Ben Zhou, the CEO of Bybit, has praised blockchain investigator ZachXBT for his work tracing a Chinese-linked laundering network allegedly responsible for moving more than $1 billion in cryptocurrency connected to the North Korean Lazarus Group. Zhou’s support highlights the growing role of independent blockchain investigators in tracking stolen digital assets, identifying laundering routes and helping crypto platforms freeze funds linked to major cyberattacks.
ZachXBT revealed the investigation after claiming he infiltrated the alleged network by posing as a customer. According to his account, he spent $349,700 in USDC and accepted losses on transactions while gathering information about operators connected to the laundering operation. His investigation focused heavily on cryptocurrency stolen during the $1.5 billion Bybit hack in February 2025.
ZachXBT’s Undercover Crypto Investigation
The investigation began after ZachXBT identified more than 15 accounts on Telegram and Discord that were allegedly seeking customers for transactions involving stolen cryptocurrency. He eventually contacted an operator using the alias “Jimmy Green” and presented himself as a legitimate customer. ZachXBT said the operation required him to accept a 5% loss on transactions while he built trust and collected intelligence.
According to the blockchain investigator, the information obtained through the operation helped identify a cluster containing more than $12 million in funds connected to the Bybit exploit. He also said the network provided information about cryptocurrency movements between Bitcoin, Ethereum, Solana and Tron, giving investigators a clearer picture of how stolen assets moved across multiple blockchain networks.
The investigation also produced information that ZachXBT said connected other transactions to previous North Korea linked attacks. One example involved funds associated with the 2023 Poloniex hack, while another $3 million transaction was reportedly connected to a wallet associated with Huione Guarantee, a Cambodian marketplace that U.S. authorities have identified as a major money laundering concern.
ZachXBT said the information from his operation helped trigger cryptocurrency freezes and provided additional evidence for attributing illicit transactions. He has claimed that his investigations since 2022 have contributed to more than $75 million in freezes involving North Korea-linked incidents.
Ben Zhou Backs Blockchain Investigators
Ben Zhou’s praise comes against the backdrop of Bybit’s extensive efforts to trace the cryptocurrency stolen during its 2025 security breach. Bybit reported that the attack drained approximately $1.46 billion from one of its Ethereum cold wallets. The company subsequently worked with blockchain analytics firms, investigators, exchanges and other crypto platforms to identify and freeze assets connected to the exploit.
ZachXBT identified connections between the Bybit attacker and the Lazarus Group shortly after the hack. The FBI later attributed the Bybit theft to North Korean actors tracked as TraderTraitor, strengthening the connection between the stolen assets and North Korea’s broader cryptocurrency theft campaign.
Zhou has previously made the fight against Lazarus a major priority for Bybit. Following the 2025 attack, the exchange launched its LazarusBounty initiative to encourage blockchain researchers and security specialists to trace and freeze stolen funds. Bybit described the program as an industry focused effort to disrupt cryptocurrency laundering associated with Lazarus Group.
The CEO’s continued backing of investigators such as ZachXBT also reflects the importance of public blockchain data in cryptocurrency crime investigations. Unlike traditional financial systems, many blockchain transactions remain permanently visible, allowing investigators to follow wallets, transaction routes and cross-chain movements long after an initial theft.
Lazarus Remains a Major Crypto Security Threat
The alleged $1 billion laundering network illustrates the increasingly sophisticated methods used to move cryptocurrency stolen through cyberattacks. Criminal groups can split assets across thousands of wallets, convert tokens between networks and use bridges, decentralized exchanges and other services to make tracing more difficult.
The Bybit incident remains one of the largest cryptocurrency thefts ever recorded. The FBI attributed the February 2025 attack to North Korean actors and said the stolen assets were rapidly converted and distributed across multiple blockchain addresses. Blockchain investigators subsequently tracked large portions of the stolen cryptocurrency as it moved through different networks and services.
The latest investigation also demonstrates why cooperation between crypto exchanges, blockchain analytics companies, independent investigators and law enforcement has become increasingly important. ZachXBT’s work shows how transaction analysis combined with information gathered from suspected laundering operators can reveal connections that would otherwise remain difficult to identify.
For the broader cryptocurrency industry, the episode reinforces the importance of onchain transparency and rapid response after major hacks. Ben Zhou’s support for ZachXBT signals that exchanges increasingly view independent blockchain investigators as valuable partners in recovering stolen assets and disrupting the infrastructure used to launder cryptocurrency.
While ZachXBT’s claim that the network moved more than $1 billion for Lazarus Group has not been independently confirmed in full by law enforcement, the investigation has produced specific wallet links, transaction trails and information connected to previously identified North Korea linked cryptocurrency thefts. The findings could provide investigators and crypto companies with additional intelligence as they continue tracking funds connected to Lazarus linked attacks.
