ZachXBT’s latest investigation doesn’t start with stolen passwords or a clever exploit, it begins with five men breaking into someone’s home.
Reading through it, what struck me isn’t just the money, it’s how casually the alleged trail leads back to someone who was apparently still posting flex videos and Snapchat screenshots weeks after the attacks happened, seemingly unaware, or unbothered, that the on-chain trail he was leaving behind was this easy to follow.
Two Violent Robberies In The Same French Spring
According to a new investigation published by on-chain researcher ZachXBT, two separate home invasion robberies took place in France within days of each other in April 2026, together netting roughly $667,000 in stolen crypto.
The first, on April 17, allegedly involved five attackers who violently robbed a victim of approximately 7.2 BTC, worth around $557,000 at the time, an incident serious enough that several people involved were reportedly sent to the hospital. The stolen funds were allegedly moved from a wallet beginning bc1qrdq5acl9nw4gt3cjte2629lw9qcg9xxkf3x02k.
Three days later, on April 20, a second incident allegedly unfolded, with multiple attackers reportedly tying up and threatening a different victim in France until they surrendered around $110,000 in crypto, moved out of an address beginning 0x3000d2a2. Two attacks, three days apart, both violent, both allegedly ending in the same laundering pipeline, which is exactly the pattern that reportedly caught ZachXBT’s attention in the first place.
Following The Money Through Bridges And Exchanges
What I find genuinely impressive about this kind of investigation is how mundane the actual laundering process looks from the outside, right up until it isn’t. According to the thread, funds from the April 17 robbery were allegedly bridged from Bitcoin to Ethereum through the cross-chain platform Chainflip, after which roughly $317,000 was allegedly funneled through three separate KuCoin deposit addresses. ZachXBT says a timing analysis of the withdrawals tied those deposits back to a single consolidation address, 0xe744d8890792eb4b51ac6565e3d409076b62b302, with a further batch of funds allegedly converted into Monero through two instant exchanges and a platform called Wagyu, a method commonly used specifically because Monero’s privacy features make it far harder to trace afterward.
The April 20 robbery allegedly followed a similar path. Stolen funds were bridged to Ethereum, and around 46 ETH, worth roughly $107,000, was allegedly laundered through another KuCoin deposit address. ZachXBT says that withdrawal, too, traced back to the exact same consolidation address, 0xe744, tying both robberies to the same alleged operator. From there, $108,000 was reportedly moved out of that consolidation address to a separate wallet that swapped ETH for USDT, a transaction ZachXBT says was funded for gas fees using the April 20 victim’s own compromised address, a small detail that, if accurate, is a genuinely damning link between the two cases.
A $93,000 Freeze And A Direct Line To Law Enforcement
Tracing stolen funds is one thing. Actually freezing them is another, and this is where ZachXBT’s investigation moves from documentation into real consequences. According to the thread, ZachXBT reported the wallet movements directly to Tether and to law enforcement, which reportedly resulted in a freeze of 93,000 USDT at address 0x47967fe27f07fb54e9f4daa2541c0f75e27ddde7. That’s not a small technical footnote, it’s money tied to two violent robberies that’s now allegedly sitting frozen and out of reach rather than fully laundered and gone.
I think it’s worth pausing on what that actually represents. A meaningful chunk of the total stolen amount, roughly 14% of the combined $667,000, has reportedly already been clawed back before ever reaching a cash-out point, which is a genuinely rare outcome in crypto crime cases that usually get written off as unrecoverable within days.
The Telegram Channel That Allegedly Tied It All Together
The identification piece of this investigation reportedly runs through a Telegram channel called “EMPIRE,” allegedly operated by someone going by M1llionz. According to ZachXBT, M1llionz posted multiple Exodus wallet screenshots to that channel, wallets that allegedly went on to receive roughly $84,000 directly traceable to the two home invasion incidents. One wallet, posted publicly on March 12, reportedly later received 1.44 ETH from the April 17 robbery. A video posted on June 8 allegedly showed the same individual sending 22.37 ETH sourced from the April 20 incident. And on June 11, two further posts, a Snapchat conversation screenshot and an Exodus wallet activity screenshot, allegedly both showed the same address, which reportedly received roughly 12.28 ETH on May 9 directly from the consolidation address tied to both robberies.
ZachXBT’s investigation also describes M1llionz as someone who has openly promoted bank fraud services within the same Telegram channel, while posting a lifestyle built around hotels, flights, cars, and designer goods, all while consistently blurring his own face in photos, a detail that reads less like caution and more like someone who understood exactly what he was risking by posting at all. Through open-source research, ZachXBT says he identified several aliases potentially tied to the same persona, including names distinct from the M1llionz handle itself, alongside multiple email addresses linked to associated social media accounts.
What Happens Next, And Why It’s Not Simple
According to ZachXBT, M1llionz has gone noticeably quiet across TikTok and Telegram in recent weeks, and has since set his TikTok account to private, a shift that, fairly or not, tends to read as someone who’s realized they’re being watched. The investigation didn’t stop there either, ZachXBT says he’s since identified two further attacks sitting within two transaction hops of the same alleged operator’s OTC addresses, suggesting this case may extend well beyond the two robberies already documented.
ZachXBT was candid about the limits of this kind of work too. He described home invasion robberies as among the cases he prioritizes most, and said he’s frozen funds across multiple seven-figure incidents spanning both the US and EU, with several additional perpetrators identified in cases he hopes to eventually make public. But he was equally direct that the sensitive nature of these investigations often means he can’t publicize findings as quickly as he’d like, a genuinely understandable constraint when publishing prematurely could tip off a suspect or complicate an active law enforcement case. He also offered a measured take on the French system specifically, noting that French law enforcement generally does care about helping victims and solving these cases, even as inefficient laws sometimes get in the way of turning that effort into real outcomes.
What strikes me most, sitting with this whole thread, is how much of it comes down to ordinary carelessness rather than some elaborate cover-up. Bridging funds through Chainflip, cashing out through KuCoin, converting to Monero, all of that is genuinely sophisticated laundering technique. But posting wallet screenshots to a public Telegram channel, and a Snapchat conversation confirming control of one of them, is the kind of self-inflicted evidence that no amount of on-chain sophistication can undo.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!