Blockchain investigator ZachXBT says he spent practically $350,000 of his personal cash to infiltrate an alleged Chinese language money-laundering community related to North Korea’s Lazarus Group, an operation that helped expose greater than $12 million in funds linked to the $1.5 billion Bybit hack.
In an in depth submit on X printed October 5, the pseudonymous investigator stated he posed as a shopper of the community in early 2025, intentionally accepting losses on transactions in trade for details about how the group moved stolen cryptocurrency.
“Posing as a shopper, I gathered intel that helped motion freezes for the Feb 2025 Bybit exploit and attribute illicit exercise onchain,” ZachXBT stated.
The Bybit assault, which occurred in February 2025, stays one of many largest cryptocurrency thefts on file. The FBI attributed the theft of roughly $1.5 billion in digital belongings to North Korean hackers it tracks as TraderTraitor, saying the stolen funds have been quickly moved throughout hundreds of blockchain addresses in an effort to obscure their origin.
ZachXBT’s standing on X
Going undercover with $349,700
ZachXBT stated his investigation started after he seen greater than 15 accounts in public Telegram and Discord teams searching for help with transactions involving funds related to the Bybit exploit.
A type of contacts used the alias “Jimmy Inexperienced.”
Quite than merely monitoring the wallets from the skin, ZachXBT determined to pose as a possible buyer. On March 6, 2025, he funded a brand new Ethereum tackle with 349,700 USDC and commenced conducting transactions with Inexperienced.
The association concerned sending USDC in trade for USDT on the Tron community. ZachXBT stated the pockets supplied by Inexperienced had itself obtained gasoline from an tackle instantly traceable to Bybit exploit funds and listed on a public Bybit blacklist.
He continued making transactions to determine credibility with the alleged laundering operation.
The technique got here at a value. ZachXBT stated he misplaced round 5% on every order, whereas additionally dealing with the likelihood that the counterparty might merely disappear together with his cash.
“At this level, I noticed I wanted to proceed shedding 5% per order and gamble on capturing as a lot actionable intel as rapidly as attainable,” he wrote.
In line with ZachXBT, Inexperienced finally started discussing plans to maneuver funds related to North Korea and supplied particulars concerning the community’s operations in Hong Kong and mainland China.
A dialog between ZachXBT and “Jimmy Inexperienced.” (Supply: ZachXBT)
The blockchain proof adopted
The conversations turned extra priceless when Inexperienced started offering data that ZachXBT might independently confirm on-chain.
In a single occasion, Inexperienced despatched a screenshot exhibiting a transaction involving funds being bridged between networks. ZachXBT stated he was capable of match the screenshot with a corresponding THORChain transaction that had been created inside minutes of the dialog.
Inexperienced later shared three Solana addresses. ZachXBT stated these addresses helped him determine a cluster containing greater than $12 million in Bybit-linked funds, which have been being moved between Bitcoin, Ethereum, Solana and Tron.
Tether subsequently froze 442,000 USDT related to the pockets cluster, in accordance with ZachXBT and stories detailing his investigation.
The alleged laundering community additionally appeared to have data of different main crypto thefts.
The blockchain proof adopted
Inexperienced reportedly talked about roughly $300,000 that had beforehand been frozen. ZachXBT traced the determine to 332,000 USDC linked to the 2023 Poloniex exploit, which researchers have related to North Korean hacking exercise.
Inexperienced additionally claimed to have laundered round $3 million in fraud proceeds for an additional shopper. ZachXBT stated these funds might be traced to a pockets related to Huione Assure, a market that has been linked to cryptocurrency laundering and illicit companies.
A broader community behind the laundering
The investigation suggests the operation was not merely a single dealer shifting cash for particular person criminals.
ZachXBT alleged that the Chinese language community had laundered greater than $1 billion throughout a number of exploits linked to Lazarus Group, together with a considerable portion of the funds stolen from Bybit. The claims are primarily based on a mixture of personal conversations, pockets actions and transaction timing.
The alleged group reportedly operated by completely different divisions, with people answerable for receiving and distributing stablecoins to different members.
That construction highlights a vital weak spot in crypto laundering operations: stolen funds could transfer by dozens of wallets and blockchains, however they nonetheless want intermediaries keen to transform, trade or switch them.
For investigators, these intermediaries can turn out to be priceless sources of intelligence.
ZachXBT’s rising function in North Korea investigations
The operation additionally builds on ZachXBT’s earlier work monitoring cryptocurrency stolen by North Korean-linked hackers.
He stated he has helped facilitate greater than $75 million in freezes related to DPRK-related incidents since 2022. His investigation into the Bybit assault additionally preceded the FBI’s public attribution of the theft to North Korea.
The investigator has turn out to be one of the outstanding unbiased figures in crypto incident response, utilizing publicly out there blockchain information to hint stolen belongings and determine connections between seemingly unrelated hacks.
His work has additionally attracted controversy and private danger. ZachXBT was beforehand sued and doxxed by a former goal, but has continued investigating main cryptocurrency thefts.
He stated grants from foundations and donations from people have helped fund harder investigations, together with the undercover operation.
For this explicit case, nonetheless, he personally fronted the cash.
The operation was not with out hazard. ZachXBT stated he had no assure that Inexperienced would proceed cooperating or return the funds, whereas direct contact with an organized laundering community created an unknown degree of private safety danger.
He finally stored the investigation personal whereas passing the knowledge to legislation enforcement and different trusted investigators.
The case illustrates how cryptocurrency laundering has advanced alongside blockchain surveillance. At the same time as criminals transfer stolen belongings throughout a number of chains, stablecoins, bridges and decentralized exchanges, investigators can generally use the identical clear infrastructure to reconstruct the path.
ZachXBT’s operation took that method one step additional: as an alternative of merely following the cash, he says he stepped contained in the community shifting it.
