Pseudonymous on-chain investigator ZachXBT says he fronted $349,700 of his own funds while posing as a client of a Chinese money laundering syndicate working for North Korea's Lazarus Group. His undercover operation targeted launderers moving funds stolen in the February 2025 Bybit exchange hack, which resulted in $1.5 billion in losses.
ZachXBT documented his infiltration through conversations with an operative using the alias "Jimmy Green" on Telegram. Beginning in March 2025, he conducted multiple transactions while accepting a 5% loss on each order to build trust and gather actionable intelligence. The investigator matched on-chain activity to the conversations in real time, tracking fund movements across multiple blockchains.
Through the intelligence gathered, ZachXBT identified a cluster of more than $12 million in Bybit funds being swapped between Bitcoin, Ethereum, Solana, and Tron. Tether subsequently froze 442,000 USDT linked to the cluster. The investigation also uncovered connections to the Poloniex exchange hack and Huione Guarantee, a Telegram marketplace where criminals sold laundering services.
ZachXBT has built a reputation as the most prolific on-chain investigator in cryptocurrency, tracing stolen funds and attributing major hacks using public blockchain data. He correctly attributed the Bybit exploit to TraderTraitor, a North Korean hacking group tracked by the FBI, before the agency's official confirmation. He has also previously traced connections between Lazarus Group and earlier attacks on the Phemex and BingX exchanges.
According to ZachXBT, he has helped action over $75 million in freezes related to North Korean incidents since 2022. He funds his investigative work through grants from foundations and donations from individuals. In February 2025, blockchain security firm Paradigm hired him as an incident response advisor.
