On-chain sleuth ZachXBT put up nearly $350,000 and posed as a scammer launching a token to rug-pull investors, infiltrating a Chinese gang suspected of laundering money for North Korean hackers. He traded while fishing for leads, and after lying low for weeks, pieced together chat logs and on-chain fund movements. The investigation was not made public until October 5, 2026, a year and a half after the operation began. Most dramatically, they not only treated him as a friend but volunteered where North Korean funds were going—and even tried to bring him into the operation so they could make money together.
The North Korean hackers mentioned in the video are Lazarus. Cyber operations linked to North Korea have long been seen by outsiders as one way the country raises funds. The “40% of funding” figure needs some context: a 2024 UN expert report cited a member state’s claim that about 40% of funding for North Korea’s weapons of mass destruction programs came from illicit cyber activity. That doesn’t mean every stolen coin can be traced directly to a particular missile, but it helps explain why an exchange heist can raise security concerns far beyond the crypto world.
How $1.5 billion was moved
The story begins on the evening of February 21, 2025. Bybit’s wallet administrators were going about their usual work, preparing to transfer some Ethereum out of a cold wallet. The address on the page looked right, and so did the URL, but according to the video’s account, the code behind it had already been tampered with. The administrators signed a transaction that actually handed control of the cold wallet to the attackers. In less than three minutes, about 400,000 Ethereum and other assets were transferred out, with losses approaching $1.5 billion. A signature that looked perfectly ordinary became the gateway to a massive theft.
According to the video’s account, about an hour after the theft, ZachXBT posted a warning on Telegram—24 minutes before Bybit’s owner publicly acknowledged it. That night, he shared more clues and concluded that the attack was linked to North Korean hackers. An investigator with over a million followers on X, he had also been scammed in the crypto world earlier in his career. He later began specializing in tracing stolen funds through on-chain records. Bybit’s owner, meanwhile, livestreamed through the night, borrowing and buying coins to fill the shortfall. On February 26, the FBI issued a statement attributing the theft of roughly $1.5 billion to the North Korea-linked TraderTraitor activity.
Being able to see where funds are going doesn’t mean you can stop them. Ethereum transfers are public and transparent, and exchanges can track them and take action against associated addresses. But the video says the stolen Ethereum was moved out in just ten days, with most of it converted to Bitcoin, largely through the THORChain cross-chain protocol. It doesn’t require traditional account registration, making it very difficult to intercept; the swaps also generated about $5.5 million in fees. But converting the coins to Bitcoin solved only the problem of moving them. Turning the stolen funds into money that could actually be spent still required someone to take them in.
Chinese intermediaries handling stolen funds for North Korean hackers have appeared in public cases before. In 2020, the U.S. Department of Justice charged Tian Yinyin and Li Jiadong with laundering more than $100 million in crypto assets for North Korea-linked hackers. According to the case details cited in the video, proceeds from coin sales flowed into Chinese bank cards, and one of Tian Yinyin’s China Guangfa Bank cards received more than 200 million yuan. These were allegations and case materials from that time, and they cannot substitute for evidence in this investigation. But they show that the laundering network between coin theft and cashing out has long been a crucial link.
The most hidden business was exposed in a public customer-support group
In the Bybit case, the video says, North Korean operatives outsourced much of the money laundering to outside groups. Those who took over might not only move the coins but also front money and bear the pressure of funds getting stuck midway. So when an exchange was delayed, they would go to the protocol’s public groups and contact support like ordinary users, asking them to hurry up. That contrast was exactly what caught ZachXBT’s attention: the money trail could be split up in complex ways, but the people actually handling it would get anxious, complain, and volunteer transaction IDs. That was how a crack in the underground operation appeared in a public customer-support group.
A few days after the Bybit incident, ZachXBT found more than 15 similar accounts in public Telegram and Discord groups. He tracked each of their requests for help and found they were all connected to Bybit’s stolen funds. The video also says some customer-support agents privately exchanged tips with him and created a small group called “Bybit Money Launderers.” When someone posted a screenshot of an account and asked whether they should ban it outright, he told them to wait: let the person speak up or contact support again. Keeping the account around could mean keeping a lead on the next transaction.
One of the accounts was called Jimmy Green. On February 25, he complained in THORChain’s group of tens of thousands that an exchange hadn’t gone through. When customer support asked him to post the transaction ID, he did. ZachXBT traced the ID and found that the transaction stuck was for more than four Ethereum, and that the payment wallet had received 64 Ethereum from a Bybit hacker address earlier that day. Jimmy’s bio also advertised, in Chinese, services for processing marked Bitcoin, Ethereum, Solana, and Tron coins, along with a coin-mixing service to keep funds separated. His identity was still unknown, but his business ad was already out in the open.
Less than an hour after Jimmy spoke in the group, ZachXBT sent him a private message. Using the alias KJ, he pretended to have marked Ethereum that he wanted to exchange for “clean U” on Tron. Jimmy replied quickly using translation software, concerned only with the address, amount, and fee. ZachXBT said they should start with a small order and expand if it went well, and they agreed on a 5% fee. Jimmy replied, “OK.” Later, when someone asked if KJ was short for Kim Jong Un, he joked, “You found me out.” Just like that, the undercover investigator was on the other party’s client list.
