Shocking! @zachxbt
This wasn’t just “on-chain tracking” anymore. He actually brought $350,000 and went undercover in a money-laundering ring.
He just went public with an experience worthy of a crypto version of *Infernal Affairs*:
To investigate where funds stolen by North Korea’s Lazarus Group were going, ZachXBT posed as a “big client” and infiltrated what he described as a Chinese organized-crime money-laundering network.
2025 #bybit
After $1.5 billion was stolen, he discovered that more than a dozen accounts were brazenly asking in public Telegram and Discord groups:
“Why is my order stuck?”
And these so-called “orders” were actually tied to funds stolen from Bybit.
So ZachXBT tracked down one of the aliases: Jimmy Green
But chatting alone wasn’t enough. To gain their trust, he actually put up 349,700 USDC and started trading with Jimmy, one transaction at a time.
Even more impressive, he willingly took on a loss of about 5% on every transaction.
He wasn’t spending investigation funds; he was paying real money for information.
Then the fish started biting.
Jimmy gradually let his guard down, even telling ZachXBT in advance what the next move for the stolen funds would be.
Once, he said, “Tomorrow, the funds will move to Solana.”
The next day, the funds really did move on-chain.
Following the trail, ZachXBT eventually uncovered a cluster of wallets tied to more than $12 million in stolen Bybit funds:
BTC → ETH → SOL → TRON
Cross-chain transfers, token swaps, splitting funds, then moving them again.
About 442,000 USDT of it was later successfully frozen by Tether.
Even more astonishingly, Jimmy claimed that his team handled a large portion of the funds stolen from Bybit.
This account comes from Jimmy’s own statements to ZachXBT and has not been independently confirmed by law enforcement. However, the on-chain flow of funds closely matches the laundering activity ZachXBT observed at the time.
What’s truly chilling is that this wasn’t an isolated incident at all.
Over the past few years, major incidents publicly attributed to or strongly suspected of being linked to the DPRK/Lazarus by government agencies, security firms, or on-chain investigators include:
🇯🇵 DMM Bitcoin: approx. $308M
🇮🇳 WazirX: approx. $230M+
🟡 Bybit: approx. $1.5B
🟢 Kelp DAO: approx. $292M
🔵 Bitget: approx. $387.5M
These incidents alone amounted to nearly $2.7 billion.
Bybit and DMM have been officially attributed by the FBI to North Korea’s TraderTraitor, while Kelp DAO, Bitget, and others have been linked by LayerZero, Chainalysis
Until authorities pointed to DPRK/Lazarus.
What ZachXBT exposed this time may reveal something even more frightening than how hackers steal money: North Korean hackers steal it, and transnational criminal networks launder it.
The stolen ETH, BTC, and USDT weren’t simply tossed into a mixer and forgotten. They went through an increasingly industrialized pipeline:
Hack → split into wallets → cross-chain bridge → token swaps on DEXs → hop between BTC / ETH / SOL / TRON → low-liquidity LPs → mixers / OTC → funds gradually lose their identity
The blockchain is transparent, but when money laundering itself becomes a global professional service, transparency ≠ recovery.
The U.S. Treasury had already identified the Lazarus Group as a state-sponsored hacking group linked to North Korea’s Reconnaissance General Bureau (RGB), and said that North Korea has long used digital asset theft to generate revenue.
And the most surreal detail of the whole story is:
ZachXBT and Jimmy didn’t just talk about money laundering. They also talked about mahjong, catching hares, meals for losing weight, family life, and vacations to Disney.
On this side of the screen might be an ordinary person having a meal for losing weight and planning a family trip to Disney.
On the other side of the screen might be someone helping the world’s most notorious hacking group launder hundreds of millions of dollars.
That’s what makes crypto’s criminal underworld so terrifying. You think Lazarus is just a group of hackers hiding in a server room in North Korea.
But what may really sustain it is an underground financial network spanning countries, exchanges, OTC desks, cross-chain bridges, DEXs, and mixers.
Since 2022, ZachXBT alone has helped facilitate the freezing of more than $75 million in DPRK-linked funds.
This time, he even used his own $349,700 as bait.
There’s no real night on the blockchain. As long as someone keeps looking, every step the money takes leaves a trail.