PublicAML
← News and reports

Tech support phishing report VR-F1AD2F0C

Investigator report

Filed by a vetted PublicAML investigator rather than by an anonymous reader. The account itself has not been independently re-checked.

The addresses below carry a risk label from this report, except those marked victim or mentioned - naming one of those is not an accusation and does not move its score.

Type
Phishing
Reported as
Tech support phishing
Chain
ethereum
Reported by
DenysInvestigator
Incident date
Aug 19, 2024
Published
Sep 9, 2026

What happened

Wallet attributed to Veer Chetal ("Wiz"/"Swag") in the $243M social-engineering theft of 19 August 2024, published by ZachXBT on 19 September 2024. The case: three actors — Malone Iam ("Greavys"), Veer Chetal ("Wiz"/"Swag") and Jeandiel Serrano ("Box"/"John") — socially engineered a single victim out of 4,064.3769 BTC (~$238M at the time, $243M across all assets). ZachXBT's investigation contributed to multiple arrests and to millions being frozen; a later superseding indictment confirmed the arrest of a further participant in Dubai. This address appears in ZachXBT's OSINT chart labelled "Wallet Address" for Veer Chetal. PublicAML read it out of that chart and verified it on-chain: an externally owned account, 109 transactions, activity clustered in early September 2024 — days after the theft — and our engine already scored it 40 on indirect exposure, tracing an inbound path from a mixer two hops out. Two other addresses in the same chart were deliberately NOT reported. PublicAML's own data classifies 0x6ef702810a1A221682FdEBCbd353e6E249e4248e and 0xe8Bde8169a2f6eD6855201AFcAc7Be05a5639B25 as centralised-exchange hubs. They are labelled "Wallet address" in the chart, but flagging an exchange hub would brand an intermediary rather than an actor. The seizure address published in a later update (0xb37d617716e46511E56FE07b885fBdD70119f768) is likewise excluded — it belongs to the authorities holding recovered funds. Category note: filed under tech-support phishing as the closest available label; the actual method was voice-based social engineering impersonating exchange and platform support. Source: https://x.com/zachxbt/status/1836752923830702392. Filed by PublicAML from public reporting plus our own verification, not by a victim of the incident.

Addresses named in this report

Named here and believe it is wrong? Open the address page above and use the flag on the assessment. Every dispute is read.

Tech support phishing report VR-F1AD2F0C | PublicAML