Hacker John flaunted $23M in crypto linked to U.S. government seizures after being provoked online.
Wallets hold Ethereum, altcoins, and stablecoins, showing both risky bets and safer holdings worth over $1M.
Blockchain tracking exposes thefts, giving investigators a clear path to trace stolen funds and catch criminals.
A dramatic crypto showdown happened online, exposing $23 million in stolen funds connected to U.S. government seizures. The incident involved a hacker named John, who’s reportedly linked to over $90 million in thefts, and got tricked into showing off his wallets.
According to blockchain investigator ZachXBT, John engaged in a “band for band” flex with another actor, Dritan Kapplani Jr., which led to public exposure of his holdings. The wallets displayed significant transfers, connecting them to prior high-profile thefts, including funds tied to the 2024 Bitfinex U.S. government seizure.
The wallets also holds a variety of other cryptocurrencies and stablecoins, showing a mix of risky and safer bets. In the past 24 hours, huge movements took place. For example, 2.65 million FTM tokens (about $210K), 1,011 ETH (nearly $3 million), and 328,472 NEXO tokens (around $306K) were transferred. Smaller but still significant moves included 744,213 KNC tokens ($158K) and some BUSD stablecoins. This shows the wallet’s owner actively manages a wide range of digital assets.
Tracing the Wallets and Their Origins
ZachXBT’s investigation traced John’s wallet address, 0x89..0Bec, holding over $1.08 million in mixed assets. The largest portions are NEXO (~$307,790) and Fantom (~$261,400), followed by FTX Token (~$247,870) and KNC (~$157,930).
The portfolio also includes minor allocations in tokenized gold and REPV2, balancing risk and stability. Moreover, on-chain analysis shows that John controlled multiple addresses, consolidating roughly $23 million in one wallet post-flex.
ZachXBT also traced the wallets back to past U.S. government seizures. One address, 0xc7a2, received $24.9 million from the Bitfinex-related seizure in March 2024. John then moved large sums between his wallets, 0x8924 and 0xd8bc, with over $63 million coming from suspected victims in late 2025. Just today, he also received 4,170 ETH (about $12.4 million) from MEXC, showing that funds are still actively moving across platforms.
Consequently, the public exposure provides a roadmap for potential law enforcement action. ZachXBT emphasized that “the proof of ownership for these wallets makes it an easy future case for law enforcement.” Furthermore, John’s quick removal of NFT usernames and Telegram screen name changes highlights attempts to obscure identity post-exposure.
The post Crypto Heist Exposed: $23M Wallet Linked to U.S. Seizures appears on Crypto Front News. Visit our website to read more interesting articles about cryptocurrency, blockchain technology, and digital assets.
