In the ecosystem of crypto crime, the line between hunter and hunted is often a matter of timing. On March 14, 2025, on-chain investigator ZachXBT published a detailed exposé linking a 29-year-old woman, Greavysenberg (an alias widely used by the accused), to a series of sophisticated social engineering attacks that drained over $5 million from at least two victims. The funds were stolen from hardware wallets, centralized exchange accounts, and IRA platforms, then laundered through Monero and instant exchanges before landing in an Exodus wallet holding 631,000 DAI.
This is not a story about a zero-day exploit or a smart contract flaw. It is a story about how low-tech social engineering, combined with poor opsec and a compulsion for online validation, created a complete evidence chain for law enforcement and the broader crypto community.
Context: The Anatomy of a Social Engineering Attack
The attack vector was brutally simple. According to ZachXBT’s investigation, the primary threat actor—known as "The Caller"—would impersonate customer support representatives from Trezor, Coinbase, and BitcoinIRA. Armed with fake email addresses (like the Patricia Massie persona used to send fraudulent BitcoinIRA notifications) and a phishing panel infrastructure provided by another alias, "bled" or "harm," the caller would convince victims to grant access to their funds. The technical sophistication was low—no malware, no zero-days—but the psychological manipulation was high.
One victim lost approximately $1.2 million in BTC and ETH from a Trezor wallet. Another lost around $500,000 in BTC from a Coinbase account. The attacker then used instant exchanges to convert stolen funds into Monero, before swapping back into DAI. The final destination was an Exodus wallet address (0x8f…f6e2) that, as of the report, held 631,000 DAI, with the majority of stolen funds still untouched.
Core: The On-Chain Trail and the Bragging Problem
Here is where the case diverges from typical crypto crime. The attacker did not just steal funds; they documented the process. ZachXBT’s report includes chat logs, audio recordings, and social media posts from the accused, including a video where she flaunts a balance of 7.7K JITOSOL on a fake Ledger Live interface. The video was later found to be doctored to inflate the displayed amount, but the underlying behavior—public boasting about stolen wealth—was very real.
The on-chain analysis revealed a critical weakness in the attacker’s methodology. While Monero offers a degree of privacy, the instant exchange from Monero to DAI created a measurable exit point. ZachXBT traced the transaction to the Exodus wallet, where the funds sat untouched. This is a classic blind spot: the attacker assumed that mixing coins was sufficient, but the conversion to a stablecoin on a transparent chain created a permanent link.
From my experience auditing DeFi protocols and tracking institutional flows, I can confirm that this pattern is more common than most traders realize. The moment a privacy coin hits a centralized exchange or an instant swap, the anonymity is broken. The illusion of privacy is only as strong as the weakest exit point.
Furthermore, the attacker’s internal conflicts added another layer of exposure. According to the chat logs, she complained about a dispute over the split of stolen funds with another threat actor, John Daghita (known as "Lick"), who had previously been exposed by ZachXBT for stealing $46 million from the U.S. government. Daghita retaliated by leaking her real name to ZachXBT, accelerating the investigation.
Contrarian: The Real Vulnerability Is Not the Code—It’s the Process
The common narrative in crypto security is that the code is the weakest link. This case proves otherwise. The attack succeeded not because of a flaw in Trezor’s hardware or Coinbase’s smart contracts, but because of a flaw in the human trust layer. The attacker impersonated customer support, a role that is inherently trusted by users. The platforms themselves had no mechanism to verify that the caller was legitimate.
In my years of analyzing DeFi exploits, I have seen this pattern before: the most successful attacks are not the ones exploiting smart contracts, but the ones exploiting human psychology. The same principle applies to yield farming strategies—the highest returns are often the riskiest, and the most trustworthy protocols are the ones that systematically verify every interaction.
Another blind spot was the role of instant exchanges. The conversion from Monero to DAI should have triggered AML checks, but it did not. The funds flowed through without any friction, highlighting a systemic weakness in the crypto infrastructure: the gap between decentralized privacy tools and centralized compliance requirements.
Takeaway: The Accountability Gap Is Closing
The case has already triggered a response from law enforcement. The Connecticut State Police executed a search and seizure warrant, dated before the public disclosure, suggesting that the investigation was already in motion. The suspect had booked a flight but left the funds untouched, indicating either a plan to flee or a lack of realized urgency. The court of public opinion, however, has already rendered its verdict.
Trust is a variable; verification is a constant. The crypto industry is entering a new phase where on-chain detectives like ZachXBT are effectively acting as a bridge between the community and law enforcement. The tools are there, the data is public, and the incentives are aligned. The only question is whether the platforms will learn from this case before the next wave of attacks.
Arbitrage is the immune system of the protocol. But in this case, the arbitrage was not on price—it was on the gap between the attacker’s arrogance and the investigator’s patience. That gap, once closed, becomes a prison sentence.