ZachXBT said that he fronted $349,700 on an undercover operation that helped uncover laundering activity linked to the Lazarus Group.
ByChayanika Deka
ZachXBT is back with another major crypto expose. This time, the onchain investigator said he infiltrated a Chinese organized crime syndicate that has laundered more than $1 billion across multiple exploits for the notorious Lazarus Group.
After posing as a client, ZachXBT said that he gathered information that helped action freezes linked to the February 2025 Bybit exploit.
Inside the Chinese Crime Syndicate
The investigation started shortly after the $1.5 billion
The investigation started shortly after the $1.5 billion Bybit exploit. The attack was attributed to the DPRK-linked group TraderTraitor. ZachXBT noticed more than 15 accounts on public Telegram and Discord groups asking for help with orders tied directly to the stolen funds. He contacted several of those accounts. One of them used the alias “Jimmy Green” on Telegram.
On March 6, 2025, ZachXBT funded a new Ethereum address with 349,700 USDC, which he planned to use for several transactions with the individual.
Jimmy gave him an address to send USDC to in exchange for USDT on Tron. The investigator then found that the address had been funded with gas by another wallet that could be directly traced to funds from the Bybit exploit. He then continued making trades with Jimmy to build trust.
That eventually led to Jimmy sharing more information
That eventually led to Jimmy sharing more information about the operation. According to ZachXBT, the alleged launderer talked about moving Bybit funds for DPRK actors and gave basic details about the group’s operations in Hong Kong and mainland China. In one example, Jimmy told ZachXBT one day before it happened that funds would be moved to Solana. The next day, the funds were indeed moved to Solana.
Jimmy also claimed that his team had laundered most of the $1.5 billion stolen from Bybit. ZachXBT said this was consistent with the laundering patterns he had observed. On March 12, 2025, Jimmy shared a screenshot showing himself bridging funds. The onchain sleuth then matched the screenshot to a transaction on the THORChain explorer using the amounts and timing.
