A complaint about frozen bitcoins turned into an exposure: how a scammer gave himself away to ZachXBT
In the world of cryptocurrency security, an incident has occurred that once again proves: criminals are not always smart. Renowned on-chain detective ZachXBT received a message from a user under the nickname AmanKesar11, who complained about the "unfair" freezing of 5.73 BTC (approximately $475,000) on the Changelly platform. However, upon investigation, it turned out that these funds were directly linked to a series of thefts targeting U.S. citizens.
Upon receiving the appeal, ZachXBT, using his blockchain analysis tools, traced the origin of the funds. The results were shocking: the transactions led to illegal sources, specifically thefts through social engineering. The victims were Americans, including retirees, and the funds passed through U.S. exchanges and Bitcoin ATMs.
How the Scammer Exposed Himself
During the investigation, it was revealed that the entire chain of thefts involving AmanKesar11 had brought the attackers over $1 million since the beginning of 2025. The 5.73 BTC themselves had been frozen on Changelly back in March 2025 — which is precisely why the individual sought help, hoping to regain access to the stolen money.
The individual's explanations for the origin of the money constantly changed: sometimes it was a loan, sometimes money sent by a boss, sometimes supposedly the boss's investments in Bitcoin "in 2014 and 2015" through an acquaintance in the U.S. Moreover, in December 2025, he even filed a complaint with the Indian police due to the freeze, attempting to legitimize his actions.
Who the Individual Worked For
In the correspondence, AmanKesar11 sent screenshots of emails, and ZachXBT managed to reconstruct the entire group's structure. The crypto detective suggests that the individual is merely an intermediary through whom money is laundered for a boss under the pseudonym "Mr Parveen." This conclusion was drawn from the "evidence" that the individual himself sent: bank statements turned out to be in someone else's name and at a different address.
This case is a vivid example of how criminals, trying to regain control over stolen funds, inadvertently expose themselves. ZachXBT addressed his followers with a warning: he can be asked for help, and he respects privacy, but it is not worth reaching out to recover stolen funds.
My expert perspective: This incident highlights the importance of on-chain analytics as one of the most effective tools in combating crypto crime. Scammers often underestimate the transparency of the blockchain, and their attempts to "launder" or recover funds only worsen their situation. For the community, this is a reminder: even the most sophisticated schemes can collapse due to one careless complaint.