How a $4M Crypto Fraud Ring Evaded Detection Until ZachXBT Exposed Them

Blockchain analyst ZachXBT recently uncovered one of the more brazen cryptocurrency scams in recent months—a $4 million theft orchestrated through impersonation and social engineering. The case not only reveals vulnerabilities in how users interact with crypto platforms, but also highlights the shocking carelessness of perpetrators who openly flaunt their ill-gotten gains.

The $240K Victim: How One Elderly Man Fell for the Scheme

The investigation began with a particularly devastating case. An elderly victim lost $240,000 after being deceived through phone calls posing as customer support representatives from a major exchange platform. According to ZachXBT’s findings, the perpetrator recorded the transaction details on Discord, providing a digital trail that would later prove crucial to identifying the ring.

The scammer, identified as Christian Nieves (online aliases: Daytwo and PawsOnHips), deposited portions of stolen assets on gambling sites and converted other funds into the privacy-focused cryptocurrency Monero (XMR)—a classic money laundering technique within the crypto ecosystem.

The Broader Operation: $4 Million in Coordinated Theft

ZachXBT’s investigation revealed that this wasn’t an isolated incident. The network operated a fake support call center where operatives impersonated exchange staff, convincing victims to create wallets using seed phrases controlled by the scammers. Once victims deposited funds into these compromised wallets, the criminals immediately siphoned the assets.

The researcher traced the gambling platform username “pawsonhips” to Nieves, identifying deposit addresses linked to over 30 suspected frauds totaling approximately $4 million. Chat logs from Discord showed that Nieves frequently placed bets with associates during calls, discussing laundering methods with striking openness.

What Made Them Vulnerable to Detection

What distinguishes this case is the perpetrators’ recklessness. Unlike sophisticated criminal operations that maintain operational security, Daytwo’s ring consistently showed their faces during calls, openly discussed money laundering strategies, and documented transactions on public platforms. This carelessness accelerated their identification and served as a valuable case study for researchers like ZachXBT.

Why Crypto Remains a Target

As cybersecurity infrastructure hardens within Web3, fraudsters increasingly pivot toward exploiting human psychology rather than technical vulnerabilities. The lack of traditional banking safeguards and the irreversible nature of blockchain transactions make cryptocurrency an attractive vector for social engineers.

ZachXBT’s detailed documentation—including call recordings and on-chain analysis—demonstrates that while blockchain provides transparency, it also reveals the patterns of unsophisticated scammers who underestimate investigative capabilities. For users, the lesson remains clear: verification protocols and skepticism about unsolicited contact remain the strongest defense against these schemes.