Verify a decision

{"actor":"system:backfill","investigation_id":"6d75a1c3-41d0-47bc-8da7-42d14b10de78","kind":"publish","page_slug":"aman-kesar-india-crypto-scam-ring","published_at":"2026-06-25T12:17:06.953Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Aman Kesar India Crypto Scam Ring","sections":[{"content":"On June 19, 2026, pseudonymous blockchain investigator ZachXBT published findings on X (formerly Twitter) documenting a suspected India-based cryptocurrency fraud ring after being approached by a user identified as Aman Kesar (@Amankesar11). Kesar had messaged ZachXBT seeking assistance recovering 5.73 BTC (approximately $475,000 at time of reporting) that had been frozen by the crypto exchange Changelly since March 2025. ZachXBT described the case as 'a short story about Indian scammers who called the cops on themselves.' Rather than finding evidence supporting Kesar's claim of unjust asset seizure, on-chain compliance analysis traced the Bitcoin inflows to a cluster of wallets linked to over $1 million in confirmed social engineering thefts targeting American victims since 2025. Kesar deleted all public posts and deactivated his X account following the publication of ZachXBT's findings, an action ZachXBT and multiple reporting outlets characterized as indicative of consciousness of guilt.","heading":"Overview and Exposure","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT spots $475K in fraud-related Bitcoin after user calls out frozen Changelly funds","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"},{"credibility":2,"name":"Indian Crypto Scammer Unwittingly Exposes $1M Syndicate to On-Chain Investigator","type":"news_article","url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"}]},{"content":"ZachXBT's on-chain analysis traced inflows to the wallets in question from multiple US-based platforms and services, including Bitcoin Depot, Athena Bitcoin, Coinhub ATM, Cash App, Robinhood, Coinbase, and Strike. The funds are alleged to have originated from social engineering thefts targeting American victims. Investigative reporting indicates the scam tactics included impersonation of US exchange support staff, fake tech support schemes, romance schemes, and investment lures, with stolen funds moved through US Bitcoin ATMs and peer-to-peer payment applications before consolidating toward New Delhi-associated addresses. Multiple victims are described as elderly individuals. Broader context from the FBI and referenced in reporting notes that approximately $7.7 billion in crypto losses in 2025 involved individuals aged 60 and older, and that Americans filed over 181,000 cryptocurrency fraud complaints in 2025 totaling over $11 billion in losses.","heading":"Alleged Fraud Methods and Victim Profile","severity":"critical","sources":[{"credibility":2,"name":"Frozen Bitcoin Wallet Exposes $1M Crypto Scam Network","type":"news_article","url":"https://cryptonews.net/news/security/33037276/"},{"credibility":2,"name":"ZachXBT Exposes Alleged Scam Mule After Self-Reported Frozen $475K Bitcoin Case","type":"news_article","url":"https://nulltx.com/zachxbt-exposes-alleged-scam-mule-after-self-reported-frozen-475k-bitcoin-case/"},{"credibility":2,"name":"ZachXBT spots $475K in fraud-related Bitcoin after user calls out frozen Changelly funds","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"}]},{"content":"Aman Kesar, operating the X account @Amankesar11 (now deactivated), is alleged by ZachXBT to have functioned as a money mule for a principal operator referred to only as 'Mr. Parveen,' believed to be based in New Delhi. During private communications with ZachXBT, Kesar's account of the frozen funds shifted on multiple occasions: he initially described the 5.73 BTC as an unjustly frozen legitimate swap, then characterized them as a loan from his boss, and later claimed his boss had invested in Bitcoin during 2014-2015 through a US-based contact. Bank statements that Kesar provided as proof of legitimate ownership allegedly bore a different name and geographic location than those claimed by Kesar, further undermining his account. ZachXBT concluded that the evidence pointed to Kesar serving as a financial intermediary rather than the beneficial owner of the funds.","heading":"Aman Kesar: Alleged Money Mule Role","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Exposes Indian Bitcoin Crypto Mule Who Complained About Frozen Scam Proceeds","type":"news_article","url":"https://cryip.co/zachxbt-exposes-indian-bitcoin-crypto-mule-frozen-scam-proceeds/"},{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT Exposes $1M Indian Scam Ring","type":"news_article","url":"https://phemex.com/news/article/zachxbt-uncovers-indian-scam-ring-involved-in-over-1-million-theft-90020"}]},{"content":"ZachXBT's