On Aug 19, 2025 a victim fell for a social engineering scam and lost 783 BTC ($91M) after exchange and hardware wallet customer support were impersonated.
The stolen funds began to peel off and deposits to Wasabi were made by the threat actor.
Coincidentally this theft… pic.twitter.com/gglShNo2UC
— ZachXBT (@zachxbt) August 21, 2025
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Memecoins promoted by political figures like Donald Trump, lax regulations, and crypto court cases abandoned by US regulators have kicked off a crypto “crime supercycle,” say a pair of blockchain crime investigators.
Blockchain investigator ZachXBT posted to X on Thursday that crypto has historically been ripe for abuse, but that has “noticeably increased since politicians launched memecoins and numerous court cases were dropped, further enabling the behavior.”
He claimed crypto influencers and key thought leaders face “zero repercussions” for scamming their followers.
“That said, there’s never been a worse time to be doing black hat, phishing, social engineering, robberies, vs. gray hat activity when the current environment is favorable,” ZachXBT added.
Source: ZachXBT
A lack of regulation, clamping down on projects that didn’t disclose paid ads and other similar behavior have also contributed to the so-called supercycle, according to ZachXBT.
“If they had spent time regulating it instead of going after open source developers or blue chip decentralized protocols, it’s only prevalent because there’s never really been repercussions,” he said.
Over $2 billion was lost to crypto hacks in the first quarter of 2025, with phishing scams making up $96 million, and rug pulls accounting for over $300 million, cybersecurity firm Hacken said in its April report, shared with Cointelegraph.
Blockchain sleuth Taylor Monahan also chimed in, saying scammers operating in the space are unlikely to change while they are still being rewarded through large profits.
“No social, financial, or legal downsides or friction around this type of behavior. Second is that is simply so easy and there’s so much instant [money] on the table for doing so,” Monahan said.
Source: Tay
Monahan thinks the crypto space is in a “rough spot” because it’s retaining too many hackers and scammers.
“Most have gone basically all-in over the last two cycles e.g., romance scams, [North Korea], malware as a service. Ransomware would be the biggest losers if crypto ceased to exist tomorrow,” Monahan said.
Related: North Korea targets crypto workers with new info-stealing malware
There are scammers in the crypto space facing the law for their crimes. In a Wednesday notice, officials with the US Department of Justice announced the seizure by the Secret Service of more than $225 million linked to crypto investment scams.
In May, a New Zealand man was arrested in connection with a global crypto fraud operation that allegedly stole 450 million New Zealand dollars ($265 million).
Magazine: Influencers shilling memecoin scams face severe legal consequences
Crypto investigator ZachXBT has put out a community warning, showing shocking connections between the $30M Zkasino exit scam and a more recent project, WhiteRock Finance (WHITE).
ZachXBT’s investigation on Zkasino Exit Scam, Source: X
Zkasino is a crypto project related to gambling that took more than $33 million in investments during a presale. However, instead of providing what they guaranteed on its roadmap, the Zkasino team is said to have utilized the funds for themselves.
In April 2024, Elham Nourzai, also known as Derivatives_Ape, was arrested by Dutch authorities (FIOD). Some of the stolen funds from the Zkasino scam were also seized during the arrest. Later in 2024, after Elham was released, the stolen money began moving again. The funds were laundered through multiple blockchains, like zkSync, Starknet, Solana, and EVM-based networks.
The money laundering methods involved cashing out via OTC brokers, exchanging into the privacy coin Monero (XMR) instantaneously through exchanges, and trading perpetual contracts using platforms such as Hyperliquid.
At same time, there was a new cryptocurrency project named WhiteRock Finance, which popped up and raised alarm immediately. The group that created it remained anonymous and did not have any known background in the cryptocurrency community. They were also accused of making fake partnerships to appear more legitimate.
Many of their wallets were funded using quick exchanges. Furthermore, they made great claims of having a large user base and support through USDX, but provided little data or transparency to back this up.
ZachXBT followed marketing wallet transactions from WhiteRock that mixed with Zkasino’s stolen funds. One influencer even verified being directly paid by a wallet belonging to both projects. These revelations indicate that at least one Zkasino insider can now be implicated in WhiteRock. Zach calls for the crypto community to be on high alert and not engage with the project.
Also Read: ZachXBT Calls on BitoPro to Explain $11.5M Hot Wallet Breach
Shaurya is the Co-Leader of the CoinDesk tokens and data team in Asia with a focus on crypto derivatives, DeFi, market microstructure, and protocol analysis.
Shaurya holds over $1,000 in BTC, ETH, SOL, AVAX, SUSHI, CRV, NEAR, YFI, YFII, SHIB, DOGE, USDT, USDC, BNB, MANA, MLN, LINK, XMR, ALGO, VET, CAKE, AAVE, COMP, ROOK, TRX, SNX, RUNE, FTM, ZIL, KSM, ENJ, CKB, JOE, GHST, PERP, BTRFLY, OHM, BANANA, ROME, BURGER, SPIRIT, and ORCA.
He provides over $1,000 to liquidity pools on Compound, Curve, SushiSwap, PancakeSwap, BurgerSwap, Orca, AnySwap, SpiritSwap, Rook Protocol, Yearn Finance, Synthetix, Harvest, Redacted Cartel, OlympusDAO, Rome, Trader Joe, and SUN.
Crypto sleuth ZachXBT has called for stricter penalties against SIM swapping and social engineering fraudsters.
He highlighted the case of a Canadian teenager who allegedly carried out a $37 million cryptocurrency theft. ZachXBT’s comments followed an X user’s suggestion that “wallet draining should be the death penalty.”
The post received a reply from the crypto sleuth on the gaps in current legal frameworks, especially regarding juvenile offenders.
