On-chain investigator ZachXBT published a post on X describing what he called “a short story about Indian scammers who called the cops on themselves.” According to the post, the episode began earlier this week when a follower contacted him by direct message from a personal account and complained that 5.73 BTC had been “unjustly” frozen at Changelly in March 2025. ZachXBT valued the amount at about $475,000 in the post. Rather than treating the message as a straightforward frozen-funds complaint, he said he plotted the Bitcoin transaction in his compliance tools and began reviewing where the coins had come from.
ZachXBT said that the inflows traced back to illicit sources tied to social engineering thefts targeting Americans through U.S. exchanges and Bitcoin ATMs. He also wrote that a broader cluster of high-confidence thefts had taken more than $1 million from victims since 2025, with several of those victims being elderly. The post therefore reframed the Changelly freeze as part of a wider on-chain investigation rather than an isolated customer-service issue over a blocked order.
A Frozen 5.73 BTC Order Leads to On-Chain Tracing
The user who contacted ZachXBT framed the frozen funds as unfairly blocked assets. ZachXBT said the relevant frozen order involved 5.73 BTC and provided the transaction hash: fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3. By entering the transaction into compliance tooling, he said he was able to chart the movement of funds and identify connections to illicit sources.
In his account, the funds were connected to social engineering thefts directed at Americans. The routes mentioned in the post included U.S. exchanges and Bitcoin ATMs, two channels that ZachXBT said were involved in the broader theft activity. The post did not identify the victims by name, but it specified that the larger high-confidence cluster had caused more than $1 million in victim losses since 2025 and that several victims were elderly. Those points formed the factual basis for ZachXBT’s conclusion that the frozen funds were linked to theft activity.
The Story Changed From a Loan to a Boss’s Bitcoin Investment
ZachXBT also described multiple changes in the user’s explanation for the source of funds. At one point, the user said the money was a loan. The explanation then changed to the user’s boss having sent the funds. It later changed again, with the user saying the boss had invested in Bitcoin “during 2014 and 2015” through a friend in the United States. ZachXBT presented these shifting explanations as part of the reason he continued to dig into the transaction and the people around it.
The most unusual part of the story, according to ZachXBT, was the claim that the user had filed a police report in India in December 2025 over the frozen funds. The report number cited in the post was 3207-P/2025. In ZachXBT’s telling, the person approaching him for help over the Changelly freeze had also taken the matter to police, while the on-chain trail connected the funds to thefts. That is why he characterized the situation as scammers effectively calling the cops on themselves.
Email Screenshots, AmanKesar11 and “Mr Parveen”
During the direct-message exchange, the user shared email screenshots with ZachXBT. ZachXBT said he queried those screenshots to surface additional data points and map out the user’s group. The post named AmanKesar11 and a person referred to as “Mr Parveen.” ZachXBT wrote that he suspected AmanKesar11 was a mule for his boss, “Mr Parveen.”
The reason given in the post was that the “proof” sent by the user included bank statements under a different name and location. ZachXBT did not publish the full personal details from those statements in the text of the post, but he used the mismatch between the submitted proof and the user’s identity claims as another data point in the investigation. The post combined on-chain identifiers, transaction tracing, email screenshots and bank-statement inconsistencies to outline the suspected group structure.
Addresses Published and a Warning About Stolen Funds
ZachXBT ended the post by listing the key identifiers for the case. The frozen 5.73 BTC order was tied to the transaction hash fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3. He also published the Bitcoin address for AmanKesar11 as bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2 and the Tron address for AmanKesar11 as TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm. These identifiers were presented as the on-chain reference points for the episode.
He also added a direct warning: people can message him for help and he will respect their privacy, but they should use common sense and not contact him with stolen funds. The X post was timestamped 11:52 on June 19, 2026, and the page showed 103,000 views. Other visible interaction figures in the captured post included 213, 97, 1.1K and 182, along with an entry showing “Read 213 replies.” The post centered on a frozen Changelly order, but ZachXBT’s account connected that order to alleged social engineering thefts, U.S. exchanges, Bitcoin ATMs, and a broader cluster of more than $1 million in victim losses since 2025.