A Digital Paper Trail Emerges as ZachXBT Traces Millions to a Suspected U.S. Seizure Leak
ZachXBT traces over $90M in suspected stolen crypto, linking flashy wallets to funds tied to a U.S. government seizure case.
Blockchain investigator ZachXBT has once again demonstrated how transparency cuts both ways in crypto. In a detailed thread published this week, he linked a cluster of high-profile wallets to more than $90 million in suspected stolen funds, some of which appear to originate from a U.S. government seizure tied to the long-running Bitfinex case. The findings underscore how public ledgers, combined with human error, can unravel even carefully obscured operations.
/p>p>At the center of the investigation is an individual operating under the alias “John,” also known as “Lick,” who allegedly controlled multiple wallets displaying conspicuous wealth. According to ZachXBT, the trail became unusually clear after a recorded dispute in a private group chat exposed live wallet access. In that exchange, commonly referred to in underground circles as “band for band,” participants attempt to outdo each other by proving control over funds in real time. What is often intended as bravado can quickly turn into evidence.
/p>p>In this case, screen recordings showed a wallet holding several million dollars in crypto, followed by additional transfers that occurred during the argument itself. ZachXBT noted that the footage appeared to show the same individual moving funds across different addresses, effectively confirming shared control. “Caught flexing $23M in a wallet address directly tied to $90M+ in suspected thefts,” he wrote, framing the incident as a rare moment where online posturing collided with blockchain forensics.
/p>p>From there, the investigation shifted to transaction history. By tracing flows backward, ZachXBT connected one of the wallets to another address that had received more than 1,000 wrapped ether in late 2025. That address, in turn, was funded by a wallet that had received nearly $25 million from a U.S. government-controlled address in March 2024. The government wallet was previously associated with seized funds from the Bitfinex hack, a case that has continued to produce new revelations years after the original breach.
/p>p>What makes the case particularly striking is the scale and timing of the inflows. ZachXBT reported that one linked wallet alone saw more than $60 million pass through it during the final quarter of 2025, including transfers potentially tied to unidentified victims and to addresses connected with government seizures. Additional funds, including a multimillion-dollar transfer from a centralized exchange, added to the picture of sustained activity rather than an isolated incident.
/p>p>The human response to exposure was swift. Shortly after the findings were made public, the suspect reportedly altered online identities, removed NFT usernames, and changed messaging app handles. Such rapid digital cleanup is often interpreted as a sign of mounting pressure, especially when scrutiny extends beyond social media and into the realm of law enforcement.
/p>p>While ZachXBT stopped short of definitively naming the individual behind the alias, he acknowledged speculation linking the wallets to a person previously arrested in 2025, emphasizing that further verification is required. The episode serves as a reminder that in crypto, anonymity is fragile. As this case illustrates, a single recorded moment can transform a display of wealth into a roadmap for investigators, leaving a permanent trail etched into the blockchain.