The investigator specifically referenced Cameron Redman, who allegedly conducted a massive SIM swap attack in 2020 at age 17.
The hacker targeted a victim for approximately 60,000 Bitcoin Cash (BCH) and 1,547 Bitcoin (BTC) worth $37 million at the time.
Cameron Redman helped SIM swap $37M in 2020 when he was 17 from Canada
Not a single mention of his full name or photo on the internet until I posted it after he got involved with phishing / X ATOs
Zero reason his name should’ve been protected or hidden https://t.co/F5uoQsD4rK
— ZachXBT (@zachxbt) June 1, 2025
According to ZachXBT’s research, the February 22, 2020 attack against victim Josh Jones involved complicated money laundering techniques. The stolen Bitcoin Cash was moved through hundreds of small transactions to centralized exchanges. However, most Bitcoin was funneled through mixing services, including Chip Mixer and Crypto Mixer.
ZachXBT criticized the legal protections afforded to minors in high-value cybercrime cases. He noted that “laws in Canada and EU are super relaxed, so threat actors can get away with a lot.”
The sleuth expressed particular frustration with name suppression policies for juvenile offenders and stated he publishes full names “regardless of age” when investigating crypto crimes.
Hamilton Police in Ontario formally charged Redman in November 2021 following collaboration with the FBI and U.S. Secret Service. Authorities recovered $5.4 million of cryptocurrency during the investigation, though $31.5 million remains unaccounted for.
The case resurfaced when ZachXBT identified Redman’s alleged involvement in recent phishing attacks and X account takeovers targeting NFT projects. Given the scale of the financial crimes, the investigator noted there was “zero reason his name should’ve been protected or hidden.”
Crypto sleuth ZachXBT revealed that the hacker accused of stealing Coinbase customer data left him a taunting message on-chain after swapping $42.5 million worth of BTC for ETH on THORChain.
In a broadcast message sent to his Investigations Telegram channel, on-chain investigator ZachXBT claimed to have received a message sent from a hacker accused of swindling more than $300 million worth of crypto assets from users. The message was sent to his on-chain Ethereum (ETH) account.
“The threat actor who stole $300M+ from Coinbase users by paying customer support just began trolling me on-chain with this message,” said ZachXBT in his Telegram message.
The message was sent from an address simply named Fake_Phishing1158790 and contained the words “L bozo” and what appeared to be a link to a YouTube video showing the viral internet short clip of former NBA athlete James Worthy smoking a cigar after a Lakers win.
“Smoking that ZachXBT pack,” one user commented under the YouTube video, indicating they were led to the video after seeing the on-chain message addressed to the crypto sleuth.
The message was linked to the alleged hacker’s recent on-chain transaction, which consisted of swapping $42.5 million worth of BTC (BTC) for ETH via THORChain.
The Coinbase user data exploit was first disclosed by the exchange on May 15. The hacker was believed to have bribed customer support staff to steal sensitive user data.
According to Coinbase, the attacker was able to get ahold of phone names, addresses, phone numbers, government-issued IDs, and other account data. The exchange claimed that the exploit only affected less than 1% of users.
After firing the customer service workers involved, the company estimated the breach could cost up to $400 million to resolve. The attackers had asked for a $20 million ransom from the crypto exchange. Coinbase refused to pay the $20 million ransom and is offering a bounty for anyone who can track down the attacker.
The hacker behind the data breach targeting Coinbase users mocked blockchain investigator ZachXBT with an onchain message following a major crypto swap.
On May 21, the hacker used Ethereum transaction input data to write “L bozo,” followed by a meme video of NBA player James Worthy smoking a cigar.
The message came after the attacker swapped about $42.5 million from Bitcoin (BTC) to Ether (ETH) via THORChain.
ZachXBT flagged the message on his Telegram channel, linking it to the same entity responsible for the Coinbase data breach affecting at least 69,400 users.
Coinbase hacker trolling ZachXBT. Source: ZachXBT.
On May 22, blockchain security firm PeckShield reported that the hacker had continued to move funds, swapping 8,697 ETH for 22 million Dai (DAI). A separate but closely linked address, which received 9,081 ETH via THORChain, also converted the assets into 23 million DAI.
Related: DOJ is investigating Coinbase data breach— Report
The Coinbase breach, first reported in a filing with the Maine Attorney General’s office, occurred in December 2024 and was discovered on May 11. The stolen data includes names, home addresses and other personal information.
Following the disclosure, the attackers demanded a $20 million ransom in Bitcoin to prevent the release of the stolen data. Coinbase refused and instead offered a $20 million bounty for information leading to the identification of the hackers.
The company estimates a potential financial impact between $180 million and $400 million due to remediation costs and customer compensation.
Coinbase has also faced a wave of lawsuits following the revelation. At least six legal complaints were filed on May 15 and 16, with plaintiffs accusing the exchange of failing to implement adequate security measures and mishandling its response to the breach.
Related: Coinbase data leak could put users in physical danger: TechCrunch founder
The Coinbase hacker’s use of THORChain to swap $42.5 million worth of Bitcoin into Ether comes as the protocol faces growing scrutiny over its role in facilitating illicit transactions.
In March, the platform came under fire after its swap volume surged following the $1.4 billion Bybit hack. The protocol generated over $5 million in revenue after processing $5.4 billion in swap volume, with over $1 billion moved in a single day.
Blockchain security firms identified North Korea’s Lazarus Group as the main suspect, using THORChain to launder a significant portion of the stolen funds.
Source: Lookonchain
The controversy intensified when a THORChain developer, known as “Pluto,” resigned after a vote to block transactions linked to Lazarus was overturned.
Magazine: TradFi is building Ethereum L2s to tokenize trillions in RWAs: Inside story