ZachXBT is a pseudonymous on-chain investigator who tracks stolen crypto, exposes scammers and attributes hacks, mostly from a single X account and a Telegram channel. Since 2021 his work has helped freeze and recover hundreds of millions of dollars, named the attackers behind the biggest exchange hack in history, and put a long list of influencers, insiders and launderers on the record. He has no badge, no company and no public name. Yet when a hack lands, his account is the first place the whole industry looks.
This profile kicks off a new wave of our “who is” series. The first run covered the OG founders. This one covers the people who actually run crypto Twitter today: the investigators, traders and builders who move the timeline. ZachXBT goes first, because he is the one name in this group almost nobody has a bad word for.
Who is ZachXBT?
Nobody knows his real name, and that is the point. ZachXBT has stayed anonymous for his entire career, even after being sued and doxxed, because his work makes enemies that most people never have to think about. State-sponsored hackers, organized laundering syndicates and scammers with millions in stolen funds all have reasons to want him gone.
What is public is the work. He started posting investigations on X in 2021, back when the account was a side project calling out influencers who shilled tokens and dumped on their followers. The threads were long, boring in the best way, and built entirely on wallet addresses anyone could check. That format never changed. Five years later, a ZachXBT thread still reads like a court exhibit: screenshots, transaction hashes, timestamps, and a conclusion he lets the reader draw.
The scale changed, though. Today he runs the Investigations channel on Telegram, advises a top venture firm on incident response, and gets tagged by exchanges, stablecoin issuers and law enforcement within minutes of a major theft. Every post on this site about him sits under our ZachXBT tag, and that archive keeps growing for one simple reason. He keeps breaking stories nobody else can.
From influencer call-outs to Lazarus
The early years were about retail. ZachXBT’s first big threads traced how paid promoters pumped low-cap tokens, sold into their own followers, and moved on to the next one. He named names and showed wallets. Some of those names are still around, and some of them still pretend the threads never happened.
Then the targets got bigger. He mapped wallet drainer operations, tracked the proceeds of phishing campaigns, and started doing something nobody else was doing at scale: helping individual victims. A hacked user with a transaction hash could DM him, and if the funds hit a freezable point, he would point them to the right people. That part of his work rarely makes headlines. Still, for thousands of people it is the only reason their story has a second chapter.
By 2023 he was a fixture. By 2024 he was tracing nine-figure thefts in real time. In August 2024 a social engineering crew stole roughly $243 million from a single Genesis creditor, and ZachXBT’s thread on where the money went helped lead to arrests within weeks. The same year he traced funds from the $305 million DMM Bitcoin hack into Huione Guarantee, the Cambodian marketplace that later got cut off by US authorities. Those two cases moved him from “crypto Twitter sleuth” to a source that journalists and investigators treat as primary.
The Bybit hack and the Lazarus era
February 21, 2025 was the day the whole industry learned how fast he works. Bybit lost about $1.5 billion in ETH and staked ETH in the largest crypto theft ever recorded. Within hours, ZachXBT submitted evidence to Arkham linking the attack to North Korea’s Lazarus Group. Arkham paid out its bounty the same day, and the FBI confirmed the attribution days later.
He did not stop at the attribution. But he showed that the wallets laundering Bybit funds also touched the Phemex and BingX hacks, tying three separate thefts to the same crew. And he helped Tether freeze some of the proceeds. And then, as we now know, he went quiet on the most interesting part for a year and a half.
In October 2026 he published the full story. He had spent $349,700 of his own money posing as a client of a Chinese laundering network working for Lazarus, eating a 5% loss on every order to keep the relationship alive. The operator, a Telegram broker calling himself “Jimmy Green,” started telling him about Bybit fund movements before they happened. One day Jimmy said the money was going to Solana. The next day it did. That intel helped identify a cluster holding over $12 million in Bybit proceeds and contributed to Tether freezing 442,000 USDT. We covered the whole operation in our ZachXBT Lazarus sting post, and it is the single most impressive piece of crypto investigation I have ever read.
Lazarus is a recurring beat for him now. When Arkham flagged North Korean flows moving through Hyperliquid in September 2026, his earlier attribution work was the foundation everyone built on. We wrote about that episode in Hyperliquid and the Lazarus money, and his name was in every version of the story.
Coinbase, Axiom and the insider stories
Not every big case involves a nation state. Some of the most damaging ones involve people inside the companies.
In early 2025 ZachXBT estimated that Coinbase users were losing over $300 million a year to social engineering scams, where callers pose as support and talk victims into moving funds. Months later Coinbase disclosed that bribed support contractors had leaked data on nearly 70,000 customers. The attacker even sent him an on-chain taunt after swapping $42 million through THORChain. He had called the problem before the company admitted it, which is a pattern that repeats across his career.
In February 2026 he turned his attention to Axiom, the Solana meme trading terminal, and exposed insider activity that shook its user base. We broke down the ZachXBT Axiom investigation when it landed, and our Axiom review still carries a section on it. That one hit close to home for meme traders, because Axiom is a tool a lot of our readers use daily.
He also keeps pressure on the big players when they drag their feet. In 2026 he publicly listed over $420 million in illicit USDC that Circle failed to freeze in time, including $61 million from the Cetus hack that moved through Circle’s own bridge. He was careful to say he holds USDC and wants Circle to do well. He just wants them to act faster, because every hour of delay is another victim who does not get their money back.
