Blockchain investigator ZachXBT disclosed on October 5 that he infiltrated a Chinese cryptocurrency laundering syndicate by posing as a trading client and funding repeated stablecoin exchanges. According to his investigation, the network laundered more than $1 billion across various exploits attributed to Lazarus Group.
Building Trust Through Trading
ZachXBT's operation began following a February 2025 exploit at Bybit, during which he observed numerous accounts in public Telegram and Discord groups seeking assistance with orders he believed were connected to stolen funds. He initiated contact with several accounts, eventually connecting with someone using the alias Jimmy Green.
On March 6, 2025, ZachXBT funded an Ethereum address with 349,700 USDC to begin transactions with the contact. The arrangement involved exchanging his USDC on Ethereum for the contact's USDT on Tron. Through repeated transactions, he established sufficient credibility for deeper discussions.
Intelligence Gathering
As trust developed, the contact began disclosing details about moving Bybit funds to North Korea before movements occurred. These conversations also referenced operations in Hong Kong and mainland China. In one instance, the contact predicted that funds would move to Solana, a prediction confirmed the following day.
On March 12, 2025, the contact sent a screenshot of a cross-blockchain transfer. ZachXBT matched the amounts and timing to a transaction on the THORChain explorer created within minutes of the message.
The contact provided three Solana addresses that exposed a cluster involving more than $12 million in Bybit exploit funds moving across Bitcoin, Ethereum, Solana, and Tron. Tether subsequently froze 442,000 USDT linked to this cluster.
FBI Attribution and Broader Scope
The FBI alerted the public on February 26, 2025, that North Korea stole approximately $1.5 billion in virtual assets from Bybit on or about February 21. The bureau labeled the specific malicious activity as TraderTraitor and noted that stolen assets had been converted to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains.
ZachXBT's investigation also identified connections to other exploits. The contact referenced a team whose funds had been frozen in 2024, which ZachXBT matched to an on-chain freeze of 332,000 USDC tied to the Poloniex exploit.
Investigation Costs
ZachXBT disclosed that he fronted 349,700 USDC for the investigation and incurred a 5% loss on each order. He appealed for continued foundation grants and individual donations to support similar high-risk investigations, noting that intelligence from these trades contributed to freezing funds tied to the Bybit exploit.
