypocritical given his coverage of memecoin extraction; he responded that the token was unsolicited and disclosed other income including community funding and payments from protocols, per KuCoin and Datawallet summaries. Separately, subjects of his investigations have periodically accused him of inaccuracy or selective targeting, though his major case outcomes have repeatedly been validated by law enforcement.

References

See also
  • Zrool Zrool is a Danish crypto trader and streamer who also competes as a professional Fortnite
  • Absol Absol is a young pseudonymous Solana memecoin trader known for large self reported profit
  • Adin Ross Adin Ross is a Kick streamer whose crypto gambling broadcasts and role in the January 2025
  • alon Alon Cohen, known online as alon (@a1lon9), is a cofounder of pump.fun and the platform's
  • Anatoly Yakovenko Anatoly Yakovenko is the cofounder of Solana whose network became the home of memecoin tre
Category: People
Last updated 2026-08-19