ZachXBT is an independent forensic investigator, threat intelligence researcher, and transparency advocate. Since 2021 this practice has traced stolen funds, identified the operators behind thefts and scams, coordinated freezes with exchanges, and produced evidence that has held up in civil and criminal cases, all run independently and published in public.
Nearly every published investigation to date was done unpaid, and that record is the credential. As the practice takes on select engagements, the rule holds: no client, donor, or fund buys a conclusion or decides what gets published.
Findings are published openly with the supporting evidence (transaction hashes, addresses, timelines) so anyone can verify the work.
The measure of success is funds frozen or returned and evidence that holds up in court, not engagement. Recovery work is done free of charge for victims.
Attribution is published only when the onchain and offchain record supports it.
The same discipline whether a case is public-interest or a paid engagement. For published work, every step is documented publicly so it can be checked.
Cases originate from victim reports, community tips, and anomalies spotted in public data. Tips are accepted anonymously and no submission metadata is collected.
Stolen funds are followed hop by hop across chains, bridges, mixers, and exchange deposits, using public blockchain data and industry-standard tracing practice.
Onchain flows are corroborated with OSINT and offchain evidence (infrastructure, social accounts, payment records) until the operators behind an incident can be identified with confidence.
Exchanges and issuers are notified to freeze assets, victims are supported through recovery, and the evidence is packaged for civil and criminal legal cases.
Investigations are published when the evidence is strong enough to stand on its own. Where publication could jeopardize an active freeze or a pending legal action, findings are shared privately with the relevant parties first.
Victims named in casework are anonymized unless they have spoken publicly. Personal information beyond what is needed to establish attribution is left out.
Roles held alongside the casework, listed for transparency.
The practice takes on a limited number of paid engagements: incident response, fund tracing, threat intelligence, expert reports, and advisory. For active incidents or information about a case, the fastest channel is a direct message on X or the tip form.
