Key takeaways
- Zkasino raised over $30 million under the guise of an onchain gambling platform but never delivered.
- Online sleuth ZachXBT linked WhiteRock wallets, emails and team members to the original Zkasino scam.
- Despite rebranding, the project reused infrastructure and connections, raising serious concerns of a recurring rug pull.
- The Zkasino case proves that investors must go beyond hype and verify claims, team histories and wallet activity before committing funds.
In decentralized finance (DeFi), scams are an unfortunate reality. However, few rival the scale and complexity of the Zkasino exit scam. Launched with promises of transforming onchain gambling, Zkasino raised over $30 million from eager investors during its presale.
Instead of delivering on its roadmap, the project’s founders allegedly vanished with the funds, triggering an international investigation. What followed was not just another rug pull. It was a multichain laundering operation that spanned networks, used privacy tools and even re-emerged under a new project name: WhiteRock Finance.
What was Zkasino’s $30M fundraise and what went wrong?
Zkasino entered the DeFi space with bold claims and an ambitious roadmap. Marketed as a decentralized gambling platform, it attracted over $30 million in investment during its presale. The team introduced a campaign called “Bridge-to-Earn,” where users could lock up Ether (ETH) in exchange for future rewards. On paper, it seemed like a win-win.
But that illusion quickly collapsed.
In April 2024, Dutch financial crime authorities (FIOD) arrested Elham Nourzai, known online as Derivatives_Ape, on allegations of fraud, embezzlement and money laundering. Simultaneously, authorities seized millions in crypto assets, real estate and luxury goods. Zkasino’s promised platform never launched. Instead, users were told their bridged Ether was converted to the platform’s own ZKAS token, without consent or the ability to withdraw.
Onchain data revealed that users’ Ether had been swapped into staked tokens that generated yield. That yield never went to the investors. Rather than building a DeFi casino, Zkasino’s team allegedly turned the platform into their personal jackpot.
How Zkasino’s funds were laundered: Chainhopping explained
After Nourzai’s arrest and later release in 2024, the stolen funds did not sit idle. Investigators observed a sophisticated process of money laundering known as chainhopping. This is moving assets across multiple blockchains to obscure their origin.
Zkasino’s stolen funds began jumping between ZKsync, Starknet, EVM-compatible chains and Solana. Each hop made the trail harder to follow, taking advantage of the fragmented nature of blockchain ecosystems.
But chainhopping was not just about confusing investigators. It also created opportunities to convert assets into different forms and access varying levels of privacy. In some cases, the funds were swapped for privacy-focused tokens like Monero (XMR), which are difficult to trace. In other cases, the funds were used for speculative trades, essentially laundering through perpetual contract platforms like Hyperliquid, where gains could be reinvested cleanly.
The method was technical, multi-layered and deliberate, a clear indication that the laundering operation was premeditated.
Did you know? The Bybit exchange suffered the largest crypto hack in history on Feb. 21, 2025, when North Korea’s Lazarus Group stole about $1.5 billion in Ether, marking an unprecedented security breach.
The role of OTC brokers in laundering the funds
Over-the-Counter (OTC) brokers played a critical role in laundering the stolen Zkasino funds. Unlike centralized exchanges that enforce strict Know Your Customer (KYC) and Anti-Money Laundering (AML) protocols, many OTC desks operate in loosely regulated jurisdictions, allowing transactions with minimal identity verification.
This provided the Zkasino team with several advantages:
- Large-volume transactions without triggering exchange limits.
- Minimal traceability, as OTC deals often occur offchain or through private wallets.
- Jurisdictional arbitrage, using brokers in regions with weaker oversight.
- Fiat off-ramps, enabling direct conversion of crypto into cash or stablecoins.
By dividing the stolen funds into smaller tranches and routing them through multiple OTC channels, the team avoided suspicion and blurred transaction trails. Some crypto was exchanged for privacy coins like XMR, while others were laundered through stablecoins like Tether USDt (USDT) or USDC (USDC) and transferred to shell companies or personal accounts.
WhiteRock Finance: The alleged link to Zkasino’s stolen funds
Just as attention around Zkasino began to fade, a new DeFi project emerged in late 2024: WhiteRock Finance.
WhiteRock promised innovative financial products and claimed partnerships with well-known crypto entities. But within weeks, red flags appeared. The team was fully anonymous, had no verifiable history in crypto, and claimed inflated user metrics. Even more concerning, the supposed backing by USDX lacked transparency and many wallets linked to the project were funded via quick, instant exchanges.
They were also publicly called out by Zach Witkoff for falsely claiming support from World Liberty Financial, exposing WhiteRock’s misleading tactics.
Crypto sleuth ZachXBT raised the alarm on June 16, 2025, revealing that onchain analysis showed a clear commingling of wallets between WhiteRock and Zkasino. A marketing wallet belonging to WhiteRock had received funds from a Zkasino-linked address. One influencer even confirmed they were paid directly from this shared wallet.
Additional evidence linked a personal email address used by WhiteRock to Ildar Ilham, also known as Prometheus, one of Zkasino’s core team members. The emerging theory was that WhiteRock was a reincarnation of the Zkasino scam, rebranded and redeployed to prey on new investors.
Did you know? World Liberty Financial’s founders, Chase Herro and Zak Folkman, previously led the DeFi platform Dough Finance, which was hacked for $2.5 million in July 2024, yet failed to fully reimburse victims, leading to lawsuits and raising concerns about fiduciary accountability in their new venture.
Key figures in the Zkasino scam: Who are the alleged scammers?
While Zkasino operated under a veil of pseudonyms, real identities began to emerge through legal documents and blockchain trails.
- Elham Nourzai (Derivatives_Ape): The central figure behind Zkasino, arrested in April 2024.
- Ildar Ilham (XBT_Prometheus): Allegedly linked to both Zkasino and WhiteRock. Also, ZachXBT found a personal email linked to an account that had multiple interactions with the WhiteRock deployer address. That same email was later traced to a Chess.com profile using the username IldarTheGrandMaster.
- Lior Ben Zakan (Sigman0x): Another suspected co-conspirator, reportedly residing in the Middle East during the investigation.
ZachXBT warned that the risk of a rug with WhiteRock remains high due to their history with other projects, including Syncus and Zigzag.
How to spot and avoid DeFi scams
While scams like Zkasino are increasingly complex, investors can still protect themselves by taking proactive steps.
- Verify team identities: Avoid projects led by anonymous founders or teams with no public presence or verifiable track record.
- Demand transparency: Look for clear documentation, white papers and publicly available smart contracts.
- Check for audits: Only invest in projects that have passed third-party smart contract audits from firms like CertiK or Quantstamp.
- Use blockchain explorers: Tools like Etherscan help track wallet movements and token flows.
- Review tokenomics: Be cautious of unsustainable high yields or unclear distribution models.
- Cross-check partnerships: Confirm if claimed collaborations are publicly acknowledged by both parties.
- Assess community health: Join Telegram or Discord groups and look for active, organic discussions.
- Watch influencer behavior: Beware of overly promotional influencers with no disclosures.
- Track developer activity: Use GitHub or project dashboards to see ongoing development.
- Always DYOR: Research independently and avoid decisions based solely on hype or FOMO.