10 Bitcoin bust leads authorities to alleged ‘FreeCity’ darknet operator

A user on X has been inadvertently exposed as the mastermind behind a darknet operation named “FreeCity.” The exposure comes as a result of the user’s inability to let some frozen funds go. However, the user has denied the allegations made by onchain sleuths like ZachXBT.

The alleged admin handling FreeCity has been outed as @sexinfochina. That user had publicly complained about how Near Intents, a project linked to the NEAR protocol, had frozen about 10 $BTC they had sent to a generated address as part of a cross-chain transaction.

The user called it “centralized theft,” cosplaying as a “mandatory compliance review” as no timeline or explanation was provided, as they were kicked out of the project’s Telegram group for voicing their questions.

The altercation that outed FreeCity’s admin

In response to the post, ZachXBT shared a comment in which he accused “Sexinfochina” of being the operator behind FreeCity, a Chinese-language underground marketplace known to operate across the dark Web, clearness and Telegram channels.

According to reports, FreeCity is behind a wide range of illegal activities, including the sale of stolen data, phishing tools, malware, money laundering, human trafficking, hitman services, drugs, prostitution, and many more.

Zach also provided a screenshot he claims proves the FreeCity admin Telegram account had also made a complaint in the Near Intents Telegram support channel about the same frozen transaction details Sexinfochina had shared.

The accused user denied the allegations

In response to Zach’s onslaught, Sexinfochina took to the comment section to clarify they are “NOT the operator of ‘FreeCity’ or ANY darknet market.”

Conveniently left out the fact that you are a cyber criminal that operates the Chinese darknet market ‘FreeCity’

You openly advertise illicit services such as human trafficking / hitman openly on Telegram.

You also have knowingly laundered 5+ hacks for DPRK as their OTC.

I… pic.twitter.com/g9SpufjGIi

— ZachXBT (@zachxbt) February 14, 2026

“That tg account doesn’t belong to me,” Sexinfochina wrote. “I’m a trader whose 10 $BTC is frozen by @near_intents under shady “compliance review.” You’re smearing me to deflect from THEIR theft. This is libel, not journalism. false accusations damaging reputation = criminal offense. Retract or lawyer up. Crypto community: Demand proof before believing smears.”

Sexinfochina went as far as accusing Zach of being the “real bad guy” because he helps “out the big shots behind the scenes, pretending to uphold blockchain justice all along.”

“So your money also comes from the crypto community? Can you guarantee that all your upstream funds are completely legal?” Sexinfochina asked.

Zach responded by sharing more screenshots of how the FreeCity market owner’s Telegram account was complaining in the Near Intents TG channel about the exact same transactions.

“As more proof here’s an old DM before your last X account was banned,” Zach wrote, attaching old images of when Sexinfochina messaged him via a now-suspended X account after getting their account frozen.

In the screenshot, they referred to themselves as a “normal user of Binance” and tried to appeal to Zach’s sense of justice, asking if he could help the “victims fight for justice.”

$BTC seizure exposed alleged admin of Chinese darknet market ‘FreeCity.'”>

Screenshot of the text from a known alias of the alleged admin of the FreeCity dark marketplace. Source: @zachxbt via X/Twitter.

Sexinfochina remained active in the comment section after that, seemingly unbothered by being outed as a threat actor by a prominent online sleuth.

Who is Sexinfochina, the alleged admin behind FreeCity?

A thread from a user identified as Narcass3, whose bio claims he hunts DPRK “for fun,” backed up Zach’s claims that Sexinfochina is in fact the admin of the Chinese darknet market FreeCity.

“Behind the handle is Xiao He, a Chinese national who is a prolific launderer of DPRK stolen funds, supporter of DPRK IT Worker ops, and pusher of fake viagra,” Narcass3 wrote.

According to the user, Xiao He most likely hails from North West China and graduated from Southwest University of China with a Bachelor’s Degree in Electrical Engineering. He reportedly currently shuttles between Dubai and China and pretends to offer legitimate crypto OTC services.

Narcass3 also linked Xiao He to various social media handles, including ‘Victor Marshal’, ‘hexiao33’, ‘camonanesi’, ‘Komonado’, and ‘chaindeler.’

“Xiao He has for years laundered millions in crypto for DPRK APTs across the board and IT Workers. In the past, we saw him work closely with a group of IT Workers supporting Moonstone Sleet,” Narcass3 wrote.

He reportedly operates several companies that all claim to be focused on freelancing or software development: ZenDao Tech, FWork[.]io, DeamChain, and Deliminal Limited.

Several of the listed companies have IT workers who are closely affiliated with them. Meanwhile, Xiao He also engages in some freelance work on the side.

Narcass3 even accused Xiao He of running a fake sex drug operation via his company “Kuhu Pharmacy” which seems to mainly be present on Telegram. He believes that most of Sexinfochina’s disparate activity all connects together because “he has shit opsec or just doesn’t care.”

Narcass3 also confirmed that despite all the shady acts he is involved in, Xiao He is unable to let go of his frozen funds and is fond of reaching out to customer support in a sloppy attempt to unfreeze them.