TLDR On-chain investigator ZachXBT invested $349,700 in an undercover operation to penetrate a suspected Chinese money laundering operation. The operation allegedly processed over $1 billion
Cryptocurrency investigator ZachXBT revealed he conducted an extensive undercover investigation to uncover a digital asset laundering operation connected to North Korean actors. He published his discoveries in a detailed post on X dated October 5.
1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.
Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. pic.twitter.com/jauRRt8875
— ZachXBT (@zachxbt) October 5, 2026
According to ZachXBT, he began operating undercover in February 2025, shortly following the Bybit security breach. He located profiles on public Telegram and Discord channels offering services to transfer illicit cryptocurrency.
ZachXBT explained that he deposited $349,700 worth of stablecoins into an Ethereum wallet. He deliberately absorbed a 5% fee on every transaction to establish credibility with a contact using the pseudonym Jimmy Green.
The investigator characterized the organization as a Chinese-based criminal enterprise. He indicated its activities extended across Hong Kong and the Chinese mainland.
bro zachxbt is actually insane
this man went undercover as a money laundering client
spent $350K of his OWN money to gain the trust of a chinese launderer who was moving bybit hack funds for north korea
the guy started sharing everything. screenshots. wallet addresses. bridge… https://t.co/LPtopGfOAU
— Bala
(@BalaiBB) October 5, 2026
He asserted the network processed more than $1 billion from various cryptocurrency hacks for the Lazarus Group. The contact purportedly revealed that nearly all assets from the Bybit incident passed through their laundering infrastructure.
A specific transaction path provided ZachXBT with his initial breakthrough. He noted that a destination wallet had previously received funding from an address appearing on Bybit’s published blocklist.
Subsequent communications provided him with advance intelligence about upcoming fund transfers. He cross-referenced these messages with on-chain data to verify the information.
On March 12, the operator transmitted a screenshot depicting an exchange of 1.192 Bitcoin for 51.73 Ether. ZachXBT successfully linked this activity to a THORChain swap involving Bybit-related assets.
Three Solana wallet addresses disclosed during their exchanges revealed a cluster containing over $12 million in funds traced to Bybit. ZachXBT observed the assets flowing across Bitcoin, Ether, Solana and Tron networks.
He reported that Tether subsequently immobilized 442,000 USDT associated with these addresses. Tether has independently announced larger freezes related to the Bybit incident through its T3 Financial Crime Unit.
By October 2025, T3-connected actions had frozen $19 million linked to the Bybit attack, Tether disclosed. The specific 442,000 USDT amount was absent from those earlier public announcements.
ZachXBT additionally stated the same source provided intelligence on separate incidents. These encompassed assets from the 2023 Poloniex compromise and a portion connected to Huione Guarantee.
The FBI assigned responsibility for the Bybit attack to North Korean entities five days following the breach. The bureau identified actors it designates as TraderTraitor as having stolen approximately $1.5 billion worth of digital assets.
Bybit explained that stolen credentials from a developer enabled the attacker to penetrate its systems. The platform stated audits revealed no compromise of its primary infrastructure.
ZachXBT indicated he transmitted his evidence to investigators and law enforcement throughout the ongoing operation. He explained he delayed publishing until October 2026 because of the investigation’s sensitive nature.
Official documentation from the FBI, Treasury and Tether has not identified the individual known as Jimmy Green. No legal proceeding has validated the complete extent of the laundering network outlined in his disclosure.
Chainalysis reports North Korean-affiliated hackers extracted $2.02 billion in cryptocurrency during 2025. The analytics firm notes investigators continue tracing proceeds from the $387 million Bitget breach that occurred in September 2026.
The post ZachXBT’s $349K Undercover Operation Exposes Chinese Money Laundering Ring for Lazarus Group appeared first on Blockonomi.
