Cryptocurrency investigator ZachXBT infiltrated a Chinese laundering syndicate that moved funds from the $1.5 billion Bybit hack in February 2025. Posing as a client, ZachXBT fronted $349,700 in USDC and accepted a 5% loss per transaction to build trust with a contact named 'Jimmy Green'. The operation exposed a $12 million wallet cluster, leading Tether to freeze 442,000 USDT. The syndicate allegedly laundered over $1 billion for North Korea's Lazarus Group.
ZachXBT's undercover sting operation
- ▪ZachXBT initiated contact with a Chinese syndicate laundering for North Korea's Lazarus Group after observing at least 15 accounts in public Telegram and Discord groups asking for help with orders tied to stolen Bybit funds in February 2025
- ▪On March 6, 2025, cryptocurrency investigator ZachXBT funded a new Ethereum address with 349,700 USDC to pose as a client and transact with a Chinese laundering syndicate contact using the alias "Jimmy Green"
- ▪ZachXBT accepted a 5% loss on each transaction order with "Jimmy Green" to build trust and gather actionable intelligence on a Chinese syndicate's operations laundering funds for North Korea's Lazarus Group
- ▪ZachXBT matched a screenshot of a cross-blockchain transfer sent by "Jimmy Green" on March 12, 2025, to a THORChain transaction explorer order created within minutes of the message
Disclosures by Jimmy Green
- ▪The Chinese laundering syndicate contact "Jimmy Green," linked to North Korea's Lazarus Group, shared personal details with ZachXBT, including playing mahjong, hunting wild rabbits, family life, and vacations at Disney
- ▪The Chinese laundering syndicate contact "Jimmy Green," linked to North Korea's Lazarus Group, claimed his team was responsible for laundering most of the $1.5 billion stolen from cryptocurrency exchange Bybit
Attribution of the Bybit exploit
- ▪The February 2025 exploit of cryptocurrency exchange Bybit resulted in approximately $1.5 billion in losses
- ▪ZachXBT connected the February 2025 Bybit exploit to the North Korean Lazarus Group using on-chain data on the day of the Bybit hack, which the FBI backed days later
ZachXBT's past investigative successes
- ▪ZachXBT's previous tracing of approximately 4,100 BTC stolen from a Genesis creditor in 2024 helped lead to arrests
- ▪Since 2022, ZachXBT has assisted in freezing more than $75 million in cryptocurrency tied to North Korean hacking incidents
ZachXBT's funding and advisory roles
- ▪In February 2025, Paradigm hired ZachXBT as an incident response advisor, with co-founder Matt Huang noting ZachXBT had returned over $350 million to victims of hacks and scams
- ▪ZachXBT funds his independent blockchain investigations through foundation grants and individual donations, which allow him to take on higher-risk cases
Debatable claims
- ▪Private blockchain investigators are justified in conducting undercover sting operations
- ▪Centralized stablecoin freezes do more harm than good to the cryptocurrency ecosystem
Story comments
Loading comments…