Key Takeaways
- • ZachXBT identified a user known as "John" or "Lick" controlling over $90 million in suspected illicit cryptocurrency funds, including assets traced to U.S. government-controlled seizure wallets linked to the 2016 Bitfinex hack.
- • Approximately $24.9 million from a Bitfinex seizure wallet was traced to wallets attributed to the suspect, with funds subsequently moved through exchanges and bridges using standard cryptocurrency laundering techniques (splitting, cycling, and reconsolidation).
- • Attribution occurred through real-time wallet exposure during a private Telegram exchange, providing rare onchain evidence that linked the pseudonymous actor to multiple fraud and theft schemes.
- • ZachXBT also identified broader compliance failures at stablecoin issuer Circle, alleging $420 million in cumulative cases since 2022 where illicit USDC funds were not frozen or delayed, including during the $285 million Drift Protocol exploit on Solana.
- • U.S. Marshals Service launched a formal investigation following the disclosure, with unverified allegations suggesting the suspect may be connected to an executive at a firm contracted to manage seized government assets.
Summary
On January 23, 2025, blockchain investigator ZachXBT publicly disclosed findings linking a pseudonymous cryptocurrency user operating under the handles "John" and "Lick" to more than $90 million in suspected illicit cryptocurrency activity. The investigation traced a significant portion of these funds—approximately $24.9 million—to U.S. government-controlled wallets holding seized cryptocurrency from the 2016 Bitfinex hack. These government seizure funds were destined for the U.S. Strategic Bitcoin Reserve, as referenced in a March 2025 Executive Order on Digital Assets.
The attribution methodology proved unusually direct: ZachXBT linked the suspect through live wallet activity exposure during a private Telegram exchange, providing rare real-time evidence connecting the pseudonymous actor across multiple wallets and transactions. Once identified, the analyst documented classic cryptocurrency laundering patterns—assets were split across multiple wallets, cycled through cryptocurrency exchanges and bridge protocols, and subsequently reconsolidated—consistent with established illicit fund-movement methodologies.
ZachXBT's investigation also identified systemic compliance gaps at Circle, the issuer of USDC stablecoin. According to the analyst's findings, Circle failed to freeze or meaningfully delay $420 million in illicit funds across documented cases spanning from 2022 onward. This alleged compliance failure included instances during the $285 million Drift Protocol exploit on Solana, where stolen USDC reportedly flowed through Circle-enabled infrastructure without adequate controls.
The findings prompted the U.S. Marshals Service to launch a formal investigation. While unverified at publication, ZachXBT alleged the suspect may be connected to an executive at a custody contractor retained by federal authorities to manage seized assets—a claim that, if substantiated, would suggest potential insider involvement in the theft.
The case underscores persistent vulnerabilities in both government asset custody practices and stablecoin issuer compliance infrastructure, despite growing regulatory scrutiny of cryptocurrency platforms handling illicit funds.
The attribution methodology proved unusually direct: ZachXBT linked the suspect through live wallet activity exposure during a private Telegram exchange, providing rare real-time evidence connecting the pseudonymous actor across multiple wallets and transactions. Once identified, the analyst documented classic cryptocurrency laundering patterns—assets were split across multiple wallets, cycled through cryptocurrency exchanges and bridge protocols, and subsequently reconsolidated—consistent with established illicit fund-movement methodologies.
ZachXBT's investigation also identified systemic compliance gaps at Circle, the issuer of USDC stablecoin. According to the analyst's findings, Circle failed to freeze or meaningfully delay $420 million in illicit funds across documented cases spanning from 2022 onward. This alleged compliance failure included instances during the $285 million Drift Protocol exploit on Solana, where stolen USDC reportedly flowed through Circle-enabled infrastructure without adequate controls.
The findings prompted the U.S. Marshals Service to launch a formal investigation. While unverified at publication, ZachXBT alleged the suspect may be connected to an executive at a custody contractor retained by federal authorities to manage seized assets—a claim that, if substantiated, would suggest potential insider involvement in the theft.
The case underscores persistent vulnerabilities in both government asset custody practices and stablecoin issuer compliance infrastructure, despite growing regulatory scrutiny of cryptocurrency platforms handling illicit funds.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.