A cryptocurrency wallet allegedly controlled by a threat actor known as “John” has been linked to more than $90 million in suspected illicit funds, including assets linked to an earlier U.S. government seizure related to the Bitfinex hack, according to blockchain investigator ZachXBT.
In a thread posted on
The funds were then traced to wallets associated with government-controlled seizure addresses and other alleged victims.
The incident stemmed from an argument between John and another threatening actor during an online group chat. The two men engaged in what is known in cybercrime circles as a “group for group,” a contest aimed at proving their control over cryptocurrency holdings. The entire exchange was recorded.
8/ 0xd8bc is linked to entries of more than $63 million from alleged victims and government foreclosure addresses in Q4 2025.
December 2025
$13.5 million
0x77a722bf33787c3512d0f4fc36412140057f4223
$15.4 million
0xf51b044f998277b17467cd713d72b403e16fad48
November 2025
3 million dollars
TACZPnbg2Fi2ppC3cGxQxZb95SqwAZVAw9
1 million dollars… pic.twitter.com/3BjyLGXYhP-ZachXBT (@zachxbt) January 23, 2026
In part of the recording, John shares a screen of an Exodus wallet showing a Tron address containing approximately $2.3 million. In another segment, another $6.7 million in ether is transferred live to an Ethereum address later identified as 0xd8bc. By the end of the trade, approximately $23 million had been consolidated into this wallet. ZachXBT said the footage demonstrated John’s control over multiple addresses.
In tracing the funds, ZachXBT linked 0xd8bc to another wallet, 0x8924, which John allegedly confirmed he owned. This address received 1,066 wrapped ether (WETH) in November 2025 from 0xc7a2, a wallet that ZachXBT says received $24.9 million in March 2024 from a US government address linked to the Bitfinex hack seizure. There is about $18.5 million left in that portfolio, he said.
ZachXBT added that 0xd8bc received more than $63 million in additional revenues at the end of 2025 from addresses associated with alleged victims. On Thursday, the wallet received an additional 4,170 ETH, worth approximately $12.4 million, from a centralized exchange.
The case draws parallels to a $243 million social engineering hack in 2024, where the two bad actors posed as Google support staff before flaunting their ill-gotten gains on social media. Miami police eventually arrested both suspects.
