On-chain sleuth ZachXBT fronted $350K to infiltrate a Chinese money laundering ring and track Lazarus Group's stolen funds through Bybit.
Security & Exploits ·
On-chain investigator ZachXBT says he fronted $349,700 in USDC on March 6, 2025, and incurred a 5% loss on each transaction while posing as a client of a Chinese money laundering syndicate. The operation allegedly exposed a cluster of Bybit exploit funds exceeding $12 million, with Tether subsequently freezing $442,000 in USDT tied to the network. ZachXBT claims the syndicate has laundered over $1 billion across multiple exploits for Lazarus Group, a North Korean-linked hacking operation.
The investigator says he began messaging accounts seeking help with orders connected to the February 2025 Bybit breach—which resulted in $1.5 billion in losses—after observing patterns in public Telegram and Discord groups. By establishing contact with a contact using the alias "Jimmy Green," he gathered intelligence that he says led to fund freezes and on-chain attribution of illicit activity tied to the exploit.
ZachXBT states his work in tracing stolen cryptocurrency and attributing North Korean incidents has helped action over $75 million in freezes since 2022, funded through grants and individual donations. The specifics of how the intelligence gathered during this operation led to particular enforcement actions remain partially unclear from available accounts.