investigation identified a Bitcoin address (bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2) and a TRON address (TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm) associated with Kesar's claimed funds. Compliance tooling traced the inflows from these addresses back to a high-confidence cluster linked to social engineering thefts across multiple US platforms. The 5.73 BTC frozen at Changelly in March 2025 represented a subset of the broader cluster, with the full connected wallet network showing over $1 million in alleged theft proceeds since 2025. Outflows from victim-linked deposits were traced through US Bitcoin ATM operators and consumer payment applications before aggregating toward New Delhi-associated wallets.","heading":"On-Chain Evidence and Wallet Cluster","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT (@zachxbt) on X","type":"social_media","url":"https://x.com/zachxbt/status/2067938523986932005"},{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT Says Scammer Asked For Help After Changelly Froze 5.73 BTC","type":"news_article","url":"https://cryptoadventure.com/zachxbt-says-scammer-asked-for-help-after-changelly-froze-5-73-btc/"}]},{"content":"Changelly froze Kesar's 5.73 BTC on or around March 11, 2025, consistent with standard anti-money laundering procedures triggered when illicit fund origins are detected. Kesar subsequently filed a police complaint in India on December 23, 2025 (case number 3207-P/2025) and shared screenshots of email correspondence with Changelly's compliance team contesting the freeze. He also publicly posted complaints about Changelly on X, citing full KYC cooperation as recently as June 15, 2026, days before ZachXBT's exposure. Changelly had not publicly commented on the case as of the date of reporting. The frozen funds remained under Changelly's custody as of the time of ZachXBT's June 19, 2026 publication.","heading":"Changelly Asset Freeze and AML Action","severity":"high","sources":[{"credibility":2,"name":"ZachXBT spots $475K in fraud-related Bitcoin after user calls out frozen Changelly funds","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"},{"credibility":2,"name":"Indian Crypto Scammer Unwittingly Exposes $1M Syndicate to On-Chain Investigator","type":"news_article","url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"}]},{"content":"ZachXBT identified an individual referred to as 'Mr. Parveen' as the suspected principal operator or coordinator behind the fraud ring, believed to be based in New Delhi, India. The specific evidence linking Parveen to the ring was not fully disclosed in ZachXBT's public reporting, and no formal charges, regulatory actions, or court filings against 'Mr. Parveen' were identified in available sources as of June 2026. The identification of Parveen as operator is based on Kesar's own communications and private documents shared with ZachXBT, placing this claim at medium confidence pending independent law enforcement corroboration.","heading":"Suspected Principal Operator: Mr. Parveen","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Exposes Indian Bitcoin Crypto Mule Who Complained About Frozen Scam Proceeds","type":"news_article","url":"https://cryip.co/zachxbt-exposes-indian-bitcoin-crypto-mule-frozen-scam-proceeds/"},{"credibility":2,"name":"Frozen Bitcoin Wallet Exposes $1M Crypto Scam Network","type":"news_article","url":"https://cryptonews.net/news/security/33037276/"}]},{"content":"As of the date of reporting, no confirmed US law enforcement charges, FBI referrals, DOJ filings, or SEC/CFTC regulatory actions have been publicly identified in connection with Aman Kesar, Mr. Parveen, or the broader wallet cluster. Kesar filed a police report in India (case #3207-P/2025) in December 2025, but this was initiated by Kesar himself in an effort to recover frozen funds rather than as a result of victim complaints. Reporting notes that Indian authorities have faced challenges distinguishing legitimate platforms from fraudulent actors in crypto-related cases, citing the mistaken arrest of CoinDCX co-founders as an example of jurisdictional investigative difficulty. No confirmation of Indian law enforcement action targeting Kesar or Parveen had emerged in available sources as of June 2026.","heading":"Law Enforcement Status","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Exposes Alleged Scam Mule After Self-Reported Frozen $475K Bitcoin Case","type":"news_article","url":"https://nulltx.com/zachxbt-exposes-alleged-scam-mule-after-self-reported-frozen-475k-bitcoin-case/"},{"credibility":2,"name":"ZachXBT Exposes $1M Indian Scam Ring","type":"news_article","url":"https://phemex.com/news/article/zachxbt-uncovers-indian-scam-ring-involved-in-over-1-million-theft-90020"}]},{"content":"Following