ZachXBT reveals undercover investigation: Infiltrated a laundering ring suspected of working for the Lazarus Group and helped freeze funds linked to the Bybit attack
On-chain investigator ZachXBT said he posed as a customer to infiltrate a criminal ring suspected of laundering money for the North Korea-linked hacking group Lazarus Group, and helped freeze funds linked to the 2025 Bybit attack. ZachXBT said that after Bybit suffered an attack resulting in losses worth $1.5 billion in February 2025, he found more than 15 accounts in public Telegram and Discord groups seeking help handling transactions involving the stolen funds. He then contacted one Telegram user who went by the alias “Jimmy Green” and built trust through several transactions. According to his account, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address to exchange USDC for USDT on the TRON network. The source of the address’s gas funds could be traced to funds from the Bybit attack, and the address had been publicly flagged as blacklisted in connection with the attack. ZachXBT said that in subsequent conversations, the other party revealed that their team had helped handle the funds stolen from Bybit and disclosed in advance that the funds would be moved across networks such as Solana. By matching transaction times, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in funds from the Bybit attack. The funds moved across several networks, including BTC→ETH→SOL→TRON, and approximately 442,000 USDT had been frozen by Tether. The ring had also attempted to launder money through methods including Uniswap liquidity pools and low-liquidity tokens. The other party also said they had helped other clients handle approximately $3 million in proceeds from scams. ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee. ZachXBT said he fronted $3.497 million during the investigation and risked losing approximately 5% on each transaction. He promptly provided the intelligence he gathered to relevant investigative agencies and law enforcement. Since 2022, he has helped freeze more than $75 million in funds linked to North Korea-related incidents.
On-chain investigator ZachXBT said he posed as a customer to infiltrate a criminal ring suspected of laundering money for the North Korea-linked hacking group Lazarus Group, and helped freeze funds linked to the 2025 Bybit attack. ZachXBT said that after Bybit suffered an attack resulting in losses worth $1.5 billion in February 2025, he found more than 15 accounts in public Telegram and Discord groups seeking help handling transactions involving the stolen funds. He then contacted one Telegram user who went by the alias “Jimmy Green” and built trust through several transactions. According to his account, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address to exchange USDC for USDT on the TRON network. The source of the address’s gas funds could be traced to funds from the Bybit attack, and the address had been publicly flagged as blacklisted in connection with the attack. ZachXBT said that in subsequent conversations, the other party revealed that their team had helped handle the funds stolen from Bybit and disclosed in advance that the funds would be moved across networks such as Solana. By matching transaction times, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in funds from the Bybit attack. The funds moved across several networks, including BTC→ETH→SOL→TRON, and approximately 442,000 USDT had been frozen by Tether. The ring had also attempted to launder money through methods including Uniswap liquidity pools and low-liquidity tokens. The other party also said they had helped other clients handle approximately $3 million in proceeds from scams. ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee. ZachXBT said he fronted $3.497 million during the investigation and risked losing approximately 5% on each transaction. He promptly provided the intelligence he gathered to relevant investigative agencies and law enforcement. Since 2022, he has helped freeze more than $75 million in funds linked to North Korea-related incidents.