1/ In late 2023 a former Yuga Labs security researcher was stopped at the airport after law enforcement mistakenly linked them to a $1.1M phishing theft from a Bored Ape owner. Here’s an investigation into where the stolen funds went and who’s actually responsible.

6/ An unnamed source provided a personal email of an account that interacted multiple time with the WhiteRock deployer address. I noticed the email has an account on Chess(.)com with the username IldarTheGrandMaster. Prometheus from Zkasino = Ildar Whiterock alias = Goedel goedel014@gmail(.)com

1/ An investigation into how the New York based social engineering scammer Daytwo/PawsOnHips (Christian Nieves) stole $4M+ from Coinbase users by impersonating customer support, bought luxury goods, and lost most of the funds gambling at casinos.

1/ Community Alert: At least one team member from the $30M Zkasino exit scam appears to be involved with the project @WhiteRock_Fi $WHITE due to onchain transactions linking both projects and a personal email address.

1/ A video went viral on YT this week after a US based victim lost $3.05M (1.2M XRP) from their Ellipal wallet. Here’s the tracing of where the stolen funds ended up and the biggest takeaways for similar thefts.

Update: Update: John (Lick) sent me 0.6767 ETH ($1.9K) of the stolen government funds from 0xd8bc to my public wallet address. Transaction hash 0x90539e91fbebd0aaa050a492548b1e3b1bc7d82dd84bf8a42a9595a90425ebfa (Any stolen funds received will be sent to a USG seizure address)

5/ Behind the scenes the account hosts fake giveaways and promote crypto pump and dump schemes.

Update 2: LAB dumped 85% down to just under $2 from $14 ($14B FDV) in past 24 hrs. Disappointing to see how no action was taken by Binance, Bitget, & Gate earlier to prevent it. If CEXs cared profits from the accounts manipulating price would be distributed to users at a minimum. Unlocks for investors were scheduled to begin later this month however multiple late vesting changes occurred in the past. Insiders have controlled the entire float which lead to extreme price manipulation on CEXs via MM. I do not encourage trading LAB under any circumstances.

8/ While these Chinese investment frauds are obvious to most, they purposely target unsophisticated retail investors via social media. Reading through victim posts, many still seem to be in denial that they were scammed. If you are a victim of BG / DSJ I suggest filing a police report in your jurisdiction (US victims: ic3[.]gov). I rarely investigate Ponzi schemes myself since the cases lack sophistication and the work gets repetitive. This incident caught my attention while I was reviewing USDD contract flows for another case. The $150M+ figure is likely significantly higher since the scheme has been operating since 2025 with thousands of victim exchange withdrawals identified.

In late 2023, French streamer TeufeurS was extorted for a ransom after a family member was kidnapped in France. I can finally share that I helped lead efforts that resulted in an ~$800K freeze with the Binance Security team after a $2M ransom was paid. Six suspects tied to the incident were later arrested. Given the sensitivity of the case, I held off commenting until now. I have since assisted with asset freezes and identifying culprits in several of the recent France home invasion robberies, and hope to share details in the coming months. If you or someone you know falls victim, reach out as soon as possible rather than delay. I prioritize these types of cases as they have grown more frequent amidst this disturbing trend.

If you enjoy similiar type of work from me consider participating in the @thedaofund x @Giveth 500 ETH matching round for Ethereum Security which is live until May 15. It's quadratic funding, so smaller contributions are worth considerably more. Currently a $10 donation is >$5K matched. Link to support me: qf.giveth.io/project/zachxbt…

