ZachXBT spent $350K undercover to infiltrate Lazarus-linked laundering ring

ZachXBT says he spent $349.7K of his own money to infiltrate a Chinese crime syndicate that has laundered more than $1 billion for North Korea's Lazarus Group, revealing the operation on October 5 in a thread on X. Posing as a laundering client, the pseudonymous on-chain investigator said he gathered intelligence that helped freeze funds from the February 2025 Bybit exploit.

The undercover work began on March 6, 2025, when ZachXBT said he funded a new Ethereum address with 349.7K USDC and started transacting with an alleged syndicate member who used the Telegram handle Jimmy Green." He accepted a 5% loss on each order, he said, with no guarantee the contact would not simply vanish with the funds, plus what he described as an unknown amount of personal risk.

A $12 million cluster and a Tether freeze

The sting's biggest payoff, per ZachXBT's account, came when his contact shared three Solana addresses that exposed a cluster of more than $12 million in Bybit exploit funds being swapped in real time, hopping from Bitcoin to Ether to Solana and finally to Tron. Chain-hopping across four networks is the core technique in the Lazarus playbook: each jump makes wallet-level tracing harder, but the cluster still anchored to Tron, where Tether controls the ability to freeze addresses holding USDT. Tether later froze 442,000 USDT linked to the cluster, ZachXBT said.

The February 2025 Bybit hack caused $1.5 billion in losses, and the FBI attributed it to North Korean hackers it tracks as TraderTraitor. ZachXBT said he began the operation after noticing more than 15 accounts in public Telegram and Discord groups asking for help moving funds directly tied to the stolen haul. Since 2022, he said he has helped action more than $75 million in freezes tied to North Korean incidents.

A pipeline that keeps resurfacing

The same laundering pattern reappeared after the late-September Bitget hack, which cost $387 million and was linked to North Korea by the exchange's CEO and by tracing firms Elliptic and Chainalysis. ZachXBT's Telegram contact described a division of labor in the operation: We have different divisions of labor. We take the u and distribute it to different acceptors."

No arrests of the alleged syndicate members have been reported, and the figures in the thread come from ZachXBT's own account. The findings fed freezes that began with the Bybit exploit in February 2025.

The post ZachXBT spent $350K undercover to infiltrate Lazarus-linked laundering ring appeared first on Techreport.