On-chain investigator ZachXBT published a post on June 19, 2026, describing what he called “a short story about Indian scammers who called the cops on themselves.” According to his account, earlier in the week a follower contacted him through a personal account and complained that 5.73 BTC, worth about $475,000, had been “unjustly” frozen at Changelly in March 2025. ZachXBT said he then plotted the Bitcoin transaction using his compliance tools.
The frozen 5.73 BTC order was identified in the post with the transaction hash fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3. The person who contacted ZachXBT framed the case as a wrongful freeze of personal funds, but ZachXBT said that once he traced the transaction path, the inflows did not resemble an ordinary private transfer.
According to ZachXBT, the inflows trace back to illicit sources connected to social engineering thefts targeting Americans. He said those thefts involved U.S. exchanges and Bitcoin ATMs. He also stated that a broader cluster of high-confidence thefts had taken more than $1 million from victims since 2025, and that several of the victims were elderly.
The account’s explanation for the origin of the money changed during the private messages, ZachXBT wrote. At one point, the person said it was a loan. Then the explanation changed to the person’s boss having sent the funds. After that, the story changed again: the boss had allegedly invested in Bitcoin “during 2014 and 2015” through a friend in the United States.
ZachXBT presented the changing explanations as part of the reason the case stood out. He then highlighted what he called the best part of the story: the person claimed to have filed a police report in India in December 2025 over the frozen funds. The police report number cited in the post was 3207-P/2025. In ZachXBT’s telling, the person seeking help over the freeze had effectively escalated the matter to Indian police while the traced funds were linked to theft activity.
The post also said that the person shared email screenshots in direct messages. ZachXBT said he queried those screenshots to surface additional data points and map out the group. He did not publish the full contents of the email screenshots in the text of the post, but he said they helped provide more information about the people involved.
ZachXBT further stated that he suspected AmanKesar11 was a mule for his boss, whom he identified as “Mr Parveen.” The reason he gave was that the “proof” sent by the person included bank statements under a different name and location. That detail was presented alongside the shifting explanations about the source of the Bitcoin funds.
Two addresses associated with AmanKesar11 were also included in the post. The Bitcoin address was bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2, and the Tron address was TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm. These addresses appeared together with the Changelly frozen order hash in ZachXBT’s disclosure.
ZachXBT ended the post with a warning about contacting him for assistance. He wrote that people can message him for help and that he will respect their privacy, but added that they should use common sense and not contact him with stolen funds. The post timestamp shown in the source was 11:52 on June 19, 2026, and the page showed 207,000 views, along with “Read 278 replies.” The scraped page content also displayed interaction figures including 278, 186, 1.8K, and 302.
The case described by ZachXBT combines a frozen Changelly order, Bitcoin transaction tracing, alleged social engineering thefts targeting Americans, a December 2025 Indian police report numbered 3207-P/2025, and the identities AmanKesar11 and “Mr Parveen.” His account centers on the contradiction between a request for help over an allegedly unfair freeze and a transaction trail he said linked the funds to theft-related inflows.