Blockchain investigator ZachXBT says he spent months posing as a client inside a Chinese organized crime syndicate that he alleges has laundered more than $1 billion across multiple exploits tied to Lazarus Group, the North Korea-backed hacking collective that has been under U.S. Treasury sanctions since 2019.

According to ZachXBT, the intelligence he gathered while undercover helped action freezes connected to the February 2025 exploit on Bybit and assisted in attributing illicit activity on-chain. He detailed the infiltration in a thread posted on X on October 5, 2026.

The Bybit incident, in which attackers drained roughly $1.5 billion from the exchange in February 2025, ranks among the largest cryptocurrency heists on record, and its aftermath has involved tracing and freezing efforts spanning multiple blockchains and issuers.

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and illicit activity onchain.
— ZachXBT (@zachxbt) October 5, 2026

The operation began soon after the exploit on Bybit in February 2025. ZachXBT reported that he noticed many people in public Telegram and Discord groups asking for assistance with transactions linked to the stolen funds, prompting him to reach out to various accounts about transactions associated with the hack. That outreach led him to a Telegram user who went by the nickname “Jimmy Green,” with whom he eventually began communicating while posing as a client seeking laundering services.

ZachXBT Put $349,700 at Risk to Enter the Network

To enter the network, ZachXBT funded a new address and started transacting with the operator on March 6, 2025, committing 349,700 USDC to the scheme. He stated that the trades included swapping USD with ETH and USDT with Tron. The investigator intentionally carried out several transactions at a near 5% loss on each trade to establish credibility as a genuine client, describing the money as a gamble to advance the operation.

That approach enabled him to learn about the network’s alleged laundering activity in Hong Kong and mainland China. ZachXBT reported that Jimmy later spoke about intended transfers of assets linked to the Bybit exploit, which led to identifiable on-chain transactions.

$12M Cluster Traced Across Bitcoin, Ethereum, Solana and Tron

The major breakthrough came when Jimmy circulated a screenshot of an alleged cross-chain transfer. ZachXBT said the screenshot matched a transaction on THORChain, a cross-chain protocol used to swap assets between blockchains, in both amount and timing — one that was created within minutes of the message. The operator also provided a number of Solana addresses. From those addresses, ZachXBT detected a vast concentration of more than $12 million in Bybit funds that had been moved among Bitcoin, Ethereum, Solana, and Tron.

He later reported that the $442,000 in USDT tied to the cluster was ultimately frozen by Tether, the issuer of USDT whose contracts allow it to block transfers at specific addresses. He added that he also observed a newer laundering approach among Uniswap liquidity pools and illiquid tokens, a shift that broadens the range of patterns analysts screen for when following stolen funds.

Bybit Funds Were Not the Only Crypto Trail

The investigation also surfaced other illicit crypto traffic connections. ZachXBT reported that Jimmy had previously spoken about $300,000 that had been frozen; according to on-chain analysis, that money was linked to 332,000 USDC reportedly still stolen in the Poloniex exploit, the 2023 hack of the Poloniex exchange. A second conversation involved approximately $3 million in fraud funds identified as belonging to a Huione Guarantee hot wallet, an online marketplace previously flagged in illicit-finance research. Both sums were referenced during his exchanges with the operator, according to ZachXBT.

ZachXBT stated that his findings were shared with “ private investigators and law enforcement members.” He says his work has helped lock away more than $75 million in freezes since 2022, a figure that reflects how private on-chain researchers, stablecoin issuers, and law enforcement increasingly converge on freezes once stolen funds surface at identifiable addresses. Building on the stolen crypto uncovered in the recent operation, he noted the case demonstrates how illicit funds can continue to traverse intermediaries long after the original exploit takes place.