On June 19, 2026, on X, on-chain investigator ZachXBT published what he described as “a short story about Indian scammers who called the cops on themselves.” The account began with a direct message he said he received earlier in the week from a follower’s personal account. According to ZachXBT, the follower complained that 5.73 BTC, valued in the post at about $475,000, had been “unjustly” frozen at Changelly in March 2025.
ZachXBT said he then plotted the relevant Bitcoin transaction using his compliance tools. His tracing, as described in the post, led to a different picture from the one presented by the person who contacted him. He said the inflows traced back to illicit sources connected to social engineering thefts targeting Americans through U.S. exchanges and Bitcoin ATMs.
Frozen 5.73 BTC Tied to Theft Flows, ZachXBT Says
In the post, ZachXBT placed the 5.73 BTC case within a broader cluster of transactions. He described the wider cluster as consisting of high-confidence thefts that have taken more than $1 million from victims since 2025. He also wrote that several of those victims were elderly. The post did not name the victims, but it linked the activity to thefts involving social engineering tactics and infrastructure used by Americans, including U.S. exchanges and Bitcoin ATMs.
The unusual aspect of the episode, as ZachXBT presented it, was that the person seeking help had approached him while the funds were allegedly connected to stolen assets. ZachXBT wrote that people can message him for help and that he will respect their privacy, but he added that they should use common sense and not contact him with stolen funds.
The Explanation for the Funds Kept Changing
ZachXBT said the follower’s explanation for the source of the funds changed during their conversation. First, the person said it was a loan. Then, according to ZachXBT, the person said the funds had been sent by his boss. The story then changed again: the person claimed that his boss had invested in Bitcoin “during 2014 and 2015” through a friend in the United States.
ZachXBT also highlighted what he called “the best part” of the story: the person claimed to have filed a police report in India in December 2025 over the frozen funds. The report number given in the post was 3207-P/2025. In ZachXBT’s telling, the same person who was trying to get assistance with frozen funds also claimed to have gone to police in India about those funds.
Email Screenshots and the Mapping of the Group
Beyond the Bitcoin transaction itself, ZachXBT said the person shared email screenshots in their direct messages. ZachXBT wrote that he queried those screenshots to surface additional data points and map out the person’s group. The post did not reproduce the full email contents in the text, but it stated that the screenshots were used as part of the effort to identify links among the people and funds involved.
ZachXBT named AmanKesar11 in the post and said he suspects AmanKesar11 is a mule for his boss, “Mr Parveen.” He gave a specific reason for that suspicion: the “proof” sent by the person included bank statements under a different name and location. Based on those materials, ZachXBT connected AmanKesar11, “Mr Parveen,” the frozen funds and the related transaction trail in his public account of the incident.
Transaction Hash and Addresses Disclosed
At the end of the post, ZachXBT listed several identifiers tied to the case. He gave the 5.73 BTC frozen order as transaction hash fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3. He also listed AmanKesar11’s Bitcoin address as bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2 and AmanKesar11’s Tron address as TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm.
The X post was timestamped 11:52 on June 19, 2026, and the page showed about 228,000 views. The interface also displayed “Read 296 replies” along with engagement counts including 296, 209, 2K and 335. The public record of the incident, as provided in the post, is that a follower asked ZachXBT for help over a frozen 5.73 BTC balance at Changelly, ZachXBT traced the transaction to inflows he described as illicit, and he then published the related order hash, Bitcoin address, Tron address and the Indian police report number cited by the person in the direct messages.