Crypto investigator ZachXBT claims he infiltrated a Chinese organized crime syndicate accused of laundering over $1 billion in cryptocurrency stolen by the North Korean hacker collective Lazarus Group.
ZachXBT discovered multiple Chinese Telegram and Discord accounts seeking assistance laundering funds from a $387 million Bitget hack. He contacted an account operator named "Jimmy Green" and posed as a money laundering client to gather intelligence.
During the operation, ZachXBT fronted approximately $350,000 to test the laundering process, incurring a 5% loss on each transaction. He documented crypto addresses and transaction details throughout.
Intelligence gathered
According to ZachXBT, Jimmy claimed his team was responsible for laundering most of the Bybit stolen funds from a $1.5 billion hack. Jimmy shared exploiter addresses and demonstrated bridging techniques using THORSwap.
When Jimmy mentioned laundering $3 million for another client, ZachXBT linked those funds to Huonie Guarantee, described as a sanctioned conglomerate that operated a multi-billion-dollar criminal marketplace. ZachXBT also connected a $100,000 freeze targeting Jimmy's transactions to the $100 million Poloniex hack from 2024.
ZachXBT's intelligence was used to freeze funds associated with the Bybit exploit and attribute illicit activity on-chain.
Investigation constraints
ZachXBT stated he cannot share certain findings sooner due to ongoing sensitive investigations with private investigators and law enforcement. He noted investigations involve personal risk from dealing with the syndicate, though he said there was "no guarantee" the operator would not disappear with funds.
ZachXBT indicated he relies on grants from foundations and donations to fund high-risk investigations.
