Blockchain investigator ZachXBT published an X thread on August 24 detailing how he traced funds stolen in two violent home invasions in France to a suspected cybercriminal using the aliases M1llionz and RichMilly666, with his investigation contributing to the freeze of more than $93,000 in USDT.
The two attacks took place on April 17 and April 20 and resulted in $667,000 in cryptocurrency being stolen. The stolen assets from both incidents eventually converged at the same Ethereum address after moving through cross-chain services and KuCoin.
Part of the funds were traced to wallets the investigator linked to M1llionz through screenshots and videos posted on Telegram. He reported the fund movements to Tether and law enforcement, resulting in 93,507 USDT being frozen at an Ethereum address on April 24.
The first attack occurred on April 17, when ZachXBT said five people carried out a home invasion against a victim in France.
The attackers stole 7.2 BTC worth $557,000 at the time, while several people were hospitalized following the attack. An image shared by ZachXBT showed a message from an apparent victim who said the attackers assaulted them for two hours and that another victim remained hospitalized with injuries.
ZachXBT traced most of the stolen bitcoin to Chainflip, a protocol that allows users to swap assets across different blockchains. He said the assets were converted from BTC to ETH before $317,000 was sent through three KuCoin deposit addresses.
Another portion of the stolen assets was converted into Monero through two instant exchanges and Wagyu, according to his investigation.
Three days later, on April 20, attackers targeted another victim in France. ZachXBT said the attackers tied up and threatened the victim until they surrendered $110,000 in cryptocurrency.
He traced about 46 ETH worth $107,000 from the second robbery to another KuCoin deposit address.
Those funds also eventually reached the same consolidation address linked to assets from the April 17 robbery.
French media separately reported a crypto-related home invasion in Ploudalmézeau, Finistère, on April 20 in which five members of a family were tied up at their home. However, public reports put the losses in that case at €700,000, and it is unclear whether it is the same April 20 attack traced by ZachXBT.
ZachXBT said $108,000 was later transferred from the consolidation wallet to another Ethereum address, where ETH was swapped for USDT.
He found another connection to the April 20 robbery during that transaction. According to ZachXBT, the address performing the swap received gas funding from an address belonging to the April 20 victim.
ZachXBT said he reported the fund movements to Tether and law enforcement. Tether subsequently froze the USDT.
On-chain USDT blacklist records show that the exact address was blacklisted on April 24 with 93,507.51 USDT.
The action occurred four days after the second robbery and four months before ZachXBT publicly disclosed his investigation.
Tether can prevent USDT held at specific addresses from being transferred by adding those addresses to its blacklist. The stablecoin issuer has previously said it works with law enforcement to freeze addresses associated with suspected criminal activity.
ZachXBT attributed part of the laundering activity to M1llionz after comparing the blockchain transactions with wallet information the individual posted on social media.
According to ZachXBT, M1llionz operated a Telegram channel called “EMPIRE,” where he posted screenshots and videos from Exodus, a self-custody crypto wallet. ZachXBT said wallets shown in those posts received $84,000 directly from the two robbery cases.
One of the strongest links predates the robberies. M1llionz posted an Exodus wallet address on March 12, and that wallet later received 1.44 ETH connected to the April 17 robbery.
On June 8, M1llionz posted a video showing himself sending 22.37 ETH that ZachXBT traced back to funds from the April 20 incident.
ZachXBT identified another wallet through two posts on June 11. He said a Snapchat conversation and an Exodus wallet screenshot both displayed the same address, indicating control of the wallet.
That address had received 12.28 ETH on May 9 from the consolidation address that ZachXBT linked to proceeds from both robberies.
The investigator also accused M1llionz of advertising bank fraud services through the Telegram channel while posting images of hotels, flights, cars, and designer goods. A TikTok profile associated with the M1llionz name similarly showed luxury travel, vehicles and clothing.
0 Comments
1/ Meet M1llionz (RichMilly666), a French cybercriminal allegedly laundering assets from two violent home invasion robberies in France in April 2026 that netted $667K total, with a history of openly posting about bank and retail fraud on social media. My work has led to a $93K Show more
