ZachXBT Infiltrated a $1 Billion Lazarus Laundering Network

The blockchain investigator says he posed as a client and spent $349,700 of his own money to trace funds from the Bybit hack, helping trigger freezes.

ZachXBT Says He Infiltrated a $1 Billion Lazarus Laundering Network

Francis Gable

05/10/26 · 2 minOctober 5, 2026 · 2 min read

Blockchain investigator ZachXBT said on Oct. 5 that he posed as a client of a Chinese crime network he alleges has laundered more than $1 billion for North Korea's Lazarus Group. In a 12-part thread on X, he said the intelligence helped freeze money stolen in the Bybit hack.

The FBI blamed North Korea for the theft of about $1.5 billion from the Bybit exchange on Feb. 21, 2025. Stolen crypto is only useful once someone swaps it into clean coins and cash. ZachXBT's account describes the people he says did that work.

Investigator Trades With an Alleged Launderer

After the hack, ZachXBT said he saw more than 15 accounts in public Telegram and Discord groups asking for help with orders tied to the stolen funds. One used the alias "Jimmy Green."

On March 6, 2025, he loaded a new wallet with 349,700 USDC, a dollar-pegged token, and began swapping it for Jimmy's USDT. He wrote that Jimmy's receiving address was funded by a wallet traceable to Bybit hack money.

Jimmy later described fund movements before they happened, ZachXBT said. Once he said funds would move to Solana, and they did the next day. Jimmy claimed his team laundered most of the Bybit haul.

Three addresses Jimmy shared exposed a cluster of more than $12 million in Bybit funds, according to the thread. Tether later froze 442,000 USDT linked to it. ZachXBT said he lost 5% on every order.

Findings Went to Law Enforcement First

ZachXBT said he passed his findings to private investigators and to law enforcement assigned to the case, and held off publishing because of the investigation's sensitivity. He says he has helped freeze more than $75 million tied to North Korean incidents since 2022. The thread does not say whether anyone has been charged.

He says the same pattern of launderers seeking help in public chats followed the September hack at Bitget. He also says he is sitting on significant findings from other cases that he has not yet published.

Treat gambling as entertainment you pay for. 18+, and if it stops feeling like entertainment, help exists at BeGambleAware and GamCare.