Investigations by ZachXBT

Community Alert: Near Intents was exploited for $3.8M+ after its BSC hot wallet saw multiple irregular outflows a few hours ago. Near Intents hot wallet 0x233c has since stopped processing transactions and the site status shows an ongoing incident impacting multiple EVM chains. The funds were immediately transferred to Kucoin and bridged to Bitcoin. BSC theft address 0x09fd1f5d9f185067a92493e43aa259ea4ab3ad37

The alleged DPRK attackers have just begun shielding ~2.7K ZEC ($3.8M) total from the Bitget exploit into the Ironwood pool. ~18.9K ZEC ($28.3M) total was stolen from the Bitget hot wallet on September 24, 2026. One of the arguments used by competing privacy projects was threat actors do not use ZEC thus XYZ is better. IronWood deposit transactions 9bf8d13474eff83ee9fcb214a3df7e1d1acbb745a0f820c837c08eb35e1e4e1a 61d2cb335127636f2854e587dd41fecf2ec31c9c1e9e5e5b543c3a416048b258 64e5a66cce034745dfe1447b4779ce37b910d99365d0583cef65eb0504b573a2 Theft source address t1WgMdtND8NF7NDUuYmq8MpMj1NTC…

Community alert: Revolut appears to have exposed personally identifiable information (PII) for a subset of users due to failing to detect a fraudulent government request. Exposed data included: -Copy of passport and/or driver's licence, plus the verification selfie -Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin -Full name, date of birth, occupation -Home address, email, phone number While the incident is likely limited in size it seems to have been targeted at high net worth users. An email alerting users was sent out to multiple Revolut users …

Community Alert: Multiple verified WooX users have reported withdrawals stuck in pending or processing over the past three days. WooX was incubated by Kronos Research, and in Q4 2025 it was acquired by FusionX Digital, a firm which allegedly has ties to BitMart founder Sheldon Xia. On July 26, 2026, BitMart announced it would cease operations and restructure. Its users have been left without access to millions in stuck funds, with complaints increasing on X. Sheldon Xia has published only vague statements claiming user assets are safe, and those claims still have not been independently verif…

Community Alert: I've reviewed evidence that two US based investment platforms: BitcoinIRA & iTrustCapital allegedly had data breaches this year but appear to have not disclosed the incidents publicly. Leaked info: Personal details, Portfolio holdings, Banking details, Custodian details, Verification status, etc Example: Threat actor ‘Tiffany’ targeted a BitcoinIRA user and stole $1.2M+ using the db in June 2026. I reached out to both companies for comment on August 21 but have not heard back yet.