Crypto Wallet Linked to “John” Exposed With Over $90M in Suspected Illicit Funds, Says ZachXBT

A cryptocurrency wallet allegedly controlled by a threat actor known as “John,” also using the aliases “Lick,” has been linked to more than $90 million in suspected illicit crypto funds, according to prominent blockchain investigator ZachXBT. The findings, shared in a detailed thread on X, suggest that part of the funds may be connected to assets previously seized by the U.S. government following the infamous Bitfinex hack.

ZachXBT revealed that John was recorded during an online dispute with another alleged cybercriminal, where he appeared to “flex” control over approximately $23 million in cryptocurrency. The argument escalated into what is known in cybercrime communities as a “band for band” challenge, a contest in which participants prove ownership of crypto holdings by moving funds live on-screen. The entire interaction was reportedly recorded and later analyzed.

In the footage, John is seen screen-sharing an Exodus wallet containing a Tron address with roughly $2.3 million. In another moment, about $6.7 million in ether (ETH) was transferred live into an Ethereum address identified as 0xd8bc. By the end of the exchange, around $23 million had been consolidated into that single wallet, demonstrating apparent control over multiple blockchain addresses.

Further blockchain analysis traced wallet 0xd8bc back to another address, 0x8924, which John allegedly confirmed as his own. That wallet received 1,066 wrapped ether (WETH) in November 2025 from address 0xc7a2. ZachXBT claims this source wallet received approximately $24.9 million in March 2024 from a U.S. government-controlled seizure address tied to the Bitfinex hack. As of now, about $18.5 million reportedly remains in that wallet.

Additionally, ZachXBT stated that wallet 0xd8bc received over $63 million in inflows during late 2025 from addresses linked to suspected victims. Most recently, the wallet received another 4,170 ETH, valued at roughly $12.4 million, from a centralized crypto exchange.

The case echoes a major $243 million social engineering crypto hack in 2024, where perpetrators impersonated Google support staff and later flaunted stolen funds online. That incident ultimately led to arrests by Miami police, highlighting how public displays of illicit crypto wealth can lead to real-world consequences.