On-chain investigator ZachXBT revealed details of an extensive undercover investigation into a digital asset laundering operation connected to North Korean actors. According to his disclosure published on X on October 5, ZachXBT infiltrated what he characterized as a Chinese-based criminal enterprise with operations extending across Hong Kong and mainland China.
ZachXBT began the undercover operation in February 2025, shortly after the Bybit security breach. He located profiles on public Telegram and Discord channels offering money laundering services. To establish credibility, ZachXBT deposited $349,700 worth of stablecoins into an Ethereum wallet and deliberately absorbed a 5% fee on every transaction while communicating with a contact using the pseudonym Jimmy Green.
According to ZachXBT's investigation, the network processed more than $1 billion from various cryptocurrency hacks for the Lazarus Group. The contact purportedly revealed that nearly all assets from the Bybit incident passed through their laundering infrastructure.
ZachXBT tracked specific transaction paths, including a March 12 transaction involving 1.192 Bitcoin exchanged for 51.73 Ether through a THORChain swap. He cross-referenced communications with on-chain data to verify the information and traced assets flowing across Bitcoin, Ether, Solana, and Tron networks.
Three Solana wallet addresses disclosed during the exchanges revealed a cluster containing over $12 million in funds traced to Bybit. Following ZachXBT's report, Tether subsequently immobilized 442,000 USDT associated with these addresses. Tether's T3 Financial Crime Unit announced that by October 2025, T3-connected actions had frozen $19 million linked to the Bybit attack.
The FBI assigned responsibility for the Bybit attack to North Korean entities, identifying actors designated as TraderTraitor as having stolen approximately $1.5 billion worth of digital assets. Bybit stated that stolen developer credentials enabled the attacker to penetrate its systems.
ZachXBT indicated he transmitted evidence to investigators and law enforcement throughout the operation and delayed publishing until October 2026 due to the investigation's sensitive nature. Official documentation from the FBI, Treasury, and Tether has not independently identified the individual known as Jimmy Green, and no legal proceeding has validated the complete extent of the laundering network outlined in his disclosure.
According to Chainalysis, North Korean-affiliated hackers extracted $2.02 billion in cryptocurrency during 2025, bringing their cumulative total beyond $6.75 billion.
