Three armed attackers posed as delivery drivers to rob a crypto holder of $4.3 million. A 16-year-old orchestrated the heist using restricted investigator databases to find the victim’s address.
A 16-year-old who used professional detective (skip-tracing) tools to orchestrate a $4.3 million cryptocurrency robbery has been sentenced alongside two accomplices. Blockchain detective ZachXBT’s investigation led to the prosecution.
Three men armed with machetes forced a victim to transfer $4.3 million in cryptocurrency on June 18, 2024, per the victim’s public post. The attackers posed as delivery drivers to gain access.
ZachXBT announcement | Source: X.com
Sheffield Crown Court sentenced the defendants on Nov. 7 with nearly all funds seized, according to ZachXBT.
How They Found Him
The perpetrator accessed TLOxp to locate the victim’s address. TLOxp is a TransUnion database restricted to licensed investigators that contains addresses, phone numbers, family connections, and property records, ZachXBT’s investigation revealed.
ZachXBT announcement | Source: X.com
Chat logs showed the attackers conducted surveillance and sent photos of the victim’s door while holding a package marked “FRAGILE.” Messages referenced the database directly, with one attacker asking for the victim’s house or phone number and receiving the reply: “No, it was not listed in the TLO.”
The Database Problem
ZachXBT has stated that TLOxp’s compromised security has resulted in eight to nine figures worth of thefts from Coinbase users. Criminals can pay less than $50 for lookups on nearly any US citizen through Telegram channels. He warned the database may have “directly resulted in multiple deaths” through robberies or swatting incidents.
Data breaches increasingly enable physical targeting. The Coinbase data breach exposed customer addresses, while Bitcoin ATM operator Byte Federal lost data on 58,000 users including photographs and physical addresses. Private key compromises accounted for 43.8% of crypto theft in 2024, according to Chainalysis.
Joseph Cox of 404 Media documented how hackers steal law enforcement officer identities to pass verification checks. Cox reported that criminals advertise database access for as little as $15 per search in Telegram channels.
Joseph Cox announced | Source: X.com
The Investigation
ZachXBT began investigating after the victim tagged him on June 18. He acquired chat logs and surveillance photos, then identified the primary suspect through a leaked bail document showing an unredacted birth date of Sept. 23, 2007.
Police officials and investigators are starting to take crypto crime seriously. In early 2025, South Korea upgraded its crypto crime task force into a permanent unit after seizing $97.5 million in assets.
The case demonstrates successful cross-border collaboration between blockchain investigators and law enforcement. At the time of completing his part of the investigation, ZachXBT advised crypto holders to avoid sharing personal information about holdings and to monitor personal data exposure online.
next