ZachXBT Changelly Scam: Mule Reports Own Frozen Funds

High attention and emotional sentiment detected.

ZachXBT shared the story on June 19, 2026. According to him, a follower using the account @Amankesar11 sent the DM earlier in the week. So a complaint about a Changelly freeze quickly became a public case study in self-incrimination.

How the ZachXBT Changelly Scam Came to Light

The complaint looked simple at first. The follower said Changelly froze 5.73 BTC, worth about $475K, after a swap to USDT on March 11, 2025. Since then, he claimed, the funds sat under review despite submitted KYC documents.

The dollar figure tracks the market at the time. Back in March 2025, Bitcoin traded near $83,000, so 5.73 BTC came to roughly $475K. By June 2026, the same coins were worth less, since BTC had slipped toward the low $60,000s.

So ZachXBT pulled the Bitcoin transaction the follower shared. That single txid became the thread that unraveled everything. Using on-chain and compliance tools, he mapped where the coins came from.

The inflows traced back to illicit sources, according to ZachXBT. He found social engineering thefts that targeted Americans, mostly through US exchanges and Bitcoin ATMs. Operators such as Bitcoin Depot, Athena Bitcoin, and Coinhub appeared in the trail, alongside outflows from Coinbase, Robinhood, Strike, and Cash App.

How the Stolen Funds Reached US Victims

The flow followed a familiar route. Scammers socially engineer victims, then push them to buy crypto. After that, the victims send funds through Bitcoin ATMs or withdraw from exchanges like Coinbase and Cash App.

From there, the coins hop toward off-ramps that the operators control. Clustering tools then group addresses by shared spending patterns. So investigators can link many separate victim deposits to one set of wallets.

The ATM leg matters most here. When a victim feeds cash into a Bitcoin ATM, the machine sends coins to an address the scammer controls. Because each kiosk logs the deposit on-chain, the trail stays public long after the cash changes hands. As a result, one DM can reopen months of older transfers.

The Story That Kept Changing

The follower’s explanation shifted with each message. First, he called the money a loan. Then he said his boss sent it. Later, he claimed the boss had invested in Bitcoin during 2014 and 2015 through a friend in the US.

The supporting proof raised more questions. ZachXBT noted bank statements under a different name and location. When he pressed on the details, the answers kept moving.

The shared emails painted a similar picture. In them, the follower complained about months of delay and described borrowing 16,200 USDT from a friend. Yet the documents never pointed to one consistent owner.

Reporting Stolen Funds to a Crypto Detective

Here is the part that turned heads. In December 2025, the follower claimed he filed an Indian police report over the frozen funds, case 3207-P/2025. So he brought a paper trail to the one investigator most likely to read it closely.

By DMing ZachXBT, the party handed over fresh data points. Names, emails, screenshots, and addresses all became searchable. As a result, ZachXBT could link them back to the same on-chain cluster.

He shared two wallets tied to the account. Both the Bitcoin address and a linked Tron address fed the analysis. In effect, the complaint mapped the operation for him.

A Cluster Tied to Elderly Victims

The broader address cluster looks far larger than one swap. According to ZachXBT, it has taken more than $1M from victims since 2025. Several of those victims were elderly, flagged under an “Elderly Fraud Case 2025” label.

The on-chain graph in his post shows the flow clearly. Funds from victim sources, including multiple ATMs and US exchange withdrawals, converged on India-linked addresses. ZachXBT tagged them to a boss he calls “Mr Parveen” in New Delhi.

So he concluded that @Amankesar11 appears to be a mule rather than the owner. That remains a suspicion based on the on-chain trail, not a court finding. Still, the pattern matches operations he has documented before.

Did Changelly Get the Freeze Right?

The follower called the freeze unjust. Yet the analysis suggests Changelly’s hold did its job. Because the service runs AML and KYC checks, it can flag large or suspicious swaps for manual review.

Changelly’s published AML and KYC policy allows holds while it verifies the source of funds. Those reviews can last weeks or months, according to the company’s guidance. In this case, the freeze sat on coins later tied to theft.

Changelly has not commented on this specific case. The accused party has not responded publicly either. So the full picture still rests on ZachXBT’s account.

What the ZachXBT Changelly Scam Case Leaves Open

Several questions remain unanswered. The real identities behind “Aman Kesar” and “Mr Parveen” are still unknown. Nobody has independently verified the police report, and the current status of the funds is unclear.

The lesson, though, is blunt. As ZachXBT put it, you can message him for help, but you should not contact him with stolen funds. For anyone tracking crypto crime, this ZachXBT Changelly scam thread is a fresh reminder that the chain remembers.