KobaXBT

Scam recovery advocate | Digital fraud investigator. Email ✉️ [email protected]

[KobaXBT @kobaxbt]

@DKricheff @brian_armstrong DM.

[Kobahacks Recovery @kobahacks]

Our head service department kobatech are doing grate works world wide

[Kobahacks Recovery @kobahacks]

Not everything needs to be rushed or handled without clarity.

If you’re reviewing a financial or personal matter, it’s important to have a calm, structured approach with someone who understands the process.

No pressure. Just a private conversation to help you understand your options.

[KobaXBT @kobaxbt]

8/ Between March and April 2026, insiders deposited 226M LAB—representing a substantial portion of the circulating float—into Bitget deposit addresses. Those balances remained largely inactive until a few days ago, when 100M LAB was withdrawn, an event that later received significant attention across Crypto Twitter.

Our analysis suggests that an unidentified market maker operating through Chinese exchanges may have received a portion of this supply and is following a pattern similar to what has been observed in RIVER, RAVE, SIREN, MYX, and SKYAI.

The majority of spot trading activity for these heavily manipulated CEX-listed tokens appears to originate on Bitget, with Binance Perpetuals/Alpha and Gate also playing a role in the broader ecosystem.

Between May 11 and May 12, nearly 100M LAB (approximately $482M at the time) was withdrawn from Bitget and distributed across ten addresses:

0x2d81ef9a8c46596d333c1294ae2aaccf61593e5a
0xef80a2b120925c3aa794c6dcfd999fdecbfec01e
0x7db446e489b08f3f33354fc233e0022bc59c4032
0xf05ced86edc1857c977b70728f3c330e9e89b151
0x82fc0bc04c4326b679bf9dbdc60d653062bea31a
0x093eb813f3c7082cd816bbb393ae399586a99335
0x0d95e8d26dd5ca98026970d20c05235a324751d0
0xbcf0771e983af09a67f10812fb336731e4c5d688
0x10e8163d1ef9098e942dbf2d1ff2127a4abf33b9
0x7c62af1a36a24765043cfde72c85bc1203d807b7
Bitget deposit addresses:
46M LAB — 0x6593aa6c31c88397c37f71259625ec92fe4ee0bf
50M LAB — 0xdd77bfbdc11cd37fd255ae35a4ac39df1f9d570a
60M LAB — 0xe39f91a0daffc5547ada79a09be30b8556f7dfba
40M LAB — 0x77156a0a621d2ac7a075c0ac3172707c2e4aa191
30M LAB — 0xd425c56f2eb64646fde7f3c53d7584e60e62fc94
Since the LAB TGE, there have been very few transfers exceeding $150K that cannot be linked back to insider-controlled wallets. This further supports our earlier conclusion that insiders continue to control more than 95% of the token supply.

[KobaXBT @kobaxbt]

7/ We identified that one of the signers across multiple LAB team multisig wallets was funded by an insider who is linked on-chain to the RIVER manipulation activity.

The same insider also received more than $12 million worth of RIVER tokens through two centralized exchange deposit addresses, further strengthening the connection between the wallets involved.

Signer address:
0xcEA722a1A812EbDFA5BBD8130531cF1D1956eBC9

[KobaXBT @kobaxbt]

6/ Since January 2026, we observed multiple OTC and private loan deals being offered across different channels. Mark, the co-founder, also publicly solicited OTC buyers inside a Telegram group.

Additional counterparties received structured deal terms via WhatsApp, including: loans at 5% monthly interest, OTC allocations at 60% discount with a 5-month cliff, “guaranteed discount” OTC at 25% recalculated monthly, and a separate tranche offering a 20% guaranteed discount.

The most recent structure we reviewed was a KOL Capital pitch offering an 80% discount, with 50% unlocking on August 14 and the remaining 50% on September 15. The terms also required KOLs to post multiple times in support of the project prior to unlock, with non-compliance leading to blacklisting.

These arrangements effectively create hidden supply unlocks that are not visible to retail participants. As price has increased, OTC discounts have expanded in parallel.

[KobaXBT @kobaxbt]

5/ We identified that the borrower wallet used in the LAB loan contract (0xf09c) is the same address used for public LAB buybacks. The same wallet is also linked on-chain to 0x3185, a borrower address involved in a separate loan issued through Wildcat.

Funds tied to LAB activity have also been traced flowing into exchange accounts associated with Vova. These same accounts previously received deposits connected to Eesee before LAB existed, with additional links through ENS activity and NFT holdings.

The overlap between personal and operational funds makes it difficult to clearly separate business activity from individual-linked wallets.

Bybit deposit address:
0x2f7fd9678bd7d89da6a4ffd7d612d919ea813e30
Gate deposit address:
0x3b5341b94dee91ec1a84470463a411c0ab5ed70c

[KobaXBT @kobaxbt]

4/ We obtained one of several loan agreements that were reportedly offered privately, carrying a 7.5% monthly interest rate over a six-month term. The borrower listed in the agreement is The Lab Management Ltd., a BVI-registered shell company, signed by Vladimir (Vova) Sadkov in his capacity as director.