the publication of ZachXBT's investigation on June 19, 2026, Aman Kesar deleted all public posts on X and deactivated his @Amankesar11 account. Multiple reporting outlets characterized this behavior as indicative of consciousness of guilt. Prior to deletion, Kesar had maintained an active public presence on X, having posted complaints about Changelly's freeze as recently as June 15, 2026. No public statement, denial, or rebuttal from Kesar was recorded before account deletion. The pattern of account deletion and post removal following public exposure is consistent with documented behavior by other individuals implicated in ZachXBT investigations.","heading":"Account Deletion and Evasion Behavior","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT spots $475K in fraud-related Bitcoin after user calls out frozen Changelly funds","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT spots $475K in fraud-related Bitcoin after user calls out frozen Changelly funds","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"},{"credibility":2,"name":"Frozen Bitcoin Wallet Exposes $1M Crypto Scam Network","type":"news_article","url":"https://cryptonews.net/news/security/33037276/"},{"credibility":2,"name":"Indian Crypto Scammer Unwittingly Exposes $1M Syndicate to On-Chain Investigator","type":"news_article","url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"},{"credibility":2,"name":"ZachXBT Exposes Alleged Scam Mule After Self-Reported Frozen $475K Bitcoin Case","type":"news_article","url":"https://nulltx.com/zachxbt-exposes-alleged-scam-mule-after-self-reported-frozen-475k-bitcoin-case/"},{"credibility":2,"name":"ZachXBT Exposes $1M Indian Scam Ring","type":"news_article","url":"https://phemex.com/news/article/zachxbt-uncovers-indian-scam-ring-involved-in-over-1-million-theft-90020"},{"credibility":2,"name":"ZachXBT Exposes Indian Bitcoin Crypto Mule Who Complained About Frozen Scam Proceeds","type":"news_article","url":"https://cryip.co/zachxbt-exposes-indian-bitcoin-crypto-mule-frozen-scam-proceeds/"},{"credibility":2,"name":"ZachXBT Says Scammer Asked For Help After Changelly Froze 5.73 BTC","type":"news_article","url":"https://cryptoadventure.com/zachxbt-says-scammer-asked-for-help-after-changelly-froze-5-73-btc/"},{"credibility":2,"name":"Suspected Indian scammer turns scrutiny on himself after ZachXBT engagement","type":"news_article","url":"https://www.mexc.com/news/1159617"},{"credibility":2,"name":"ZachXBT (@zachxbt) on X — original investigation post","type":"social_media","url":"https://x.com/zachxbt/status/2067938523986932005"}],"summary":"A New Delhi-based cryptocurrency fraud ring, identified through on-chain analysis by blockchain investigator ZachXBT in June 2026, is alleged to have stolen over $1 million from American victims since 2025, primarily targeting elderly individuals via social engineering. The ring was exposed when a suspected money mule, Aman Kesar (X: @Amankesar11), contacted ZachXBT seeking help unfreezing 5.73 BTC (~$475,000) held by Changelly under anti-money laundering review. On-chain tracing linked the frozen funds to a cluster of confirmed social engineering thefts; Kesar subsequently deleted his X account and all public posts following the exposure.","timeline":[{"date":"2025-03-11","event":"Changelly freezes 5.73 BTC (~$475,000) belonging to Aman Kesar's account under AML review during an attempted BTC-to-USDT swap.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"},{"date":"2025-12-23","event":"Aman Kesar files a police complaint in India (case #3207-P/2025) attempting to recover the frozen Bitcoin from Changelly, inadvertently creating a law enforcement record.","source":"Castle Crypto","source_url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"},{"date":"2025-12-31","event":"Kesar posts first public complaint on X about the Changelly freeze, claiming funds were unjustly seized.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"},{"date":"2026-06-15","event":"Kesar posts on X claiming full KYC cooperation with Changelly compliance team, days before ZachXBT's exposure.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-spots-fraud-bitcoin-changelly-funds/"},{"date":"2026-06-19","event":"ZachXBT publishes on-chain investigation linking Kesar's frozen 5.73 BTC to a wallet cluster with over $1 million in alleged social engineering thefts from elderly American victims. Kesar is identified as an alleged money mule for operator 'Mr. Parveen' based in New Delhi.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"date":"2026-06-19","event":"Aman Kesar deletes all public posts and deactivates his X account (@Amankesar11) following ZachXBT's publication.","source":"Crypto Times","source_url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"}]},"v":1}