The pseudonymous on-chain investigator ZachXBT says he posed as a client of a Chinese laundering syndicate that has moved more than $1 billion in stolen crypto for North Korea's Lazarus Group, fronting 349.7K USDC — roughly $349,700 — of his own money and accepting a 5% loss on every order to keep the operation alive.

In a thread published on X on October 5, 2026, ZachXBT said the undercover work gathered intelligence that helped action freezes tied to the February 2025 Bybit exploit and supported the on-chain attribution of illicit activity. The operation, he said, exposed a cluster of more than $12 million in funds stolen from Bybit, and Tether later froze 442,000 USDT to it. He added that he has helped action more than $75 million in freezes related to North Korean incidents since 2022.

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. pic.twitter.com/jauRRt8875

— ZachXBT (@zachxbt) October 5, 2026

A $1.5 Billion Target

The exploit at the center of the case struck the crypto exchange Bybit in February 2025 and caused $1.5 billion in losses, the largest crypto theft on record. The FBI attributed the incident to TraderTraitor, the name it uses for North Korean hackers. According to ZachXBT, the launderers he approached were a Chinese gang working for North Korea. United Nations investigators have for years linked North Korean hacking units to billions of dollars in stolen cryptocurrency that helps bankroll the regime's weapons programs.

ZachXBT is likely the best-known and most prolific on-chain investigator in crypto. The mostly pseudonymous 20-something has spent years tracing stolen funds and naming the people behind hacks and scams, publishing threads built on public blockchain data that anyone can verify. He kept investigating even after a former target sued and doxxed him in 2023.

"Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain," he wrote.

Spotting a Pattern

The entry point came shortly after the hack. "In Feb 2025, shortly after the $1.5B Bybit exploit attributed to the DPRK-linked group 'TraderTraitor,' I observed a pattern of 15+ accounts asking for help with orders directly tied to stolen funds in public groups on Telegram and Discord," he wrote on X.

He saw the same pattern again last week after the $387 million Bitget hack, which Bitget's CEO and the blockchain tracing firms Ellipic and Chainalysis have linked to North Korea.

His North Korea track record made him well placed to act. On the day of the Bybit hack, he connected it to Lazarus Group using on-chain data, and the FBI backed that attribution days later. He also showed that wallets used to launder the Bybit funds were tied to earlier Lazarus attacks, including the Phemex and BingX hacks. In 2024, his tracing of the theft of roughly 4,100 BTC from a Genesis creditor helped lead to arrests. Paradigm hired him as an incident response advisor in February 2025, with the firm's co-founder Matt Huang saying he had returned more than $350 million to victims of hacks and scams.

ZachXBT says grants from foundations and donations from individuals fund his work and let him take on riskier cases like this one. Most on-chain tracing is passive — reading public ledgers rather than touching the money. By posing as a client, he moved from observer to participant, capturing details like advance notice of fund movements that public data alone could not reveal.

"Jimmy Green"

Back in 2025, ZachXBT began messaging the accounts that had been asking for help with Bybit-linked orders. One of them went by "Jimmy Green" on Telegram.

"On Mar 6, 2025, I funded a new address with 349.7K USDC on Ethereum in preparation to conduct several transactions with Jimmy Green," he said. Jimmy supplied an address to receive the USDC in exchange for USDT on Tron. That address, ZachXBT wrote, had been funded with gas by a wallet that "is directly traceable to Bybit exploit funds and is labeled on the public Bybit exploit blacklist site."

"I completed several additional transactions with him in order to build up trust," he said. "After that, Jimmy began to talk about moving Bybit funds for DPRK in advance of it happening, along with basic details about their operation in [Hong Kong] and mainland China."

For ZachXBT, the proof of Jimmy's foreknowledge was simple: "one day prior he stated funds would be moved to Solana and the next day they were."

Staying in the hunt carried a cost. "At this point, I realized I needed to continue losing 5% per order and gamble on capturing as much actionable intel as quickly as possible," he wrote. "For this case, I fronted $349.7K and lost 5% on each order, with no guarantee Jimmy wouldn't disappear with the funds, and an unknown amount of personal risk from dealing with the syndicate," he said.

Jimmy was eager for more business. On March 10, he repeatedly pinged the fake persona until ZachXBT, staying in character, said the pestering made him "lose trust in your business." Jimmy replied that "the team has prepared $1 million and is ready to start work at any time!"

In another chat, Jimmy described the team's setup: "We have different divisions of labor. We take the u and distribute it to different acceptors." The "u," ZachXBT noted, is apparently shorthand for USDT, the stablecoin issued by Tether.

The Payoff On-Chain

The conversations translated into verifiable evidence. ZachXBT wrote that on March 12, 2025, he matched a screenshot Jimmy sent of himself bridging funds to an order created within minutes of the message, using amounts and timing visible on the Thorchain explorer, a public log of swaps on the decentralized protocol that moves coins directly across blockchains.

Jimmy then shared three Solana addresses. They exposed a cluster of more than $12 million in Bybit loot being swapped in real time, hopping from Bitcoin to Ether to Solana and finally to Tron. Tether later froze 442,000 USDT linked to the cluster. The freeze illustrates one of the few hard levers in crypto: once stolen value converts into tokens like USDT, the issuer can lock assets at a flagged address.

Jimmy also volunteered details ZachXBT could independently check. He said a team he knew had around $300K frozen in 2024; ZachXBT found the freeze on-chain. The real figure was 332,000 USDC, stolen in the Poloniex exploit — the November 2023 hack that drained than $100 million from the exchange and that researchers have tied to North Korea's Lazarus Group.

The Cambodia Connection

Jimmy also said he had laundered $3 million in fraud proceeds for a different client. ZachXBT traced those funds to a hot wallet used by Huione Guarantee, a Telegram marketplace where criminals sold laundering services and stolen data.

Huione Guarantee is part of Huione Group, the Cambodian conglomerate the U.S. Treasury's FinCEN targeted over the alleged laundering of at least $4 billion. Telegram banned the marketplace in May 2025, and Chinese authorities arrested former Huione Group chairman Li Xiong after Cambodia deported him.

Not all of the exchanges were about crime. "Throughout our conversations, Jimmy and I had a lot of small talk in between discussing laundering for DPRK," ZachXBT said. "He talked about playing mahjong, hunting wild rabbits, food, his fat reducing meal, family life, and vacations at Disney."

Documented Results

The sting was not a one-off. "Since 2022, I have helped action $75M+ in freezes related to DPRK incidents," ZachXBT wrote.

He said his findings went immediately to trusted private-sector investigators and to the law enforcement assigned to the case, and that sensitivity around the investigation kept him from publishing sooner. The thread names none of the individuals behind the syndicate and describes no arrests stemming from the operation, leaving any further freezes or enforcement action built on the intelligence he handed over as the next development to watch.