Under the contract terms, any default would allow repayment to be made in LAB tokens at the prevailing market price rather than in the original loaned asset.

Borrower address:
0xf09C19328C26088053a8c9CfB982427bafF2Bd0b
While the document reviewed was a draft agreement from Q1 2026, a source familiar with the arrangements confirmed that interest payments were made under similar loan structures.

[KobaXBT @kobaxbt]

3/ The LAB team reportedly altered the terms of the Legion public sale, extending the vesting cliff from 3 months to 9 months after the sale had already taken place. Evidence of the change was shared in an email received by a Legion participant.

We also identified multiple public complaints from creators who claim they have been waiting months to receive payments for completed marketing campaigns, with little to no communication or clarification from the team regarding the delays.

[KobaXBT @kobaxbt]

2/ LAB was launched by Vova Sadkov and Mark as a trading platform, with its token generation event taking place in October 2025. The founders were previously behind Eesee ($ESE), a project that many investors felt was abandoned after the team's focus shifted elsewhere.

One of the biggest concerns is the lack of transparency around LAB's token distribution. Major data providers report conflicting circulating supply figures, while the project's own documentation provides no meaningful breakdown of token allocations.

The project is backed by a number of well-known industry participants, including Lemniscap, OKX, Animoca, GSR, Gate, KuCoin, Mirana, and Amber. Notably, several of these entities are also exchanges where LAB is actively traded.

Based on our analysis of on-chain activity and wallet distribution, insiders likely retain control of more than 95% of the current token supply.

[KobaXBT @kobaxbt]

1/ We investigated the opaque private loan and OTC arrangements, unilateral vesting changes, market maker involvement, unclear circulating supply, and the concentration of more than 95% of the token supply that helped drive $LAB to a $6B FDV.

Our findings highlight why LAB has become a prime example of the issues surrounding the current retail extraction model on major centralized exchanges.

[KobaXBT @kobaxbt]

Thirteen regulators across five continents publicly issued fraud warnings regarding DSJ and BG.

On April 23, 2026, U.S. law enforcement seized one of BG’s domains, bgwealthsharing[.]com.

[KobaXBT @kobaxbt]

The $150M+ DSJ Exchange (DSJEX) / BG Wealth Sharing Ponzi operation reportedly collapsed last week. Between April 27 and May 3, more than $92 million was allegedly moved across multiple blockchains in an effort to hide the movement of funds and complicate tracing.

[KobaXBT @kobaxbt]

DSJ / BG has been running since 2025, advertising daily returns between 1.3% and 2.6%, while also offering referral commissions and rank-based bonuses.

DSJ was presented as the trading platform, while BG acted as the investment group behind the operation.

A fictitious CEO named Stephen Beard was used as the public face of the scheme, while domains and hot wallets were regularly rotated to evade law enforcement detection.

Recruitment campaigns and fake trading signals were distributed through groups on BonChat.

[KobaXBT @kobaxbt]

An investigation into how Greavys (Malone Iam), Wiz (Veer Chetal), and Box (Jeandiel Serrano) stole $243M from a single person last month in a highly sophisticated social engineering attack

[KobaXBT @kobaxbt]

Meet Aleksandr (Aleks) Khinkis, a Russian OTC broker who has allegedly helped a ransomware group launder $4.7M+ via a single crypto exchange account since July 2025, across three suspected ransom payments totaling 796 BTC.

[KobaXBT @kobaxbt]

Update: Three hours ago multisig 0x53d7 linked to the RAVE initial distribution which I flagged above sent ~23M RAVE ($23M) to two Bitget deposit addresses and the price dropped 40% from $1 to $0.6.

Deposit addresses 0x26aC542f5a04D574580881723224DAcD1EDB9B45 0x64D6E91D0bd9cB7be44E1e627264539493f73c2b

[KobaXBT @kobaxbt]

Update: Here’s 5 more X accounts operated by the same entity that follow the pattern.

jihooncrypto - 3846842218 seongwooiq300 - 1780190681756999680 iq300min - 2868821473 raqeem_saudi - 1238542124129320960 mrcryptowhalecn - 2707360046

(All accounts already have me blocked)

[KobaXBT @kobaxbt]

Meet Haby (Havard), a Canadian-based threat actor allegedly responsible for stealing more than $2 million over the past year through Coinbase support impersonation and social engineering scams.

The stolen funds were reportedly spent on rare social media usernames, bottle service, and gambling.

[KobaXBT @kobaxbt]

Community notice: In January, Ledger reportedly faced another customer data breach through its payment processor Global-e, exposing personal details such as customer names and other contact information.

Customers were notified of the incident after the breach was discovered.