Crypto investigator ZachXBT says he used $349,700 of his own money to pose as a customer of a Chinese laundering syndicate allegedly handling funds for North Korea-linked hackers, helping identify more than $12 million connected to the 2025 Bybit exploit.
In a report published by Decrypt, the pseudonymous investigator said he funded an Ethereum address with 349,700 USDC on March 6, 2025. He used the funds to conduct transactions with a Telegram contact known as “Jimmy Green,” accepting a 5% loss on each order while trying to establish credibility with the group.
The operation followed the February 2025 attack on crypto exchange Bybit, which caused about $1.5 billion in losses. The FBI attributed that incident to North Korean hackers tracked as TraderTraitor. ZachXBT said the laundering network he approached was a Chinese criminal group working for the Democratic People’s Republic of Korea, or DPRK.
How the undercover operation worked
ZachXBT said he had noticed more than 15 accounts seeking help with orders connected to stolen funds in public Telegram and Discord groups shortly after the Bybit attack. He began communicating with one of those accounts and created a new address for the transactions.
The arrangement involved sending USDC on Ethereum in exchange for USDT on the Tron network. ZachXBT said the receiving address had been funded for transaction fees by a wallet directly traceable to funds from the Bybit exploit and listed on a public blacklist associated with the attack.
After completing several transactions, he said, the contact began discussing the movement of Bybit funds and provided information about the group’s operations in Hong Kong and mainland China. ZachXBT said one detail was later supported by blockchain activity: the contact predicted that funds would move to Solana, and the transactions occurred the next day.
Maintaining the undercover identity required him to continue accepting losses. He said he had no guarantee that the contact would not take the money and disappear, while his interactions with the alleged syndicate also created an unspecified personal risk.
The contact later claimed that the team had prepared $1 million and was ready to begin work. In another exchange, he described a structure in which incoming USDT was distributed among different “acceptors,” or people handling separate parts of the laundering process.
Blockchain trail and freezes
ZachXBT said the conversations became particularly useful on March 12, 2025. He matched a screenshot showing funds being bridged with an order recorded within minutes on Thorchain, a decentralized protocol that facilitates swaps between blockchain networks.
The contact then shared three Solana addresses. According to ZachXBT, those addresses revealed a cluster containing more than $12 million linked to the Bybit theft. The funds moved through several networks, including Bitcoin, Ethereum, Solana and Tron, as the operators attempted to convert and disperse them.
Tether subsequently froze 442,000 USDT associated with the cluster. Stablecoins such as USDT are digital tokens designed to track the value of a fiat currency, and their issuers can sometimes restrict or freeze tokens held at identified addresses.
The chats also gave ZachXBT other information that he said could be checked against public blockchain records. The contact mentioned that a team had lost access to about $300,000 in a 2024 freeze. ZachXBT linked that incident to 332,000 USDC stolen during the November 2023 Poloniex exploit, an attack that drained more than $100 million from the exchange and has been associated by researchers with the Lazarus Group.
He also traced a separate claim involving $3 million in fraud proceeds to a hot wallet used by Huione Guarantee, a Telegram-based marketplace associated with laundering services and stolen data. Huione Guarantee is part of Cambodia-based Huione Group, which the U.S. Treasury’s Financial Crimes Enforcement Network has targeted over alleged laundering of at least $4 billion. Telegram banned the marketplace in May 2025, while former Huione Group chairman Li Xiong was arrested after Cambodia deported him, according to the source material.
ZachXBT’s wider role in crypto investigations
ZachXBT is one of the best-known independent on-chain investigators in the cryptocurrency sector. His work relies on public blockchain records to follow stolen assets and connect wallet activity with hacks, scams and laundering operations. He has continued investigating despite being sued and exposed by a former target in 2023.
He said he identified the Bybit attackers’ connection to Lazarus Group on the day of the exploit, before the FBI publicly backed the attribution days later. He also linked wallets used in the laundering effort to earlier attacks involving Phemex and BingX.
In 2024, his tracing of approximately 4,100 stolen bitcoin belonging to a Genesis creditor helped lead to arrests. Paradigm hired him as an incident-response adviser in February 2025, and co-founder Matt Huang said at the time that ZachXBT had helped return more than $350 million to victims of hacks and scams.
ZachXBT said grants from foundations and donations from individuals finance his investigations. He added that, since 2022, his work had helped enable freezes involving more than $75 million connected to DPRK-related incidents. He said information was passed quickly to trusted private-sector investigators and law-enforcement agencies, while the sensitivity of the investigation prevented him from publishing details earlier.
Moneyiar market picture
Moneyiar market data at the stated times show mixed performance among the listed assets:
- OriginTrail (TRAC): $0.4004083068, down 3.3% over 24 hours and 7.35% over seven days, as of October 7, 2026, 10:33 a.m. +03:30.
- RealLink (REAL): $0.0100747766, down 86.56% over 24 hours and 86.35% over seven days, as of September 15, 2026, 7:04 a.m. +03:30.
- REAL (ASSET): $0.2063109401, up 7.73% over 24 hours but down 11.35% over seven days, as of October 3, 2026, 1:04 p.m. +03:30.
- Alchemy Pay (ACH): $0.0057151335, down 5.73% over 24 hours and 7.61% over seven days, as of October 7, 2026, 10:33 a.m. +03:30.
