• ZachXBT announced the exposure of a probable network of crypto scammers from India.
• The owner of the frozen bitcoins approached the analyst himself and drew attention to a possible crypto scheme.
• The crypto detective claimed a connection between 5.73 BTC and a series of thefts via bitcoin ATMs and US exchanges.

On-chain researcher ZachXBT reported the exposure of a probable group of crypto scammers from India after one of the users approached him with a complaint about the freezing of 5.73 BTC in the Changelly service. 

The story attracted the attention of the crypto community because the complainant was probably himself trying to get funds of dubious origin unblocked.

According to ZachXBT, at the beginning of the week a user contacted him from a personal account and claimed that his 5.73 BTC (about $475,000 at the time of the appeal) had been "unfairly" frozen by Changelly in March 2025.

How to protect yourself from cryptocurrency theft: advice from Juscutum 13.12.2023 Read

After analyzing the bitcoin transactions, the analyst concluded that the funds came from illegal sources.

"The inflows of funds lead to illegal sources through thefts committed using social engineering against Americans via US exchanges and bitcoin ATMs," ZachXBT said.

According to him, a broader group of addresses linked to these transactions has stolen more than $1 million from victims since 2025. Some of those affected are elderly people.

The versions of the funds' origin kept changing

The crypto detective noted that the complainant's explanations regarding the origin of the first cryptocurrency kept changing.

At first he claimed that the funds were a loan. Later he stated that the bitcoins had been sent by his manager. Subsequently, yet another version appeared — that the manager had allegedly invested in bitcoin in 2014-2015 through an acquaintance in the US.

ZachXBT paid particular attention to the fact that in December 2025 the complainant had allegedly filed a report with the Indian police regarding the frozen funds.

During the correspondence, the user sent screenshots of emails which, according to the analyst, helped to obtain additional data and establish connections between participants in the alleged scheme.

Seconds before the transfer: how crypto fraud is changing in the age of AI 21.04.2026 Read

He suggested that a user under the alias AmanKesar11 could have acted as a financial intermediary for a person named Parvin.

"I suspect that AmanKesar11 is a mule for his boss “Mr. Parvin”, since the “evidence” he provided contained bank statements under a different name and from a different location," he noted.

ZachXBT also ironically commented on the concentration of funds from various platforms on one person in New Delhi:

"Nothing suspicious about irregular transfers from Bitcoin Depot, Athena Bitcoin, Coinhub ATM, Cash App, Robinhood, Coinbase, Strike and other services going to one person in New Delhi, India."

At the end, the researcher added:

"You can come to me for help, and I will respect your confidentiality, but at least use common sense and don't write to me regarding stolen funds."

In recent months, ZachXBT has regularly found himself at the center of high-profile investigations in the crypto industry. Earlier he reported possible misconduct by Axiom employees who, according to him, may have used insider information for insider trading. 

The researcher also reported a network of AI accounts on the social network X that promoted crypto scams through political and military fakes, accused Circle of improperly blocking stolen assets worth more than $420 million, and announced a $10,000 reward for information about alleged manipulation on centralized exchanges.

Source: Incrypted