ZachXBT Fronted $350,000 to Go Undercover With the Chinese Launderers Moving North Korea's Stolen Crypto

Crypto sleuth ZachXBT spent weeks pretending to be a customer of the people who clean North Korea's stolen money, and he paid for the privilege with his own funds. In a thread on X on 5 October, the pseudonymous investigator said he had infiltrated a Chinese organized crime syndicate that, by his account, has laundered more than $1 billion across multiple exploits for the Lazarus Group. Those figures are his findings, not an official tally.

ZachXBT is probably the best-known on-chain investigator around. He kept working after a former target sued and doxxed him in 2023.

Shopping for a launderer

The operation started in February 2025, shortly after the $1.5 billion Bybit hack, which the FBI pinned on North Korea. He noticed more than 15 accounts in public Telegram and Discord groups openly asking for help with orders tied directly to the stolen funds. He messaged them posing as a client.

One went by "Jimmy Green" on Telegram. On 6 March 2025, ZachXBT funded a fresh Ethereum address with 349,700 USDC to trade with him, swapping USDC on Ethereum for USDT on Tron. The address Jimmy handed over had been funded with gas by a wallet directly traceable to Bybit exploit funds, and it sat on the public Bybit blacklist.

"For this case, I fronted $349.7K and lost 5% on each order, with no guarantee Jimmy wouldn't disappear with the funds, and an unknown amount of personal risk from dealing with the syndicate," he wrote.

A few more trades built trust. Then Jimmy started talking shop: moving Bybit funds for the DPRK ahead of time, plus basic details of operations in Hong Kong and mainland China. "We have different divisions of labor," he explained. "We take the u and distribute it to different acceptors," with "u" meaning USDT. When ZachXBT, in character, complained that the constant pinging made him "lose trust in your business," Jimmy shot back: "the team has prepared $1 million and is ready to start work at any time!"

The receipts

The chats checked out on-chain. One day Jimmy said funds would move to Solana, and the next day they did. On 12 March 2025, ZachXBT matched a screenshot Jimmy sent of himself bridging funds to an order on the THORChain explorer created within minutes.

Jimmy also shared three Solana addresses, exposing a cluster of more than $12 million in Bybit loot hopping from Bitcoin to Ether to Solana to Tron. Tether later froze 442,000 USDT linked to it. A team Jimmy knew had about $300,000 frozen in 2024, he said; ZachXBT found a 332,000 USDC freeze tied to the November 2023 Poloniex hack, which researchers have linked to Lazarus. Another $3 million in fraud proceeds Jimmy said he laundered traced back to a hot wallet of Huione Guarantee, the Telegram marketplace of Cambodia's Huione Group that FinCEN targeted over alleged laundering of at least $4 billion.

Between orders, the conversation was oddly domestic. "He talked about playing mahjong, hunting wild rabbits, food, his fat reducing meal, family life, and vacations at Disney," ZachXBT wrote.

He says he passed his findings immediately to trusted private investigators and assigned law enforcement, and that sensitivity delayed publication. Since 2022 he says he has helped action more than $75 million in freezes tied to DPRK incidents. No arrests or charges have been announced over this network.

Same playbook, new hack

The pattern hasn't gone away. On 28 September, ZachXBT said Chinese actors allegedly laundering funds from the $387 million Bitget hack, which Bitget's CEO, Elliptic and Chainalysis have linked to North Korea, were openly asking for help in public Discord and Telegram channels, just as the Bybit launderers had.

The stakes are enormous. Chainalysis says North Korea-linked hackers stole at least $6.75 billion in crypto through 2025. US prosecutors charged two Chinese nationals in 2020 with laundering more than $100 million for North Korean hackers, and OFAC sanctioned two more traders in 2023. Pyongyang's money machine also leans on remote IT workers, like the laptop farm Japan just shut down. However the money comes in, it eventually needs a human willing to move it, and some of those humans are advertising in public chats.