A scammer accidentally revealed himself by asking ZachXBT for help with frozen bitcoins.
In the world of cryptocurrency security, a curious incident has occurred that once again confirms: even the most sophisticated criminals can make fatal mistakes. A user under the nickname AmanKesar11, faced with the freezing of 5.73 BTC (about $475,000) on the Changelly platform, decided to seek help from the well-known on-chain detective ZachXBT, complaining about "injustice." However, instead of sympathy, he received a complete exposure.
How the "victim" became a suspect
ZachXBT, upon receiving the message, conducted his own investigation and found that the origin of these funds was far from harmless. Transaction analysis showed that the bitcoins were stolen as a result of a series of social engineering attacks targeting US citizens, including retirees. The scheme involved the use of American exchanges and Bitcoin ATMs. The total damage from this criminal activity, according to ZachXBT's estimates, exceeded $1 million since the beginning of 2025.
The 5.73 BTC themselves were frozen on Changelly back in March 2025. This is precisely what prompted the individual to seek help. His explanations for the origin of the funds constantly changed: from a loan to money sent by a boss, and even allegedly the boss's investment in Bitcoin in 2014-2015. Most strikingly, in December 2025, AmanKesar11 even filed a complaint with the Indian police over the freeze, trying to portray himself as a victim.
Who is behind the scheme?
During the correspondence, AmanKesar11 sent ZachXBT screenshots of emails that allowed the structure of the entire group to be reconstructed. The detective concluded that AmanKesar11 is not the main perpetrator, but merely an intermediary through whom funds are laundered for a boss hiding under the pseudonym "Mr Parveen." This conclusion was also reached based on the "evidence" provided by the individual himself: bank statements turned out to be issued in someone else's name and at a different address.
This case is a stark reminder that cryptocurrency is not anonymous, and the blockchain records every transaction. Turning to on-chain detectives with a request to "unfreeze" stolen funds is not just foolishness, but a direct path to exposing the entire criminal scheme. My comment as an analyst: This incident underscores the critical importance of KYC/AML procedures on centralized platforms. It was the effective work of Changelly's security service that made it possible to break the money laundering chain and gave ZachXBT the key to solving the case. Criminals should learn: the game of cat and mouse with the blockchain always ends in defeat.