Crypto Sleuth ZachXBT Fronted $350K to Pose as Client of Lazarus’ Chinese Launderers

Blockchain investigator ZachXBT says he spent almost $350,000 of his personal cash to infiltrate an alleged Chinese language money-laundering community linked to North Korea’s Lazarus Group, an operation that helped expose greater than $12 million in funds linked to the $1.5 billion Bybit hack.

In an in depth submit on X printed October 5, the pseudonymous investigator mentioned he posed as a consumer of the community in early 2025, intentionally accepting losses on transactions in alternate for details about how the group moved stolen cryptocurrency.

“Posing as a consumer, I gathered intel that helped motion freezes for the Feb 2025 Bybit exploit and attribute illicit exercise onchain,” ZachXBT said.

The Bybit assault, which came about in February 2025, stays one of many largest cryptocurrency thefts on report. The FBI attributed the theft of roughly $1.5 billion in digital belongings to North Korean hackers it tracks as TraderTraitor, saying the stolen funds have been quickly moved throughout hundreds of blockchain addresses in an effort to obscure their origin.

ZachXBT’s standing on X

Going undercover with $349,700

ZachXBT mentioned his investigation started after he observed greater than 15 accounts in public Telegram and Discord teams looking for help with transactions involving funds linked to the Bybit exploit.

A kind of contacts used the alias “Jimmy Inexperienced.”

Fairly than merely monitoring the wallets from the skin, ZachXBT determined to pose as a possible buyer. On March 6, 2025, he funded a brand new Ethereum deal with with 349,700 USDC and started conducting transactions with Inexperienced.

The association concerned sending USDC in alternate for USDT on the Tron community. ZachXBT mentioned the pockets supplied by Inexperienced had itself obtained fuel from an deal with straight traceable to Bybit exploit funds and listed on a public Bybit blacklist.

He continued making transactions to ascertain credibility with the alleged laundering operation.

The technique got here at a value. ZachXBT mentioned he misplaced round 5% on every order, whereas additionally going through the likelihood that the counterparty might merely disappear together with his cash.

“At this level, I noticed I wanted to proceed shedding 5% per order and gamble on capturing as a lot actionable intel as shortly as potential,” he wrote.

In line with ZachXBT, Inexperienced finally started discussing plans to maneuver funds linked to North Korea and supplied particulars concerning the community’s operations in Hong Kong and mainland China.

A dialog between ZachXBT and “Jimmy Inexperienced.” (Supply: ZachXBT)

The blockchain proof adopted

The conversations turned extra useful when Inexperienced started offering data that ZachXBT might independently confirm on-chain.

In a single occasion, Inexperienced despatched a screenshot exhibiting a transaction involving funds being bridged between networks. ZachXBT mentioned he was in a position to match the screenshot with a corresponding THORChain transaction that had been created inside minutes of the dialog.

Inexperienced later shared three Solana addresses. ZachXBT mentioned these addresses helped him establish a cluster containing greater than $12 million in Bybit-linked funds, which have been being moved between Bitcoin, Ethereum, Solana and Tron.

Tether subsequently froze 442,000 USDT linked to the pockets cluster, in keeping with ZachXBT and reviews detailing his investigation.

The alleged laundering community additionally appeared to have data of different main crypto thefts.

The blockchain proof adopted

Inexperienced reportedly talked about roughly $300,000 that had beforehand been frozen. ZachXBT traced the determine to 332,000 USDC linked to the 2023 Poloniex exploit, which researchers have related to North Korean hacking exercise.

Inexperienced additionally claimed to have laundered round $3 million in fraud proceeds for an additional consumer. ZachXBT mentioned these funds could possibly be traced to a pockets related to Huione Assure, a market that has been linked to cryptocurrency laundering and illicit companies.

A broader community behind the laundering

The investigation suggests the operation was not merely a single dealer transferring cash for particular person criminals.

ZachXBT alleged that the Chinese language community had laundered greater than $1 billion throughout a number of exploits linked to Lazarus Group, together with a considerable portion of the funds stolen from Bybit. The claims are primarily based on a mixture of personal conversations, pockets actions and transaction timing.

The alleged group reportedly operated by means of completely different divisions, with people answerable for receiving and distributing stablecoins to different contributors.

That construction highlights a crucial weak point in crypto laundering operations: stolen funds could transfer by means of dozens of wallets and blockchains, however they nonetheless want intermediaries keen to transform, alternate or switch them.

For investigators, these intermediaries can grow to be useful sources of intelligence.

ZachXBT’s rising function in North Korea investigations

The operation additionally builds on ZachXBT’s earlier work monitoring cryptocurrency stolen by North Korean-linked hackers.

He mentioned he has helped facilitate greater than $75 million in freezes linked to DPRK-related incidents since 2022. His investigation into the Bybit assault additionally preceded the FBI’s public attribution of the theft to North Korea.

The investigator has grow to be one of the outstanding unbiased figures in crypto incident response, utilizing publicly accessible blockchain knowledge to hint stolen belongings and establish connections between seemingly unrelated hacks.

His work has additionally attracted controversy and private threat. ZachXBT was beforehand sued and doxxed by a former goal, but has continued investigating main cryptocurrency thefts.

He mentioned grants from foundations and donations from people have helped fund tougher investigations, together with the undercover operation.

For this specific case, nonetheless, he personally fronted the cash.

The operation was not with out hazard. ZachXBT mentioned he had no assure that Inexperienced would proceed cooperating or return the funds, whereas direct contact with an organized laundering community created an unknown degree of private safety threat.

He in the end stored the investigation non-public whereas passing the knowledge to regulation enforcement and different trusted investigators.

The case illustrates how cryptocurrency laundering has developed alongside blockchain surveillance. At the same time as criminals transfer stolen belongings throughout a number of chains, stablecoins, bridges and decentralized exchanges, investigators can typically use the identical clear infrastructure to reconstruct the path.

ZachXBT’s operation took that method one step additional: as an alternative of merely following the cash, he says he stepped contained in the community transferring it.