According to @lookonchain, a threat actor named John was baited into a “band for band” flex and live-shared his wallets. According to @zachxbt’s on-chain tracing cited by @lookonchain, the revealed wallets are linked to large suspected thefts and include funds tied to a U.S. government seizure related to Bitfinex. According to @lookonchain, an Arkham Intel address 0x8924B17fD7512953949DE703a7C97484E66E0Bec was shared, which allows public tracking of holdings and transfers for trade monitoring.

According to @zachxbt, after the B4B was done John moved approximately 23 million dollars to the 0xd8bc address, and a recording shows John controls both wallets mentioned; @zachxbt added that additional linked addresses may be identifiable in the recordings and that he began tracing funds backward to verify their source (source: @zachxbt).

According to @zachxbt, the threat actor John (Lick) displayed control of a wallet holding about USD 23M that he ties directly to suspected crypto thefts exceeding USD 90M from the US Government in 2024 and to other unidentified victims from November 2025 to December 2025. Source: ZachXBT on X. The thread identifies a specific on chain wallet and timeframe, giving traders concrete parameters for watchlists, address labeling, and real time wallet tracking. Source: ZachXBT on X. Participants can reference the wallet and details in the thread to set alerts and enhance deposit controls around flows associated with the alias John (Lick). Source: ZachXBT on X.

According to @lookonchain, a newly created wallet FYqRpV spent 470,000 USDC to buy 10.19 million RALPH and, after the token crashed, sold the entire position for 114,861 USDC, realizing about 355,000 USDC in losses within hours. Source: Lookonchain on X.