The Machi lawsuit
The hardest moment of his career came in June 2023. Jeffrey Huang, better known as Machi Big Brother, sued him for defamation over a 2022 article alleging that 22,000 ETH had been embezzled from Formosa Financial. Huang also doxxed him. For a pseudonymous investigator, that combination is close to an existential threat.
The community response told you everything about how people see him. He asked for help, and within three days crypto Twitter had sent over $1 million to his legal defense wallet. Two months later Huang dropped the suit after ZachXBT amended the article. ZachXBT then did something rare in this industry: he returned the unused donations.
That episode matters for two reasons. It proved his readers trust him enough to fund him blind. And it showed the limits of what one person can do when the target has deep pockets. We will cover Machi in his own profile soon, because his story deserves the full treatment.
Why he turned harsher
If you have followed him for years like I have, you have probably noticed a change in tone. He is more blunt on X now. He pushes back harder on people asking for help, and he has publicly complained about the flood of DMs he cannot answer.
I do not blame him one bit. He became the only person in crypto that victims can reach, and people get hacked every single day. Someone who loses $100 is devastated, and that person ends up in his DMs right next to a $50 million exchange hack. Most of those cases are not something he can help with. Small thefts into unmixed wallets rarely hit a freezable point, and there is no legal process for a sum that size. Replying to all of it is impossible, and reading it all is draining.
The honest version is that one volunteer is doing the job of a department. Every exchange, every stablecoin issuer and every chain benefits from his work. Yet none of them employ him, and he still funds investigations partly out of his own pocket. After the Lazarus sting, he openly asked for grants and donations to cover the $349,700 he fronted. That request should embarrass an industry worth trillions.
He also seems more active on Telegram than on X these days. I joined his group over a year ago, and the real-time updates land there first. If you want to actually follow his work rather than catch the headlines a day later, that is where to be.
My Take
I have been following ZachXBT for as long as he has been posting, and I rate him higher than anyone else in this series. That includes the billionaires. Most of the people we profile built something and got rich. He built nothing you can buy, got sued for it, and kept going.
My respect for him is also personal. A good friend of mine in New Zealand got drained of his Bored Ape and the rest of his wallet a couple of years back. He reached out to Zach, and Zach pointed him in exactly the right direction at the exact moment it mattered. The thieves had swapped into USDT, Tether froze it, and two years of paperwork later my friend got his money back. I told the whole story in Can stolen crypto be recovered, and it only has a happy ending because of a free pointer from a stranger on the internet.
That is the thing about him. He has never charged a victim. He has never sold a course, launched a token or taken a sponsorship that compromised a story. In an industry where almost every big account has a price, his price has stayed at zero for five years. The donations he gets are the closest thing crypto has to a public good being funded voluntarily.
I also think the harshness is earned. Anyone who has run a public inbox in crypto knows what it looks like. Multiply that by the stakes he deals with, and the fact that he still answers anyone at all is remarkable.
Should beginners follow ZachXBT?
Yes, and for a different reason than most accounts on this site. You do not follow him for trades. You follow him to learn what getting robbed looks like before it happens to you.
His threads are the best free education on crypto security that exists. Read a few and you will recognize the support impersonation call, the fake airdrop link, the “recovery expert” who slides into your replies after a loss. Every one of those scams gets dissected in public, with the wallets attached.
Follow him for the hack alerts too. When an exchange or protocol gets hit, he usually confirms it before the official statement. That hour of warning can be the difference between withdrawing and watching.
One caution. He is not a help desk. If you lose a small amount, read his past threads on what to do, file your report, contact the issuer if a stablecoin is involved, and do not expect a reply. He has said as much himself.
Keep This Content Free
Profiles like this take real digging, and ZachXBT’s five years of threads are a lot of reading. If you want to support the site, use our referral links on OKX or Bybit. It costs you nothing extra and keeps this series going. And if you have a few dollars left over, Zach’s donation address is pinned on his X profile. He has earned it more than we have.
Final Words
ZachXBT is the closest thing crypto has to a conscience. He attributed the biggest hack in history within hours, went undercover against North Korea’s launderers with his own money, and still answers hacked strangers for free. The industry runs on his work and has mostly forgotten to pay for it.
He also opens a new chapter of our series. The OG run ended with CZ, the most powerful founder in the business. This run starts with the one person that founder, and every other founder, hopes never has a reason to post about them.
FAQ
Who is ZachXBT?
ZachXBT is a pseudonymous on-chain investigator who tracks stolen crypto, exposes scams and attributes hacks. He has posted investigations on X since 2021 and runs the Investigations channel on Telegram.
What is ZachXBT’s real name?
Unknown. He has stayed anonymous throughout his career, even after being doxxed during the 2023 Machi Big Brother lawsuit, because his work targets organized criminals and state-backed hackers.
How much crypto has ZachXBT helped recover?
Estimates from people who work with him put it around $350 million as of 2025, through freezes by exchanges and stablecoin issuers and through evidence handed to law enforcement.
Did ZachXBT identify the Bybit hackers?
Yes. He submitted evidence linking the $1.5 billion February 2025 Bybit hack to North Korea’s Lazarus Group within hours. The FBI later confirmed the attribution.
Does ZachXBT charge victims for help?
No. He has never charged victims and funds his work through community donations and grants. Anyone offering paid crypto recovery in his name is a scammer.
Can I contact ZachXBT if I got hacked?
You can try, but he receives far more requests than he can answer. Start with his past threads on what to do after a theft, file a police report, and contact the stablecoin issuer if the thief swapped into USDT or USDC.
