Crypto Sleuth ZachXBT Claws Back $7M from $330M Bitcoin Phishing Scam—Wall Street Still Can’t Spot a Scam This Big

In a stunning countermove, blockchain investigator ZachXBT has intercepted $7 million tied to last month’s massive $330 million BTC phishing attack. The recovery—a rare win against crypto crime—highlights both the Wild West nature of digital assets and the embarrassing incompetence of traditional finance’s ’fraud detection’ systems.

How it went down: The attacker used a classic wallet-drainer scheme, luring victims with fake airdrops. ZachXBT traced the funds through a maze of mixers and bridges—while your bank’s anti-fraud team still flags $50 Uber charges.

The takeaway? Crypto’s transparency cuts both ways. Yes, scams happen. But unlike your ’secure’ brokerage account, blockchain leaves a trail even the suits can follow—if they’d bother to look.

BTC phishing funds swapped or kept in new wallets

Heists targeting BTC are relatively rare, as the coin is not held in easily accessible Web3 wallets. However, the phishing team still managed to make their target to expose the wallet. 

Some of the funds are still held in new addresses with smaller holdings, split into small sums of 5 BTC. Over 17 BTC were sent to a KuCoin hot wallet, with the potential to intercept the funds. 

The hacker address received multiple transactions from the victim, with the largest one for 2.78K BTC in a single transaction. Investigators have not answered whether the victim sent out the transactions willingly or if the wallet’s keys were compromised. 

The theft of BTC remains unusual, as most confidence scams often resort to using stablecoins. However, the pattern of attacking elderly investors remains valid. Stablecoins can be concealed more easily, using P2P markets like Huione Guarantee.

Following the theft, the price of XMR remained elevated at above $280. Most of the XMR volume concentrated on KuCoin. Nearly 47% of all XMR activity is locked in several pairs on the South Korean exchange. 

One obstacle for the hacker may be the inability to withdraw XMR from the exchange. The coin saw highly elevated volumes as other traders joined. 

KuCoin only shares its reserves of BTC, ETH, and stablecoins, with no data on actual XMR available for withdrawal. While on the exchange, XMR offers no actual privacy. However, KuCoin has not been mentioned as one of the assistants of ZachXBT for intercepting some of the funds. 

The MEXC exchange was also used for some of the swaps. The market operator has not shared its XMR or other available reserves.

Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot