Subscribe to Investigations By ZachXBT
Investigations By ZachXBTHow Lazarus Group laundered $200M from 25+ crypto hacks to fiat from 2020–2023
Table of contents1). Introduction 2). CoinBerry, Unibright, & CoinMetro hacks 3). Nexus Mutual founder hack 4). EasyFi hack 5). Bondly hack 6). Unreported hacks 7). MGNR and PolyPlay hacks 8). bZx hack 9). Steadefi and CoinShift hacks 10). Paxful and Noones accounts 11). Investigation results 12). Other Incidents 13). AcknowledgmentsIntroductionBluenoroff or APT38, more commonly referred to as Lazarus Group is a threat group which has been tied to the North Korean government since as early as...
Investigations By ZachXBTScammers In Paris
Background:Over the past year we’ve seen scammers become more creative with new methods to phish people in Web 3. In this investigation we’ll breakdown how two phishing scammers from France defrauded people out of NFTs worth millions of dollars and the trail of breadcrumbs left behind leaving them exposed.December 2021 — Victim 1On December 13 2021, Twitter user Dilly Dilly was phished for Bored Ape Yacht Club (BAYC) #237 after clicking on a link shared by a verified member of the BAYC Discor...
Investigations By ZachXBTGone phishing for $5m
BackgroundSince late 2021 a scammer known as Elliot / Chinese / Devil has stolen $5m+ worth of crypto and NFTs through phishing scams and a NFT rug pull project.October 2021 — Crazy Lemur ClubOn Oct 10 2021 the NFT collection Crazy Lemur Club (CLC) launched with a total supply of 5,000 NFTs created by the anonymous team “Cat” & “Dog”. CLC advertised utility such as “exclusive metaverse access, arcade games, and a community DAO” but on November 5 2021 CLC made its last Tweet ever with the webs...
>300 subscribers
Investigations By ZachXBTHow Lazarus Group laundered $200M from 25+ crypto hacks to fiat from 2020–2023
Table of contents1). Introduction 2). CoinBerry, Unibright, & CoinMetro hacks 3). Nexus Mutual founder hack 4). EasyFi hack 5). Bondly hack 6). Unreported hacks 7). MGNR and PolyPlay hacks 8). bZx hack 9). Steadefi and CoinShift hacks 10). Paxful and Noones accounts 11). Investigation results 12). Other Incidents 13). AcknowledgmentsIntroductionBluenoroff or APT38, more commonly referred to as Lazarus Group is a threat group which has been tied to the North Korean government since as early as...
Investigations By ZachXBTScammers In Paris
Background:Over the past year we’ve seen scammers become more creative with new methods to phish people in Web 3. In this investigation we’ll breakdown how two phishing scammers from France defrauded people out of NFTs worth millions of dollars and the trail of breadcrumbs left behind leaving them exposed.December 2021 — Victim 1On December 13 2021, Twitter user Dilly Dilly was phished for Bored Ape Yacht Club (BAYC) #237 after clicking on a link shared by a verified member of the BAYC Discor...
Investigations By ZachXBTGone phishing for $5m
BackgroundSince late 2021 a scammer known as Elliot / Chinese / Devil has stolen $5m+ worth of crypto and NFTs through phishing scams and a NFT rug pull project.October 2021 — Crazy Lemur ClubOn Oct 10 2021 the NFT collection Crazy Lemur Club (CLC) launched with a total supply of 5,000 NFTs created by the anonymous team “Cat” & “Dog”. CLC advertised utility such as “exclusive metaverse access, arcade games, and a community DAO” but on November 5 2021 CLC made its last Tweet ever with the webs...
Share Dialog
Share Dialog
Since December 2021 we’ve seen 600+ Discord servers compromised & 12+ NFT related Twitter accounts hacked as well. This has resulted in millions of dollars being stolen.
Welcome to part 2 of tracking down the people responsible.
As a TLDR to those who missed the first part of the investigation, I uncovered that Cam (who previously SIM swapped $37m), sold Twitter panel access to scammers known as HZ & Popbob enabling them to hack 12+ NFT Twitter accounts.
Safe to say horror (HZ/Chase) was not too thrilled with my thread calling him out for the Twitter hacks.
