Three Wrong First Answers: tracing deposits sent to dgbpool.com
By Mark McNiel (JohnnyLaw), Around The Block LLC, Stillwater, Oklahoma. Published Oct 12, 2026.
The incident
Someone who had sent DGB to a site called dgbpool.com asked me to find out where their deposits went. My on-chain analysis confirmed those deposits and followed the funds from there.
Three first conclusions that did not survive verification
Every case hands you an easy story early. This one handed me three, and each one was wrong.
-
"The site is distributing malware." The site linked DigiByte-branded downloads to a GitHub organization. That looks bad. When I checked, the organization returned a 404 and the links were dead. A dead link proves nothing about malware, so I don't claim it.
-
"Here is how much was laundered." The cash-out leg moved a very large amount of DGB to an exchange. It was tempting to call all of it stolen. But nobody had itemized that figure, so I could not show how much of it traced back to this case. A number you can't itemize is not a theft figure, so it stays out.
-
"Tell the exchange and they'll freeze it." That sat in an early draft of the next steps. When I checked how freezes actually work, a report from someone who isn't the account holder usually isn't enough for a lasting hold. It generally needs an official case behind it. The guidance changed to match.
What was actually established
- dgbpool.com was registered on 2026-03-29 through Registrar.eu (Hosting Concepts B.V.) and expires 2027-03-29. Its nameservers are at ZillionKingHost and it is hosted on OVH.
- One deposit address is confirmed as the site's, through off-chain ground truth. The reporting person's deposits are confirmed on-chain.
- What that one address received is a certified floor, not a ceiling. How many other people sent funds is still open.
- From that address, funds were swept to a hub controlled by the same owner. A single public key signed every input of an 11-input consolidation.
- From the hub, funds moved through a passthrough address left at zero balance, then to a feeder address that sent 100% of its outflow to a confirmed KuCoin hot wallet. KuCoin is the cluster's cash-out venue.
- No obfuscation on the path. The CoinJoin check came back clean.
The restraint
There are a few things I chose not to say. I'm not publishing the reporting person's transactions, amounts, or dates. I'm not publishing the large throughput figure from the cash-out leg, because it hasn't been itemized and it isn't a theft number. I'm not saying why anyone did anything. On-chain data shows what moved, not what someone meant. And there was a timing coincidence in the domain records that looked meaningful. It's an observation, not a conclusion, so it stays internal.
What this means for people and projects
If you lost funds, the first story you hear (from others or from yourself) is usually the most dramatic one, and it is often not the right one. For projects and builders, when someone uses your name, the pull is to go loud fast. Don't. An overstated claim gets challenged, and when it falls, it takes the true claims down with it. Verify before you accuse. Separate what you can anchor to evidence from what you only suspect, and publish only the first part.
Say what you can prove, and nothing past it.
If you were affected: Tracing is free for now, I will never charge upfront fees, and I cannot promise recovery. Treat anyone who contacts you offering to recover your DGB for a fee as a second scam until proven otherwise. See How I trace DigiByte thefts for how I work and how to file a report.