In early June 2025, Ross Ulbricht, the founder of the Silk Road, received a donation of 300 Bitcoin (BTC), worth approximately $31 million, in his crypto wallet, sparking speculation and debate within the crypto community. Ulbricht had been released from prison in January 2025 after being pardoned by former U.S. President Donald Trump, having served 12 years of a double life sentence for his role in operating the darknet marketplace. The Silk Road facilitated the sale of over 9.5 million Bitcoin between 2011 and 2013 before being shut down by the FBI. The timing of the donation, so soon after Ulbricht's release and his successful auction of prison memorabilia for $1.8 million, led many to speculate that the funds were either a hidden stash from his Silk Road days or a generous gift from supporters.

Adding to the intrigue, blockchain investigator ZachXBT stepped in to trace the origin of the funds. ZachXBT is known for exposing scams, tracking stolen funds, and holding fraudsters accountable in the crypto space. Often called the "Sherlock Holmes of crypto," ZachXBT uses blockchain analytics and social media intelligence to uncover fraudulent projects. Through meticulous on-chain analysis, ZachXBT was able to trace the $31 million Bitcoin donation back to a "questionable source".

Initially, many in the crypto community suspected the donation was a self-transfer from Ulbricht's own hidden funds. However, ZachXBT's investigation suggested otherwise. "It likely doesn't appear to be a self donation as people were claiming, though it comes from questionable sources due to the flagged address," ZachXBT stated in a post on X.

ZachXBT discovered that the funds originated from a suspicious centralized Bitcoin mixing service called Jambler. He noted that Jambler is not as widely used as decentralized privacy tools like Wasabi or Samourai, making it an unusual choice for such a large transaction. Further investigation revealed that the 300 BTC likely came from two dormant addresses. One address was created in 2014, while the other was active in 2019. Significantly, the second wallet had been previously flagged as suspicious by compliance tools.

Moreover, ZachXBT found that the two wallets had deposited large amounts of crypto into Jambler between April and May, coinciding with the timing of the donation to Ulbricht's wallet. This suggested that the sender was attempting to obscure the origin of the funds. ZachXBT also discovered that the individual behind the transfer had previously cashed out other crypto through centralized exchanges in small, spread-out amounts, a tactic commonly used to avoid detection and asset freezing.

Chainalysis, another blockchain analytics firm, conducted its own investigation and concluded that the donation did not originate from Silk Road. Instead, their analysis pointed to AlphaBay, a now-defunct darknet market that operated between 2014 and 2017, as the likely source. AlphaBay was reportedly ten times the size of Silk Road at its peak and was known for trafficking in drugs, malware, and illegal services. Chainalysis' director of investigations, Phil Larratt, suggested that the size of the donation indicated it likely came from a former vendor on AlphaBay.

Chainalysis' forensic analysis matched on-chain activity to known AlphaBay patterns, revealing that the donor used several Bitcoin mixers, including Jambler, to obscure the flow of funds. ZachXBT told WIRED that the money was a legitimate donation but not legitimate funds, describing the transaction pattern as common among criminals trying to avoid detection.

The identity of the donor and their motivation for sending the $31 million in Bitcoin to Ross Ulbricht remain unclear. Some speculate it was a repayment or act of solidarity from another dark web actor, while others believe it may have been a gesture appreciating Ulbricht's campaign for anonymous online commerce. Regardless of the intent, ZachXBT's ability to trace the funds to a flagged wallet highlights the importance of blockchain analytics in uncovering illicit activities and promoting transparency in the crypto space.