Crypto sleuth ZachXBT has uncovered how $28 million was stolen from Bittensor. In a recent post, he said that he followed a trail that led through anime NFT trades and traced the funds back to a former Bittensor worker after unmasking hidden transactions made through the Railgun crypto mixer.
According to ZachXBT, 32 TAO holders lost funds between May and July 2024 after a malicious PyPi package caused private key leaks. Consequently, the Bittensor network halted operations on July 2, 2024, while developers investigated the breach. He started tracing the stolen TAO tokens that were moved to Ethereum and later exchanged for Monero (XMR) using quick-swap platforms.
1/ An investigation into how I identified one of suspects tied to the $28M Bittensor hack from 2024 by identifying anime NFT wash trades linked to a former employee and earned a whitehat bounty for my efforts. pic.twitter.com/2utJ5AGtZy
— ZachXBT (@zachxbt) October 15, 2025
Following the crypto trail
ZachXBT followed the stolen funds to a wallet known as 0x09f, which moved about $4.94 million into Railgun in June 2024. He identified three wallets that extracted the funds by comparing the quantity and timing of payments and withdrawals. The trail showed 1,246 ETH, 276,000 USDC, and 19.8 WETH were shifted to Avalanche and then back to Ethereum using the Synapse Bridge.
The investigation took a surprising turn when address 0x1d7 purchased four Killer GF NFTs for 18.64 ETH, grossly overpaying the floor price. Moreover, related wallets 0x0bc7 and 0x5e9c exchanged NFTs between themselves using stolen funds, showing clear wash trading patterns. These unusual trades connected the theft to a wallet tied to “Rusty,” a person using the alias otc_rusty, who once worked as an Opentensor engineer.
Real world links and legal fallout
ZachXBT revealed that Rusty (Ayden B) later admitted ownership of the identified wallets during a civil lawsuit, though he denied involvement in the hack. Another individual, Jon L (0xJones), also became a suspect after deleting messages and deactivating his accounts post-incident.
“It’s extremely rare to see exploits or hacks involve NFT wash trading,” ZachXBT noted, emphasizing how coordinated the addresses appeared. Moreover, he said law enforcement could move forward with criminal proceedings based on these findings.
ZachXBT’s findings show that in crypto, digital trails can still reveal the truth behind hidden transactions. The case reveals that careful tracking and transparency help uncover complex hacks.