Blockchain investigator ZachXBT says he infiltrated a Chinese organized crime syndicate that allegedly helped launder more than $1 billion in cryptocurrency linked to North Korea’s Lazarus Group.
The investigation, disclosed on October 5, involved ZachXBT posing as a paying client and conducting real transactions to gain access to the network. He said the operation generated intelligence that helped trace funds connected to the $1.5 billion Bybit hack in February 2025.
ZachXBT Spent Nearly $350,000
According to ZachXBT, he funded a fresh Ethereum address with approximately $349,700 in USDC and accepted a 5% loss on transactions while building trust with an operator using the alias “Jimmy Green.”
The investigator said the operator provided information about transactions involving stolen cryptocurrency, allowing him to compare private communications with public blockchain activity.
That process helped ZachXBT identify a cluster containing more than $12 million in funds linked to the Bybit exploit, according to his disclosure.
Tether Froze $442,000
The investigation also reportedly contributed to the freezing of approximately 442,000 USDT associated with wallets identified during the operation.
ZachXBT said the network moved funds across multiple blockchains, including Bitcoin, Ethereum, Solana and Tron, making blockchain analysis and transaction timing important to tracking the stolen assets.
The Bybit theft was previously attributed by the FBI to North Korean actors known as TraderTraitor, who are associated with the broader Lazarus operation.
Why It Matters
The investigation highlights an increasingly important feature of crypto crime: stolen assets can be moved quickly across multiple chains, but the public nature of blockchains can also leave a detailed trail for investigators.
ZachXBT’s approach went beyond simply following wallet addresses. By interacting directly with alleged laundering intermediaries, he obtained information that could then be compared against on-chain transactions.
However, the claims about the syndicate’s total laundering volume remain ZachXBT’s assessment, and the reported $1 billion figure has not been independently established by law enforcement.
The case also demonstrates the growing role of independent blockchain investigators in tracking stolen crypto and supporting efforts to freeze illicit funds.
