Teen Gets Prison for $4.3M Crypto Machete Heist Cracked by ZachXBT

Key Notes

• Attackers accessed TLOxp, a restricted TransUnion database for licensed investigators, to locate the victim's home address.
• ZachXBT traced the perpetrators through leaked chat logs and surveillance photos, leading to their prosecution at Sheffield Crown Court.
• Compromised data lookup services have enabled eight to nine figures in crypto thefts and may be linked to multiple deaths.

A 16-year-old who used professional detective (skip-tracing) tools to orchestrate a $4.3 million cryptocurrency  robbery has been sentenced alongside two accomplices. Blockchain detective ZachXBT’s investigation led to the prosecution.

Three men armed with machetes forced a victim to transfer $4.3 million in cryptocurrency on June 18, 2024, per the victim’s public post . The attackers posed as delivery drivers to gain access.

Sheffield Crown Court sentenced the defendants on Nov. 7 with nearly all funds seized, according to ZachXBT.

How They Found Him

The perpetrator accessed TLOxp to locate the victim’s address. TLOxp is a TransUnion database restricted to licensed investigators that contains addresses, phone numbers, family connections, and property records, ZachXBT’s investigation revealed.

Chat logs showed the attackers conducted surveillance and sent photos of the victim’s door while holding a package marked “FRAGILE.” Messages referenced the database directly, with one attacker asking for the victim’s house or phone number and receiving the reply: “No, it was not listed in the TLO.”

The Database Problem

ZachXBT has stated that TLOxp’s compromised security has resulted in eight to nine figures worth of thefts from Coinbase users. Criminals can pay less than $50 for lookups on nearly any US citizen through Telegram channels. He warned the database may have “directly resulted in multiple deaths” through robberies or swatting incidents.

Data breaches increasingly enable physical targeting. The Coinbase data breach exposed customer addresses, while Bitcoin ATM operator Byte Federal lost data on 58,000 users including photographs and physical addresses. Private key compromises accounted for 43.8% of crypto theft in 2024, according to Chainalysis.

Joseph Cox of 404 Media documented how hackers steal law enforcement officer identities to pass verification checks. Cox reported that criminals advertise database access for as little as $15 per search in Telegram channels.

The Investigation

ZachXBT began investigating after the victim tagged him on June 18. He acquired chat logs and surveillance photos, then identified the primary suspect through a leaked bail document showing an unredacted birth date of Sept. 23, 2007.

Police officials and investigators are starting to take crypto crime seriously. In early 2025, South Korea upgraded its crypto crime task force into a permanent unit after seizing $97.5 million in assets.

The case demonstrates successful cross-border collaboration between blockchain investigators and law enforcement. At the time of completing his part of the investigation, ZachXBT advised crypto holders to avoid sharing personal information about holdings and to monitor personal data exposure online.

next