ZachXBT is an independent forensic investigator, threat intelligence researcher, and transparency advocate. Since 2021 ZachXBT has traced stolen funds, identified the operators behind thefts and scams, coordinated freezes with exchanges, and produced evidence that has held up in civil and criminal cases, all run independently and published in public.
Nearly every published investigation to date was done unpaid, and that record is the credential. As select engagements come in, the rule holds: the findings follow the evidence, whoever is funding the work, and publication decisions stay with ZachXBT.
Findings are published openly with the supporting evidence so anyone can verify the work.
The measure of success is funds frozen or returned and evidence that holds up in court, not engagement.
Attribution is published only when the onchain and offchain record supports it.
The same discipline whether a case is public-interest or a paid engagement. For published work, every step is documented publicly so it can be checked.
Cases originate from victim reports, community tips, and anomalies spotted in public data. Tips are accepted anonymously and no submission metadata is collected.
Stolen funds are followed hop by hop across chains, bridges, mixers, and exchange deposits, using public blockchain data and industry-standard tracing practice.
Onchain flows are corroborated with OSINT and offchain evidence until the operators behind an incident can be identified with confidence.
Exchanges and issuers are notified to freeze assets, victims are supported through recovery, and the evidence is packaged for civil and criminal legal cases.
Investigations are published when the evidence is strong enough to stand on its own. Where publication could jeopardize an active freeze or a pending legal action, findings are shared privately with the relevant parties first.
Roles held alongside the casework, listed for transparency.
Security Council
Incident response advisor
Security Council
Advisor
ZachXBT takes on a limited number of paid engagements: incident response, fund tracing, threat intelligence, expert reports, and advisory. For active incidents or information about a case, the fastest channel is a direct message on X or the tip form.