Why would he ask to take them down?
Few remember that prior to the Twitter hacks HZ has been also responsible for the majority of Discord attacks working with Popbob and Two1
Back in April 2022 I mapped out their known wallets with over $3.9m in them at the time.
As of a few weeks ago HZ/Chase began flexing on Twitter an iced out Audemars Piguet watch.
Well where did he buy that watch?
I realized HZ likely paid in crypto due to the nature of how he obtained the funds.
I then asked around a few mutual friends who sell watches. This lead me to a watch seller who recently sold that AP watch for $47.5k USDC.
Inside the Discord server for the seller were two flex pics by the buyer (HZ) with the first made on 08/19/22.
What looks similar? Well the success pics inside the Discord from the buyer were the EXACT same watch and sweater as posted on Twitter by HZ.
I then chatted with the watch seller who was completely unaware of what had transpired. After learning what HZ has done they confirm it’s the same watch and have me look into the address HZ paid with.
0xdc25df861f979a175bfe4f3737d1562d45cdc5cd
Watch payment:
I then map out the flow of funds.
The address HZ used to pay the watch seller $47.5k was DIRECTLY funded by multiple addresses used to scam people with hacked Twitter accounts such as @deekaymotion @Zeneca_33 @ezu_xyz @JRNYclub
(highlighted in yellow below)
Just 1–2 hops away from this address HZ is tied to the @BoredApeYC @nansen_ai @AnataNFT @LACOSTE @TheParallaxHQ @cheebsnft Discord attacks and to @nounsdao @franklinisbored Twitter account hacks.
More attacks aren’t displayed for the sake of space.
On June 28 the JRNY Club Twitter was hacked.
In total HZ received 73.56 ETH ($114k) from the scam to the same address used to pay for the watch.
TXID:0x8879d3f03028954c406484ae818b59511d75c3eaaea8f815fe374db7aa387077
On July 14 DeekayMotion Twitter account was hacked.
In total HZ received 23.11 ETH ($36k) from the scam to the same address used to pay for the watch.
TXID:0x8bc3cdf25a31476f685aee8bd004868f90356a1219e0ae1879b9f353640ed379
On July 19 Zeneca’s Twitter was hacked.
In total HZ received 20.36 ETH ($31.7k) from the scam to the same address used to pay for the watch.
TXID:0x2ae1482e97f56c5e88a54e8457b4a1c6199341eb6deffe0fb4b865e474a5c375
(note HZ is tied to the 333 club Discord attack too)
Some of the Discord attacks like the BAYC Otherside and 333 Club ones HZ is tied to stole $300k+ worth of NFTs with each attack.
Since December 2021 @NFTherder has tracked at least 600 Discord servers that’ve been compromised (thanks for calculating this number).
Here is his latest report for August 2022:
After months and months of tracking their group it’s nice to know one of the main perpetrators (Chase Senecal) for NFT/crypto phishing attacks has been identified. Others in his group like Popbob have yet to be caught
Hopefully at some point victims will take legal action
The majority of the stolen funds haven’t been spent & sit in wallets like:
$1.27m0x9971e3efc26ce470f806c725518e51dee118202e
$730k0x5f7a8e85071e992473a016529b86c6bf0c4e50a4
$828k0xe84d4e6451119f49f24f13caf13fbda331c2245f
Some is spent on OG usernames like @skull @horror
Sources:
Chainabuse report (am advisor):chainabuse.com/report/19be733…
Breadcrumbs report (am investor):breadcrumbs.app/reports/2851
Archive:archive.ph/BSBAW
Hundreds of hours go into reports like this. If you appreciate my research please consider donating to my wallet. All my work is possible because of it.
zachxbt.eth
0x9D727911B54C455B0071A7B682FcF4Bc444B5596
bc1qqsspeghy0wenywvgvrka3krqzd3gdvq38pmf4hka6llget8kjemquk23g6
Since December 2021 we’ve seen 600+ Discord servers compromised & 12+ NFT related Twitter accounts hacked as well. This has resulted in millions of dollars being stolen.
Welcome to part 2 of tracking down the people responsible.
