Skip to main content
Sign in

Vkevin

avoid.net/vkevin→2/100·100% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:doxxed][src:powershell][src:mee6_spoof][src:2025_telegram][src:safeguard_spoof][src:discord_phishing][src:zachxbt][src:zachxbt_investigation][src:fake_bot][src:rat_malware][src:new_york][src:nft_theft][src:2022_discord][src:telegram_phishing]
anchored·442aXR…DVCL

Summary

Vkevin is a pseudonymous threat actor known for operating fake Safeguard Telegram bot phishing campaigns that have allegedly drained seven figures from victims' cryptocurrency wallets. On January 23, 2025, blockchain investigator ZachXBT published a 31-minute video exposing Vkevin in the act of running these scams from what was described as a New York school, and confirmed the individual had been doxxed. Vkevin is additionally alleged to have conducted a 2022 Discord attack against DigikongNFT using a spoofed MEE6 bot, resulting in over $300,000 in NFT losses.

Connected Entities

1 entities
Organizations
□Vkevin
Relationships
    Have evidence about Vkevin?

    Timeline(3 events)

    2022-08-14

    Vkevin allegedly attacks DigikongNFT's Discord server using a fake MEE6 bot webhook, exfiltrating Discord authentication tokens via a bookmarklet phishing site at mee6.ca/verify. NFT holders lose over $300,000.

    2025-01-23

    ZachXBT publishes a 31-minute video on X secretly recording Vkevin running fake Safeguard Telegram bot phishing operations across multiple Telegram channels, with seven figures in victim losses alleged. ZachXBT confirms Vkevin has been doxxed.

    2025-01-23

    Multiple crypto media outlets including Cryptopolitan, CryptoNews.net, and blockchain.news report on ZachXBT's exposure of Vkevin. Leviathan News characterizes losses as 'draining millions via Telegram.'

    Provenance & Audit Trail
    Anchored on SolanaVerify on-chainsrc:doxxedsrc:powershellsrc:mee6_spoofsrc:2025_telegramsrc:safeguard_spoofsrc:discord_phishingsrc:zachxbtsrc:zachxbt_investigationsrc:fake_botsrc:rat_malwaresrc:new_yorksrc:nft_theftsrc:2022_discordsrc:telegram_phishing

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.

    full audit log →version history →

    model: claude-sonnet

    generated: 5/4/2026, 4:05:02 PM

    last updated: 5/26/2026, 4:11:16 AM

    avoid.net — verified advice for a post-truth world