Blockchain investigator Zachary Wolk, widely known as ZachXBT and currently serving as an Incident Response Advisor at crypto investment firm Paradigm, has revealed how he posed as a client to infiltrate a Chinese organized crime syndicate that has laundered more than $1 billion tied to multiple blockchain exploits.

In an October 5 disclosure, ZachXBT laid out the undercover operation that helped disrupt a sophisticated laundering network connected to the Lazarus Group, the cybercrime organization operating on behalf of the North Korean government. Groups linked to North Korea have repeatedly been tied to some of the largest thefts in crypto, which is why the movement of their proceeds is watched closely by exchanges, issuers, and independent investigators alike.

To earn the syndicate's trust, the investigator risked $349,700 of his own capital across 15 identified suspicious accounts. Specifically, he initiated test transactions, paid the group's standard 5% fees, and traced illicit flows across major blockchains. Laundering networks fill this role because activity on public blockchains is permanently visible, so stolen funds typically have to be routed through intermediaries before attackers can spend them without a direct on-chain link to the original exploit.

One member of the criminal group, operating under the pseudonym Jimmy Green, assured ZachXBT that the laundered funds were clear of freezing. According to the on-chain sleuth, the organization handled most of the $1.5 billion stolen in the February 2025 Bybit exploit, as well as $387 million tied to the September 2026 Bitget incident. The Bybit breach is widely reported as the largest single theft in crypto history, making the trail of its proceeds one of the industry's most closely followed cases.

As trust developed, Jimmy began sharing details about the operation. He spoke about moving Bybit funds ahead of time, referenced activities in Hong Kong and mainland China, and sent screenshots of bridges that ZachXBT quickly matched on block explorers such as THORChain (RUNE). Jimmy also provided Solana (SOL) addresses tied to a cluster that moved more than $12 million of the stolen Bybit funds across Bitcoin (BTC), Ethereum (ETH), and Tron (TRX). Each hop between chains and bridges adds another layer of separation from the original exploit — precisely the pattern ZachXBT was able to match across public block explorers.

ZachXBT's tracking subsequently helped Tether freeze $442,000 from the stolen funds. Overall, the investigator has contributed to freezing more than $75 million linked to North Korean hacks since 2022. Stablecoin issuers such as Tether have the technical ability to lock tokens at specific addresses, so pinpointing where stolen funds sit on-chain can convert tracking work directly into frozen balances.

He is now calling for financial assistance to fund his investigations, which he says could further counter on-chain crime. The request follows an operation in which he personally put $349,700 at risk, a figure that illustrates the cost side of independent on-chain enforcement.