On X, on-chain investigator ZachXBT shared what he described as “a short story about Indian scammers who called the cops on themselves.” According to his post, earlier this week a follower contacted him through a personal account and complained that 5.73 BTC had been “unjustly” frozen at Changelly in March 2025. ZachXBT noted that the amount was worth about $475,000.
Rather than accepting the complaint at face value, ZachXBT said he plotted the Bitcoin transaction using his compliance tools. The result, as described in the post, was that the inflows traced back to illicit sources. He said those sources were connected to social engineering thefts that targeted Americans through U.S. exchanges and Bitcoin ATMs.
The Frozen Changelly Order
The frozen order identified by ZachXBT was fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3. The person who contacted him presented the case as a dispute over frozen funds, claiming that the 5.73 BTC had been frozen unfairly. ZachXBT’s post framed the matter differently after reviewing the transaction flow and linking the inflows to theft-related sources.
He also wrote that the broader cluster of high-confidence thefts has taken more than $1 million from victims since 2025. Several of those victims, according to ZachXBT, were elderly. The post did not name the victims, but it did specify that the thefts targeted Americans and used routes involving U.S. exchanges and Bitcoin ATMs.
A Changing Explanation for the Funds
ZachXBT said the person’s story changed repeatedly during the conversation. In his summary, the explanation first became that the money was a loan. Then the person said his boss sent it. After that, the explanation changed again: his boss had invested in Bitcoin “during 2014 and 2015” through a friend in the United States.
The person also shared screenshots of emails in direct messages. ZachXBT said he queried those screenshots to surface more data points and map out the group. The account he named was AmanKesar11. ZachXBT wrote that he suspected AmanKesar11 was a mule for his boss, identified in the post as “Mr Parveen,” because the “proof” that was sent included bank statements under a different name and location.
The India Police Report
A central detail in ZachXBT’s post was the claim that, in December 2025, the person said he had filed a police report in India over the frozen funds. ZachXBT listed the report number as 3207-P/2025. This is the detail behind his description that the scammers had called the cops on themselves: the person was allegedly seeking official help over funds that ZachXBT said were tied to illicit inflows.
ZachXBT ended the post with a direct warning. He wrote that people can message him for help and that he will respect their privacy, but they should use common sense and not contact him with stolen funds. The message was aimed at the person who approached him, but it also served as a broader statement about how he handles requests for assistance when the associated funds appear to trace back to theft.
Addresses Disclosed in the Post
In addition to the Changelly frozen order, ZachXBT published two addresses associated with AmanKesar11. The Bitcoin address was bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2. The Tron address was TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm. These were presented alongside his explanation of the transaction tracing, the shifting claims about the origin of the funds, and the alleged connection to “Mr Parveen.”
The X post was timestamped 11:52 on June 19, 2026. The page showed about 180,000 views, along with visible interaction counts including 268, 153, 1.6K and 265, and a “Read 268 replies” label. The disclosure centered on the frozen 5.73 BTC, the Changelly order, the claimed India police report numbered 3207-P/2025, and ZachXBT’s conclusion from the transaction data and direct-message material he reviewed.