CryptoSlate
ZachXBT says he posed as a crypto client to infiltrate a Chinese laundering syndicate that he alleges moved more than $1 billion for North Korea's Lazarus Group. He says he advanced 349,700 USDC in repeated trades, then traced a cluster involving more than $12 million in funds stolen from Bybit. Tether later froze 442,000 USDT linked to that cluster.
Why it matters
The investigation shows how direct contact with alleged laundering intermediaries can add intelligence to on-chain tracing. ZachXBT says a contact using the alias Jimmy Green discussed planned movements of Bybit funds before they happened. In one instance, he matched a transfer screenshot to a THORChain order created within minutes of the message, and said three Solana addresses exposed flows across Bitcoin, Ethereum, Solana and Tron.
The scale of the alleged syndicate and the links to Jimmy Green are ZachXBT's findings. Separately, the FBI said North Korea stole approximately $1.5 billion in virtual assets from Bybit on or around Feb. 21, 2025, and urged services to block transactions connected to laundering addresses.
Market impact
The reported 442,000 USDT freeze is distinct from the more than $12 million in Bybit funds ZachXBT says he traced. He also linked a separate 332,000 USDC freeze in 2024 to funds tied to the Poloniex exploit. The account highlights the role stablecoin issuers can play in disrupting suspected laundering when funds are identified and frozen.
ZachXBT says he lost 5% on each order used to build trust, but did not quantify his total net loss. He has called for continued grants and individual donations to support higher-risk investigations.
Frequently asked questions
-
How did ZachXBT gain access to the alleged laundering network?
He says he posed as a cryptocurrency client and completed repeated stablecoin trades, advancing 349,700 USDC to build a relationship with a contact.
-
How much Bybit exploit money did ZachXBT say he traced?
He reported tracing a cluster involving more than $12 million in Bybit exploit funds across Bitcoin, Ethereum, Solana and Tron.
-
How much USDT did Tether freeze?
ZachXBT reported that Tether froze 442,000 USDT linked to the cluster. That amount is distinct from the more than $12 million he said he traced.
-
What did the FBI say about the Bybit theft?
The FBI said North Korea stole approximately $1.5 billion in virtual assets from Bybit on or around Feb. 21, 2025, and urged services to block linked laundering transactions.
-
Did ZachXBT disclose his total loss from the trades?
No. He said he lost 5% on each order but did not quantify his total net loss.
CoinTelegraph
CoinDesk
WuBlockchain
TheBlock