The investigator’s findings suggested the thefts were not smash-and-grab operations, but carefully threaded movements that blended arrogance with technical precision, leaving behind just enough evidence to raise alarms without a clear trail to follow.
“Threat actors only continue to showing off stolen funds in leaked recordings rather than simply just staying quiet after an alleged theft from the U.S. Government,” the analyst stated.
FAQ Who is “John” or “Lick”?An online alias ZachXBT tied to wallets allegedly linked to multiple large-scale crypto thefts. What funds were allegedly stolen?The investigation points to private wallets and U.S. government seizure addresses holding tens of millions of dollars. How was the actor identified?Through leaked Telegram recordings and onchain wallet tracing. Have authorities confirmed the claims?No charges or official statements have been issued as of Jan. 25, 2026.
