The scammer turned himself in: a complaint about frozen bitcoins led to the uncovering of a major scheme
In the world of cryptocurrency security, an incident has occurred that once again proves: greed and stupidity are the worst allies of a scammer. An anonymous user under the nickname AmanKesar11, faced with a block on 5.73 BTC (approximately $475,000) on the Changelly platform, sought help from the well-known on-chain detective ZachXBT. Instead of sympathy, he received a complete exposure.
ZachXBT conducted a standard transaction check and instantly identified that these funds are directly related to a series of thefts from U.S. citizens. The scheme was automated to perfection: the attackers used social engineering methods, primarily targeting retirees through American exchanges and Bitcoin ATMs. The total damage from this group's activities since the beginning of 2025 has already exceeded $1 million.
How the Scammer Exposed Himself
The most striking part of this story is the "evidence" that AmanKesar11 provided in his defense. The screenshots of bank statements he sent were made out to someone else's name and a different address. His explanations of the origin of the funds changed on the fly: first it was a loan, then money from a boss, then "the boss's investments" in Bitcoin back in 2014-2015. At one point, he even claimed to have filed a complaint with the Indian police over the unfair block.
Thanks to these "clues," ZachXBT was able to reconstruct the full structure of the group. Most likely, AmanKesar11 is just a courier or intermediary through whom funds were laundered for the organizer, known by the pseudonym "Mr Parveen." This is a classic scheme: a "money mule" risks their freedom for a small cut of the stolen funds, while the real beneficiaries remain in the shadows.
Conclusions and Warning
This case is a stark reminder that the blockchain does not forgive mistakes. On-chain analytics allows for reconstructing the chain of events with frightening accuracy. Scammers who think they can cover their tracks often make fatal errors by turning to those whose job it is to track their activity.
My professional stance: this incident underscores the critical importance of KYC/AML procedures on centralized platforms. Changelly acted flawlessly by freezing suspicious assets. However, investors and ordinary users should remember: if someone promises easy money or asks you to conduct a dubious transaction, chances are you are being used as cover for a criminal scheme.