Investigations by ZachXBT


Kanal geosi va tili: Butun dunyo, Inglizcha


Reports, news, & insights shared by ZachXBT
Donation address
EVM
0x9D727911B54C455B0071A7B682FcF4Bc444B5596
SOL
investigations.sol

Связанные каналы  |  Похожие каналы

Kanal geosi va tili
Butun dunyo, Inglizcha
Statistika
Postlar filtri


Please stop flexing phantom screenshots and your expensive purchases this bull run on CT.

TLDR: Family member of a crypto influencer was just kidnapped and found by the police in the trunk of a car, with gasoline on him in France after trying to extort the son for money.

Source 1: https://www.francebleu.fr/infos/faits-divers-justice/un-homme-retrouve-ligote-dans-le-coffre-d-une-voiture-interceptee-par-la-police-pres-du-mans-deux-hommes-en-fuite-7958611

Source 2: https://cryptoast.fr/pere-influenceur-crypto-sequestre-soir-nouvel-an/


The Blockchain Bandit attacker woke up after being dormant for multiple years and consolidated 51,000 ETH ($172.2M) to a single multisig.

Multisig address
0xC45C36017b0B7708f493534Ca4f0930964C1D542


There’s been so many account compromises on X/Twitter lately.

Would expect a new panel, recovery method, or exploit is going around as I highly doubt all of these accounts lack 2FA with a security key or authenticator app.


Update this number has increased to $12.38M stolen from 100+ victim addresses. See the address list here.


LP-5.36M-Dec-2024.png
113.0Kb
Today an estimated $5.36M was drained by the LastPass threat actor from 40+ victim addresses.

Stolen funds were swapped for ETH and transferred to various instant exchanges from Ethereum to Bitcoin.


Which one of you hacked Drake to promote a meme coin scam?


Community alert: A threat actor compromised the Cardano X/Twitter account. Do not click any links posted.


Victim was drained due to the WallStreetBets ATO on X/Twitter where a phishing site was posted.

Attackers recently have been exploiting a bug with X on mobile where after compromising an account they add pass keys which currently are not shown to the original account owner and previously were not being reset by support.


A few hours ago a victim was drained on Solana for $2.2M+ worth of meme coins ($1.43M PNUT, $400K ZEREBRO, $130K ALCH, etc)

Theft address
7DQZQzydMPhFdhQnFYkwwNkykqeYADcj14JxYLAgVbBm
2CJ5d3o6MaCsgmZNZRrDE9fHuWRZ3Gpc5MBdMkz6HUxy
8qRK51ghCidRvwpYNRiu9hdUsg6UA7ZQF71HCAeUnBDZ


Yubico (security key), Proton (email), & Tuta (email) all have sales going on today for those who still use gmail or have SMS 2FA enabled instead of a security key.

Proton lets you pay with crypto (BTC only). Tuta you can buy a giftcard with XMR from their official partner (ProxyStore).

Trezor & Ledger also have select items on sale as well if you still do not own hardware wallets and leave all funds in a hot wallet.

While most of you do this many others need the reminder as way too many thefts/incidents are preventable. Remember to only purchase items on the official site and not from random marketplaces/stores. I do not have referral links.


A few hours ago wallets tied to crypto influencer JRNY saw ~$4M worth of crypto assets suspiciously transferred out and sold indicating a potential private key compromise.

Theft address
0xc467150582cfc8eec4132a483c76101d3636f598
0x6fd6c8fd64c7efdb8eec902161d3bbc035430456
0xa2dd5e2ab84240cbecc7beaca9946afef97ae74a


Multisig exploiter just transferred 9980 ETH ($31.4M) to the crypto exchange eXch, swapping from Ethereum to Bitcoin in 7 orders.

Source address
0x2d146Aa23645950FDefBb23f636A5d1674FE1047

Destination address
bc1qffvx38hplm6ym5el5yakxmntezv7tg6yurghnq
bc1qut035lpe0k6yklcrkaquhvg4x65lkg5n3uvnel
bc1qe6yk9rnae0l96775gu99zvjdy496j3rrfc5sm0
bc1q4cwvw5x89pjaquq5e25ghjgffevmz6rtz043tx
bc1qpj24paw8hunju2z6fharwej82rfjywexsz629a
bc1qrzzdx82jv4t4tlkfc0gsqjpjp2r9r6ptq7rtuf
bc1qyht95cksxh2un0elgdaq0up874s99kj80ev97d


On-chain clown of the day: The threat actor who hacked Andy Ayrey sold PNUT early for $6.4K and missed out on $31.6M.

Wallet address
Gx3uCAS7su6HjVASf74KkPgsU23DP5sg8LmqiHStXmmT


Do not expect my help with ecosystems where people do not actively support my work (Arbitrum, Cosmos, zkSync, Aptos, Sui, Scroll, etc).

I currently only assist people on the chains which make my work possible: Solana, Ethereum, Bitcoin, OP/Stark.

There is already many scams as is so I would rather focus my time on helping the ecosystems which give back and fund public goods (I receive 1K+ inbounds / month).

This is just a general reminder for all of those people who think they are entitled to my time for free.


Do not buy the Wiz Khalifa Pump Fun it's the same hacker who compromised Andy Ayrey (Truth Terminal creator) the other day.

51k 3 189 590

Looks like the crypto casino Metawin was exploited for $4M+ on Ethereum and Solana earlier today.

See 115+ theft addresses tied to the exploiter here.

So far stolen funds have been transferred to Kucoin and a HitBTC nested service.


I did some initial tracing for the Andy Ayrey (Truth Terminal creator) hack this week which lead to $1.5M+ stolen from deploying multiple bundled meme coins and found one of the people involved in the incident appears to be a FWOG whale.

Theft consolidation address
0xcd27994d2a460e3f7bdee75974188040d7fe723e
6haUPtErdx5g88G6Rv4itwB37XzqvRjaCuJnn4J85Pro
Apc3eA9ScQksuZvfURQswZwVkusEYRaqeKEv4eXXbRZm
CAwocNV1VaEmXoi2XPnfcYZSxnJ3fBTiWNgtPtF3nriH

Holder address
AtdSsizerZZMVuStX4Ji5kAY1bPnNi9LdymfQ4DWuLcr

50k 1 174 389

The crypto exchange M2 was hacked for ~$13M from hot wallets on multiple chains yesterday.

Theft addresses
ETH: 0x968b6984cba14444f23ee51be90652408155e142
BTC: bc1qu4kh7wa38xpkrp8frgxl4sak88wx0jug8n3vfj
SOL: EKko14NvgqdvNttUb8JjXkVGuUs6BTikjfN3hqW4LQoL


Update: The threat actor just transferred $19.2M back to the compromised US government address in the last 30 minutes.

This amount does not include the funds already transferred to instant exchanges (Switchain, HitBTC, N Exchange).


Looks like $20M of seized funds tied to the US Government was likely stolen in the past hour.

Theft address
0x3486ee700ccaf3e2f9c5ec9730a2e916a4740a9f
0xbf6f7c503e858aded4e18ce2bcf93846fd726c15
0x15d0a31ed5050ed8decd3c101aaee0b2ad2e6441

20 ta oxirgi post ko‘rsatilgan.