2/ For this example I bridged 1 SOL from Solana to Zcash via Near Intents & shielded it after. Source txn from 27sfYM 3R82PEDc1WsvQHbEaEph5igAbfvunWjg3ErpjrAvQ5rzkhcqRkhp9MKocKXMNLAwTNrW2rrP3cicywb2HFcBMxF4 Destination txn to t1MQ9Z

3/ Now let’s say I want to anonymously fund an ETH address from my Zashi wallet with my shielded ZEC so I use the “Crosspay” feature via Near Intents to receive 0.005 ETH to the following address: 0x6dda3649f19191a9df465f4010019f2f59c34bc4

4/ My order completed after several minutes but the issue is a Near Intents refund txn of 0.001598 ZEC was also made to my t - address I initially shielded from which establishes a clear link between my addresses. Someone can simply match up timing/amounts from the Near Intents

5/ I contacted the Zashi team and they informed me they plan to solve this privacy issue by adding ephemeral addresses soon and eventually shielded Near Intent refunds. In the meantime I suggest using multiple seeds on separate devices if you use Near Intent integration for

6/ I wanted to make this post so more people do not continue the privacy mistake of accidentally revealing their transparent address when bridging with shielded ZEC until a Zashi update is implemented. Should I do more posts like this in the future about how to maintain proper

@zachxbt Do think it would be beneficial to do more posts around OPSEC. Been helping people out with that a lot on the physical/social side, and Onchain is a different beast. Bet you’d find alot of folks willing to pay for that service too

@beausecurity I’m considering it more so as a consulting service for individual traders / small business vs lots of public posts since bad actors could potentially abuse it to launder

@zachxbt Could you do one of these for Railgun?

@AvgJoesCrypto Eventually sure (once an ongoing case involving it is resolved)

@zachxbt dude we need more of these

@0xNairolf 🤝

@zachxbt what the difference between > proper onchain opsec and > money laundering after scam if they have similar ideas, the anonymity of transactions and the impossibility of tracking them

@manfromhell_eth the difference is not everyone wants their activity featured on MLM, LookOnChain, or Arkham

@zachxbt Will you ever consider creating a publicly accessible database of the tools you use and maybe some investigative methodology documents based on your previous cases ? Or if such things already exist, maybe you could point me to them as I am eager to learn/practice

@Xtern3993 I have a list of tools pinned in my TG channel https://t.me/investigations/23...

@zachxbt Isn't this going to give ideas to scammers to cover their tracks?

@RTDurac It will be fixed in the near future and can still be retroactively used to identify entities

@zachxbt boss this is awesome. ty for flagging it

@0xelegant np

@zachxbt Can you tell us how you make your money? (If it's not a secret)

@hunterrronchain >grants and donations >started taking on more paid engagements for formal reports / recovery this year

@zachxbt If you’re exploring privacy projects, check out #0x0’s Arcane Wallet. It’s doing what most privacy protocols only talk about. No mixers, no bridges, no trusted setups. Arcane gives users true on-chain privacy with stealth addresses, ECDH encryption, and relayers that broadcast

@zachxbt How do we catch bad actors when this is perfected?

@zachxbt Doesn’t this just mean insider ZEC holders can dump anonymously without anyone knowing how much they hold?

@zachxbt Once again, thanks for the read and highlighting the challenge between privacy and security Overall I believe privacy matters more for anything that doesn't need to be public (ie gov spendings, ...)

@zachxbt It seems counterproductive to spread awareness of something that could actually empower malicious actors. Very odd post, coming from you.. #PaidAd?

@zachxbt The @0x0exchange team establishes new industry benchmarks for security and privacy across the DeFi landscape. Their existing Arcane Wallet already delivers first-class protection, while the forthcoming Spectre (Fully Privacy DEX) is set to fundamentally redefine decentralized

@zachxbt "The thing I love about my job is testing privacy products with the hope of exploiting them" Please don't change jobs.

@zachxbt If an optional snark is the privacy goto, then why the hell would I go into zcash instead of Tornado Cash?? That's really the only question that matters to me here. It just doesnt make sense to add all those extra steps.

@zachxbt Oh no mert lied about some tech being good again? Shocker

@zachxbt This is going to help privacy lovers. Your findings are great.

@zachxbt it all makes sense now

@zachxbt Dude these reports are vital info fam