Blockchain investigator ZachXBT disclosed on October 5, 2026, that he fronted $349,700 in USDC to build trust with a contact inside a Chinese organized crime syndicate believed to launder funds for North Korea's Lazarus Group. The undercover effort resulted in the identification of a wallet cluster holding more than $12 million connected to the Bybit exchange hack, prompting Tether to freeze 442,000 USDT.
The Operation
The investigation began on March 6, 2025, roughly one to two weeks after the Bybit exchange hack in February 2025, which resulted in approximately $1.5 billion in stolen funds. ZachXBT's contact, using the alias "Jimmy Green," received the $349,700 upfront to establish credibility.
Jimmy Green provided specific Solana addresses that allowed ZachXBT to track funds as they moved between blockchains. Using this intelligence, ZachXBT identified a wallet cluster linked to the Bybit theft. The syndicate's operations reportedly span Hong Kong and mainland China, with the network allegedly involved in laundering most of the $1.5 billion stolen from Bybit.
Stablecoins as a Choke Point
The freeze highlights the vulnerability of laundering routes that flow through stablecoins. Because Tether operates at the issuer level, USDT transfers can be halted in ways that decentralized assets like Bitcoin cannot easily be stopped. The 442,000 USDT freeze represents a small fraction of the $1.5 billion theft but demonstrates how stablecoin infrastructure creates pressure points for investigators.
Broader Impact
ZachXBT has reportedly assisted in freezing more than $75 million tied to North Korean incidents since 2022. While the identified wallet cluster and frozen USDT are small portions of the total Bybit theft, disrupting the brokers and networks that cash out stolen funds can strand assets even when original thieves remain unreachable. ZachXBT's model—deploying personal capital and accepting operational risk as an independent researcher—has produced measurable results but relies on individuals willing to undertake risks most institutions would not authorize.
