On-chain investigator ZachXBT published a post on X describing what he called a short story about Indian scammers who ‘called the cops on themselves.’ According to his account, a follower contacted him earlier this week from a personal account and complained that 5.73 BTC, marked in the post as roughly $475,000, had been ‘unjustly’ frozen at Changelly in March 2025. Instead of accepting the explanation as presented, ZachXBT said he plotted the relevant Bitcoin transaction in his compliance tools and began tracing the movement of funds.
The trail, as ZachXBT described it, led back to illicit sources. He said the inflows could be traced through social engineering thefts that targeted Americans and involved US exchanges as well as Bitcoin ATMs. He also tied the case to a broader cluster of high-confidence thefts that, since 2025, has taken more than $1 million from victims. Several of those victims, he wrote, were elderly.
The Changelly Freeze and the Bitcoin Trail
The case began with a direct message. ZachXBT said the person reached out through his own personal account and asked for help over the 5.73 BTC frozen at Changelly. The user described the freeze as unfair and placed the timing in March 2025. ZachXBT then used compliance tooling to map the Bitcoin transaction and examine where the inflows had come from.
Based on that tracing, ZachXBT said the funds were not clean. In his post, he connected the inflows to illicit sources through social engineering thefts. The described victims were Americans, and the route involved US exchanges and Bitcoin ATMs. ZachXBT did not name the victims, the specific exchanges, or any individual ATM locations, but he did identify the pattern as part of a wider theft cluster.
He stated that the broader cluster contained high-confidence thefts and had taken over $1 million from victims since 2025. The mention that several victims were elderly added another factual detail to the pattern he described: the case was not presented merely as a dispute over a frozen exchange order, but as one data point in a larger group of thefts involving social engineering and subsequent movement of Bitcoin.
Changing Explanations and an Indian Police Report
ZachXBT said the user’s story kept changing during their conversation. At one point, the user described the funds as a loan. Then, according to ZachXBT, the explanation changed to the funds having been sent by the user’s boss. The story then shifted again, with the user saying the boss had invested in Bitcoin ‘during 2014 and 2015’ through a friend in the United States.
The most unusual part of the exchange, as ZachXBT framed it, was the user’s claim that he had filed a police report in India in December 2025 over the frozen funds. The report number cited in the post was 3207-P/2025. ZachXBT used this detail to support his description that the scammers had effectively called the police on themselves while seeking help over funds he said were linked to theft.
During their direct messages, the user also shared email screenshots with ZachXBT. ZachXBT said he queried those screenshots to surface additional data points and to map out the group connected to the user. The post did not publish a full investigative chart, but it made clear that the screenshots were used to expand the set of identifiers and relationships around the account that contacted him.
AmanKesar11, ‘Mr Parveen’ and the Public Addresses
ZachXBT identified the user as AmanKesar11 in the public information included at the end of the post. He said he suspects AmanKesar11 is a mule for his boss, whom he named as ‘Mr Parveen.’ The reason he gave was that the ‘proof’ sent by the user included bank statements under a different name and location. ZachXBT did not provide a full identity profile for Mr Parveen and did not describe a complete division of roles between AmanKesar11 and the boss; he limited the statement to the suspicion formed from the material shared in their exchange.
The post also contained a direct warning. ZachXBT wrote that people can message him for help and that he will respect privacy, but they should at least use common sense and should not contact him with stolen funds. In the same post, he published the relevant identifiers: the 5.73 BTC frozen order was fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3; the AmanKesar11 BTC address was bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2; and the AmanKesar11 Tron address was TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm.
The X post was timestamped 11:52 on June 19, 2026. The page showed 143,000 views, along with visible interaction figures including 256, 130, 1.4K and 228, and it also displayed that 256 replies could be read. Foresight categorized the item under its homepage headline section and linked to ZachXBT’s original post on X.