A summary of the RAVE -95% price fluctuation from $26 to $1 over the past 24 hours. RAVE Timeline: April 18, 2026 7:26 am UTC: I posted a call to action for Binance, Bitget, & Gate to investigate RAVE market manipulation and offered a $10K bounty. 10:56 am UTC: I posted an update increasing the bounty to $25K. 11:18 am UTC: Bitget publicly acknowledged the call to action. 2:08 pm UTC: Binance publicly acknowledged the call to action. 3:06 pm UTC: RaveDAO posted claiming they have no involvement. 4:19 pm UTC: Gate publicly acknowledged the call to action. In the days leading up, on April 13 & 14, I confronted RaveDAO co-founder Yemu Xu (wildwoomoo) but have yet to receive an answer. RAVE launched in Dec 2025 on Binance Alpha with a 1B total supply. The addresses below, linked to the initial distribution, control ~95% of the RAVE supply (h/t Mlm): 0x9831156F1a6E506Fca41503590b42F07c2e80f54 0x8Ed6245C3276307E1A9D9Dc872E98A0E770070fd 0x6020656d1EF182173E45D4Fc375BDD5a48c674B0 0x2664cB80a5ee7D8EC05fe7C752dD62E078056E6d 0x2D81F8AeBf3e58A5e638006c9fd8F38C5220ecab 0x31694d761A8e851cFFbCd286aC54D01e5Ce5aFe6 0x0A1F07993a51CcEb4f52CA67765AECeADDA790d7 0xEB74Df8588cFC1C179Df4bd96C0bB8B227B9bE92 0x53d7d52301366DC14E1916b14eFeC1aDD8F3487b I found suspicious CEX activity in April 2026 tied to RaveDAO team addresses onchain, which potentially contradicts their recent statement: Bitget 0x2dc20f2180582172f5450c5d71e23fa438a7031b 0xa3a02aeb97fc1737c66f50d07d024799c137891d 0x2d95eb42525e6087e0cb7869f98da6838ed2e743 Gate 0x31711246b05d71e9eda5e38a3abb654020ee3353 Given the supply concentration, the team at minimum knows who is responsible for this price action. A simple litmus test: $6B in market cap was wiped out on just $52M of 24hr liquidations (h/t CoinGlass). That ratio points to a manipulated and unsustainable valuation. RAVE is not the only token with manipulation we have seen on major centralized exchanges. It's just the most blatant, reaching a top 15 market cap within 10 days before dropping 95% in hours. Other projects with highly questionable price action recently include: SIREN, MYX, COAI, M, PIPPIN, RIVER. Exchanges need faster intervention on manipulation. Detection at scale isn't easy, but each day of delay means retail traders absorb losses while platforms collect fees on the volume. The outcome is the same regardless of intent. While it's good the exchanges responded, I find it unlikely this activity wasn't spotted internally before I raised it publicly. I recognize how much this behavior takes from retail traders, and I plan to investigate similar movements in hopes of identifying the responsible parties. I want to reiterate that I did not take a position. If I had, I would have been liquidated myself. I also could not anticipate if or when the exchanges would comment publicly. My $25K bounty will remain active since the only DMs received were unverified claims rather than non-public information with supporting evidence as requested.

Update: Three hours ago multisig 0x53d7 linked to the RAVE initial distribution which I flagged above sent ~23M RAVE ($23M) to two Bitget deposit addresses and the price dropped 40% from $1 to $0.6. Deposit addresses 0x26aC542f5a04D574580881723224DAcD1EDB9B45 0x64D6E91D0bd9cB7be44E1e627264539493f73c2b

1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions. I spent long hours going through all of it, none of which has ever been publicly released. It revealed an intricate ~$1M/month scheme of fraudulent identities, forged legal documents, and crypto-to-fiat conversion. Enjoy the findings!

11/ This cluster of DPRK IT worker activity is less sophisticated compared to groups like AppleJeus and TraderTraitor, which operate far more efficiently and present the greatest risks to the industry. I previously estimated DPRK IT workers generate multiple seven figures per month in revenue, and the data here supports that. Unpopular opinion: threat actors are leaving an opportunity on the table by not targeting low-tier DPRK groups. The risk of repercussions is low, competition is minimal, and the targets are arguably deserving. I plan to continue building out investigation.io with future findings. Special thanks to @domain for helping me purchase two premium domains.

1/ Welcome to the Circle $USDC files. $420M+ in alleged compliance failures since 2022, including fifteen cases of the US-regulated stablecoin issuer taking minimal action against illicit funds.