As a TLDR to those who missed the first part of the investigation, I uncovered that Cam (who previously SIM swapped $37m), sold Twitter panel access to scammers known as HZ & Popbob enabling them to hack 12+ NFT Twitter accounts.
Safe to say horror (HZ/Chase) was not too thrilled with my thread calling him out for the Twitter hacks.
Why would he ask to take them down?
Few remember that prior to the Twitter hacks HZ has been also responsible for the majority of Discord attacks working with Popbob and Two1
Back in April 2022 I mapped out their known wallets with over $3.9m in them at the time.
As of a few weeks ago HZ/Chase began flexing on Twitter an iced out Audemars Piguet watch.
Well where did he buy that watch?
I realized HZ likely paid in crypto due to the nature of how he obtained the funds.
I then asked around a few mutual friends who sell watches. This lead me to a watch seller who recently sold that AP watch for $47.5k USDC.
Inside the Discord server for the seller were two flex pics by the buyer (HZ) with the first made on 08/19/22.
What looks similar? Well the success pics inside the Discord from the buyer were the EXACT same watch and sweater as posted on Twitter by HZ.
I then chatted with the watch seller who was completely unaware of what had transpired. After learning what HZ has done they confirm it’s the same watch and have me look into the address HZ paid with.
0xdc25df861f979a175bfe4f3737d1562d45cdc5cd
Watch payment:
I then map out the flow of funds.
The address HZ used to pay the watch seller $47.5k was DIRECTLY funded by multiple addresses used to scam people with hacked Twitter accounts such as @deekaymotion @Zeneca_33 @ezu_xyz @JRNYclub
(highlighted in yellow below)
Just 1–2 hops away from this address HZ is tied to the @BoredApeYC @nansen_ai @AnataNFT @LACOSTE @TheParallaxHQ @cheebsnft Discord attacks and to @nounsdao @franklinisbored Twitter account hacks.
More attacks aren’t displayed for the sake of space.
On June 28 the JRNY Club Twitter was hacked.
In total HZ received 73.56 ETH ($114k) from the scam to the same address used to pay for the watch.
TXID:0x8879d3f03028954c406484ae818b59511d75c3eaaea8f815fe374db7aa387077
On July 14 DeekayMotion Twitter account was hacked.
In total HZ received 23.11 ETH ($36k) from the scam to the same address used to pay for the watch.
TXID:0x8bc3cdf25a31476f685aee8bd004868f90356a1219e0ae1879b9f353640ed379
On July 19 Zeneca’s Twitter was hacked.
In total HZ received 20.36 ETH ($31.7k) from the scam to the same address used to pay for the watch.
TXID:0x2ae1482e97f56c5e88a54e8457b4a1c6199341eb6deffe0fb4b865e474a5c375
(note HZ is tied to the 333 club Discord attack too)
Some of the Discord attacks like the BAYC Otherside and 333 Club ones HZ is tied to stole $300k+ worth of NFTs with each attack.
Since December 2021 @NFTherder has tracked at least 600 Discord servers that’ve been compromised (thanks for calculating this number).
Here is his latest report for August 2022:
After months and months of tracking their group it’s nice to know one of the main perpetrators (Chase Senecal) for NFT/crypto phishing attacks has been identified. Others in his group like Popbob have yet to be caught
Hopefully at some point victims will take legal action
The majority of the stolen funds haven’t been spent & sit in wallets like:
$1.27m0x9971e3efc26ce470f806c725518e51dee118202e
$730k0x5f7a8e85071e992473a016529b86c6bf0c4e50a4
$828k0xe84d4e6451119f49f24f13caf13fbda331c2245f
Some is spent on OG usernames like @skull @horror
Sources:
Chainabuse report (am advisor):chainabuse.com/report/19be733…
Breadcrumbs report (am investor):breadcrumbs.app/reports/2851
Archive:archive.ph/BSBAW
Hundreds of hours go into reports like this. If you appreciate my research please consider donating to my wallet. All my work is possible because of it.
zachxbt.eth
0x9D727911B54C455B0071A7B682FcF4Bc444B5596
bc1qqsspeghy0wenywvgvrka3krqzd3gdvq38pmf4hka6llget8kjemquk23g6
No comments yet