Skip to main content
AVOID.NET

ZachXBT

avoid.net/zachxbt→82/100·87% conf.
[✓ FACT-CHECKED]· reviewed once · last review 6 May 2026

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·2myRa4…pNEo

Summary

ZachXBT (legal name Zachary Wolk, revealed through 2023 court filings) is a pseudonymous American blockchain investigator and OSINT researcher who has operated since 2021, publishing forensic investigations into cryptocurrency fraud, scams, and large-scale thefts. He is widely regarded as one of the most consequential independent crypto investigators, credited with helping recover over $350 million in stolen assets and contributing evidence that has led to multiple arrests across several countries. He maintains strict anonymity and has no formal law enforcement affiliation, though he joined Paradigm as an incident response advisor in February 2025.

Connected Entities

19 entities · 60 linked investigations
Individuals
○Zachary Wolk○Taylor Monahan○Nick Bax
Organizations
□Bybit80□Five I's□Kraken65□Patrick Yarmoch (FBI Agent — Crypto Theft)□Ethereum□Veer Chetal□John Daghita (aka Lick) — US Marshals Crypto Theft□MetaMask□Binance□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□Changpeng Zhao□Dean Daghita / CMDSS (Command Services and Support)□ZachXBT□Malone Lam
Protocols
⌂Cream Finance
Tokens
♦Bitcoin
Relationships
  • Zachary Wolk→member of→ZachXBT(90%)
  • Nick Bax→member of→ZachXBT(80%)
  • Taylor Monahan→member of→ZachXBT(80%)
  • Five I's→associated with→ZachXBT(75%)
  • Nick Bax→controls→Five I's(80%)
  • John Daghita (aka Lick) — US Marshals Crypto Theft→mentioned with→Ethereum(65%)
  • John Daghita (aka Lick) — US Marshals Crypto Theft→mentioned with→ZachXBT(70%)
  • Ethereum→mentioned with→Bitcoin(60%)
  • Cream Finance→mentioned with→ZachXBT(70%)
  • Cream Finance→mentioned with→Ethereum(70%)
  • + 44 more
Have evidence about ZachXBT?

Timeline(17 events)

2017

ZachXBT enters the crypto space during the ICO boom and begins losing money to fraudulent projects, which later motivates his investigative work.

ZachXBT - Wikipedia

2018

ZachXBT suffers a wallet hack losing approximately $15,000, which he has cited as a turning point toward self-taught blockchain analysis.

Who is ZachXBT? - BeInCrypto

2021

ZachXBT begins publishing investigative threads on X (Twitter), establishing his presence as a pseudonymous blockchain investigator.

ZachXBT - Wikipedia

2021

ZachXBT tracks a five-person phishing ring targeting BAYC NFT holders; all five are later arrested and convicted by French authorities.

ZachXBT - Wikipedia

June 2022

ZachXBT publishes investigation alleging Jeffrey 'Machi Big Brother' Huang embezzled 22,000 ETH (~$37.8 million) from Formosa Financial.

Crypto Detective ZachXBT Faces Defamation Lawsuit - CoinDesk

15 June 2023

Jeffrey Huang files federal defamation lawsuit (Huang v. Wolk, 1:23-cv-00683) in U.S. District Court for the Western District of Texas; court filings reveal ZachXBT's legal name Zachary Wolk.

Crypto Sleuth ZachXBT Sued, Doxxed by Former Target - Decrypt

16 June 2023

ZachXBT launches legal defense fund; raises over $1.1 million in cryptocurrency within days from approximately 18,000 Ethereum transactions.

Crypto sleuth ZachXBT raises $1.1 million for legal defense - Blockworks

14 August 2023

Jeffrey Huang voluntarily withdraws defamation lawsuit. ZachXBT amends his investigative article, removing embezzlement allegations and other sharp characterizations. ZachXBT pledges to return unused defense funds.

ZachXBT, Machi Big Brother defamation suit has been dropped - Blockworks

19 August 2024

ZachXBT detects an unusually large Bitcoin transaction while preparing to board a flight, triggering his investigation into the $243 million Genesis creditor theft.

ZachXBT - Wikipedia

19 August 2024

Wired Magazine describes ZachXBT as 'the most prolific independent crypto-focused detective in the world.'

ZachXBT - Wikipedia

18 September 2024

Malone Lam and Jeandiel Serrano are arrested in Miami and Los Angeles respectively in connection with the $243 million Genesis creditor theft, following ZachXBT's investigation.

Police Arrest Two People Related to $243M Crypto Heist - CoinDesk

21 February 2025

Bybit exchange suffers approximately $1.46 billion hack. ZachXBT submits forensic evidence attributing the attack to North Korea's Lazarus Group within hours, sharing findings with Arkham Intelligence.

Bybit Loses $1.5B in Hack but Can Cover Loss - CoinDesk

27 February 2025

FBI confirms North Korea's Lazarus Group was responsible for the Bybit hack, corroborating ZachXBT's attribution.

IC3 Public Service Announcement - North Korea Responsible for Bybit Hack

26 February 2025

ZachXBT announces he has joined Paradigm as an incident response advisor; Paradigm co-founder Matt Huang states ZachXBT helped recover over $350 million for victims.

Onchain sleuth ZachXBT joins Paradigm as incident response advisor - The Block

March 2025

Veer Chetal (third Genesis creditor theft suspect) is arrested.

ZachXBT - Wikipedia

23 January 2026

ZachXBT publishes investigation alleging John Daghita ('Lick'), son of a USMS cryptocurrency contractor, stole approximately $46 million in seized crypto from U.S. government wallets.

U.S. marshals investigate claim of $40 million crypto theft - CoinDesk

5 March 2026

John Daghita is arrested on the island of Saint Martin in a joint FBI and French Gendarmerie operation. FBI Director Kash Patel publicly announces the arrest and credits ZachXBT's investigation.

Son of contractor managing seized crypto for U.S. Marshals arrested in France - CoinDesk
Provenance & Audit Trail

Decision Log

  • #4reviewRecorded on Solana ✓10/16/2026, 11:58:03 AM
    slot 457629152 · hash 8sqnogAB2CCS8nDENpcThbT9n9yscDpXq3RwCKdnFnyH
  • #3publishRecorded on Solana ✓5/30/2026, 1:02:38 PM
    slot 423161593 · hash DwEk9gDtQFLW9LHVbbHhSgCkdXrYZiz8bPW2k1Ygx6Kn
  • #2review approveRecorded on Solana ✓5/6/2026, 2:50:08 AM
    slot 417878572 · hash 6mLoXuQZF5wV34iUzyotYpiUYM28VPBFtnJNDKmrV2Cn
  • #1reviewRecorded on Solana ✓5/6/2026, 2:50:08 AM
    slot 417878567 · hash DKeVtKtKAizPSwGjpESXzBzRh8qcknQBjkk6rBS7gHCU

This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 22 of 23 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-10-1620 claims checked7 corrections pending0 applied⛓ anchoredSee findings →

model: claude-sonnet-4-6

generated: 4/20/2026, 2:36:25 AM

last updated: 4/20/2026, 2:36:25 AM

11 views

avoid.net — verified advice for a post-truth world