Cybersecurity researcher ZachXBT challenges prior arrest, pointing to new evidence in high-profile NFT theft.
The world of non-fungible tokens (NFTs) has been rocked again after prominent blockchain investigator ZachXBT revealed that law enforcement may have detained the wrong individual in connection with a 2022 theft involving Bored Ape Yacht Club (BAYC) NFTs. The stolen assets, worth over $1 million at the time, were part of a sophisticated scam that left the community rattled and a security expert under scrutiny.
Now, with fresh forensic evidence surfacing, questions loom large over how the investigation was handled and whether the real perpetrator has remained untouched until now.
Wrong Man in Custody
According to a statement posted on social media platform X on May 9, ZachXBT claims that U.S. authorities apprehended the wrong individual, Sam Curry, a former security researcher at Yuga Labs, the parent company behind BAYC. The incident, dating back to late 2022, saw 14 high-value NFTs stolen in what appeared to be a coordinated cyberattack.
Law enforcement reportedly used OpenSea server logs that revealed Curry’s home IP address and connected it to suspicious on-site activity. This led to his detention at an airport in 2023, a move that ZachXBT now calls a critical error.
In his post, ZachXBT clarified that Curry had been working on tracing the breach in his role at Yuga Labs and had interacted with malicious code embedded in the scam website’s JavaScript, a move misinterpreted as evidence of wrongdoing.
On-Chain Forensics Paints a Different Picture
Rather than stopping at the official version of events, ZachXBT took the investigation a step further using blockchain analysis tools. Through detailed tracing of Ethereum transactions, he tracked the movement of funds associated with the theft through Tornado Cash, a privacy-preserving crypto mixer often used to launder stolen funds.
The analysis ultimately led him to a wallet address he believes is connected to the real attacker. Further digging uncovered links to a now-deleted social media profile that could hold key evidence, including potential communication and behavioural patterns matching the time of the heist.
ZachXBT urged law enforcement to act on the digital trails he uncovered, recommending a full audit of the suspect’s online activity and associated blockchain wallets. He stressed the importance of accessing archived data from the removed social media profile before it is lost to time.
A Costly Mix-Up
The implications of the mistaken arrest are serious. Not only was a cybersecurity professional potentially defamed and disrupted in the course of his legitimate work, but valuable investigative time may have been wasted chasing a false lead. The fact that Curry’s interactions with the scam’s infrastructure were part of his effort to help Yuga Labs only deepens the concern.
This case exposes the risks of superficial digital forensics in crypto investigations, where context and intent can be easily misread. The misuse of server logs, in this instance, led to a dramatic misjudgment, raising eyebrows about the technical competence of investigative teams handling complex cybercrimes.
Bored Ape NFTs Still a Prime Target
First launched in 2021, the Bored Ape Yacht Club quickly rose to prominence as one of the most sought-after NFT collections in the world. Known for their quirky art style and exclusive community benefits, Bored Apes once traded for over $400,000 apiece at their peak. Though prices have cooled, individual NFTs still fetch upwards of $30,000 today.
The December 2022 breach, which cost collectors 14 Bored Apes valued at roughly $86,000 each at the time, served as a sobering reminder of the vulnerability in the Web3 ecosystem. Even as NFT projects strive to implement better safeguards, attackers continue to exploit weaknesses in both code and user behaviour.
ZachXBT’s intervention may just be the turning point this case needed. Whether authorities follow up on his lead remains to be seen, but the community is watching closely.
