Prominent blockchain investigator ZachXBT has shared a striking case of an alleged Indian crypto mule who reached out to him directly for help, only to inadvertently expose his own involvement in stolen funds. Earlier this week, a follower using the X handle @Amankesar11 (name: Aman Kesar) sent a direct message (DM) from his personal account to ZachXBT. He complained that 5.73 BTC (approximately $475,000) belonging to him had been “unjustly” frozen by the crypto exchange Changelly since a transaction in March 2025.
A short story about Indian scammers who called the cops on themselves:
Earlier this week a follower DM’d me from his personal account complaining that 5.73 BTC ($475K) of his was ‘unjustly’ frozen at Changelly in Mar 2025.
So I went and plotted the Bitcoin transaction in my… pic.twitter.com/gZxM4dRCW3
— ZachXBT (@zachxbt) June 19, 2026
The individual insisted the funds were legitimate. He shared email screenshots with Changelly’s compliance team and even claimed to have filed a police complaint in India regarding the frozen funds. ZachXBT decided to investigate the transaction. Using his compliance and on-chain analysis tools, he traced the Bitcoin inflows.
The funds were traced back to multiple social engineering thefts targeting American victims, particularly elderly individuals. These scams typically involved impersonation tactics through US exchanges, Bitcoin ATMs, Cash App, Robinhood, Coinbase, and similar platforms. ZachXBT noted that the broader cluster of high-confidence thefts linked to this network has stolen over $1 million from victims since 2025, with several being elderly.
During the conversation with ZachXBT, the suspect’s explanation shifted repeatedly. He first claimed it was a legitimate swap, then said it was a loan from his boss, and later alleged his boss had invested in Bitcoin from 2014-2015 through a US contact. In December 2025, he filed a police complaint in India (case number 3207-P/2025) and shared screenshots of emails sent to Changelly’s compliance team protesting the delay.
The allegations also mirror patterns seen in other cross-border crypto investigations. ZachXBT recently uncovered a network allegedly facilitating illicit remittances and crypto payments linked to North Korean actors, demonstrating how intermediaries and mule accounts can be used to move funds across jurisdictions.
ZachXBT suspects that @Amankesar11 is acting as a money mule for his boss, ‘Mr. Parveen’. The addresses are connected to a group involved in receiving and moving illicit funds.
This case highlights how stolen cryptocurrency moves across borders through money mules and how exchanges like Changelly freeze suspicious funds during compliance checks. The 5.73 BTC remains frozen at Changelly. ZachXBT gave a clear warning: “While you can message me for help and I’ll respect your privacy, at least use common sense and don’t contact me with stolen funds.
The case follows a broader trend of asset freezes linked to blockchain investigations. Earlier, ZachXBT reported that approximately $12.6 million connected to the Zama project was frozen after Circle blacklisted an Ethereum address, underscoring the growing role of compliance controls in recovering or restricting suspicious funds.