Every transaction traded money lost for intelligence
On March 6, ZachXBT opened a new wallet and deposited nearly 350,000 USDC, then sent Jimmy a screenshot of the balance. Jimmy sent him a payment QR code. The first transaction was just $100; two minutes later, 100 Tron USDT came back, with no fee for the test. The second was increased to $10,000. After more than 40 minutes, $9,500 arrived—exactly 5% deducted. Jimmy explained that he was on his way to the office, told his client not to worry, and stressed that honesty came first. His practiced sales pitch made a suspected money-laundering transaction sound like an ordinary exchange service.
The third transaction was for $25,000. Jimmy said it was already nighttime where he was and he had to call someone in, so things might be slow at first. ZachXBT took the opportunity to ask: Were they doing this alone, or as a team? Jimmy replied that handling it alone made it easy to get frozen, so each person took care of one part. After receiving the U, they split it among different OTC brokers—people who exchange stablecoins for cash off-exchange. The final payout was $23,750, again with exactly 5% deducted. His answers showed the investigator that this was no longer just an account taking orders, but a processing network with defined roles and connections upstream and downstream.
What truly linked Jimmy to the Bybit stolen funds was an unremarkable miner fee. The receiving address Jimmy provided was a new wallet. Ten minutes after it received the money, another address sent over a small amount of Ethereum to pay the transfer fee. The address that supplied the miner fee was on the blacklist of stolen-fund addresses published by Bybit. The chat partner, the receiving wallet, and a known stolen-fund address thus formed a chain. After completing the first few transactions, ZachXBT didn’t exchange the remaining more than $310,000 in the wallet; he moved the money out that same day.
Over the next few days, ZachXBT barely responded to Jimmy. On March 10, Jimmy sent messages from early morning, first greetings and then, eventually, just a question mark. ZachXBT pretended to be annoyed and told him to stop constantly chasing him; he’d get in touch if he had an order. Jimmy quickly explained that the North Korean coins had been paused for ten days, so the team needed work. They had already prepared $1 million and could start at any time. He thought he was trying to win a client, but in reality he had revealed the business slowdown, the source upstream, and the team’s available funds. The investigator got another lead from the conversation.
ZachXBT said he had only small orders this week, and Jimmy was willing to take them. He also warned that both USDC and USDT could be frozen and that scrutiny had been especially intense lately. To prove he had the funds, Jimmy sent a photo of himself holding a phone, with nearly 1.2 million U in the wallet—more than the $1 million he had just mentioned. He acknowledged the pressure of being tracked while assuring him that they specialized in keeping funds separate and preventing freezes, and that processing them wasn’t difficult. The wallet balance, ability to take orders, and promises of safety were all originally sales pitches, but ZachXBT treated them as material to verify.
In one chat, Jimmy said the North Koreans would start work the next day and Bitcoin would be transferred back to Solana. He also tried to recruit ZachXBT, saying there was plenty of this work and they could make money together when he had time. He promised that the U he gave him wouldn’t be frozen and that he’d compensate him if it was. And the next day, the Bybit funds did indeed move toward Solana. For the investigator, accurately predicting the movement of funds was more valuable than mere bragging. ZachXBT decided to keep placing orders, risking a 5% loss on each one to obtain deeper intelligence, then check each claim against the on-chain records.
Who revealed that Boss Jin had fifty bitcoins?
On March 12, ZachXBT placed another $50,000 order. He asked if Jimmy was busy, and Jimmy said he was processing North Korean Bitcoin. He also claimed, “Kim Jong Un just released 50,” and that his team had received only 30 of them. Jimmy went on to explain that the upstream party was worried about the U being frozen, so they had started testing Bitcoin and were being more cautious about releasing funds. It’s important to be clear: 50 was the amount Jimmy claimed had been released, not an amount confirmed to have been frozen. And repeated mentions of Kim Jong Un in the chat do not prove that Kim Jong Un personally ordered or handled each transaction.
Jimmy also tried investigating his “clients.” He noticed that ZachXBT had transferred more than $300,000 and asked whether he had hired someone else to do it. He warned him that there were lots of scammers around and not to experiment carelessly, or his money might get stolen. Then Jimmy sent a screenshot of his computer showing an order to exchange a little over one bitcoin for more than 50 Ethereum. In the chat, he called ZachXBT “my friend,” but had him saved as “foreigner.” ZachXBT matched the screenshot’s time and amount against THORChain records, then traced the Bitcoin’s source, which once again led back to Bybit.
Provide subtitles (optional)
The two began chatting more and more like old friends. Jimmy asked whether he had eaten and whether he played mahjong, and sent photos of two huge pots of food. One weekend, he said a friend had asked him to process $3 million in scam proceeds. The fee was low, so he hadn’t wanted to take the job, but his friend had asked, so he had to work through the night. The video says the money was later transferred first as $100,000 and then as $2.9 million. ZachXBT tracked it all the way to wallets associated with Huione in Cambodia. Ordinary dinner chatter appeared alongside huge sums of money, gradually bringing the order-taker’s network into focus.
Jimmy’s most outrageous claim was that his team had handled most of the $1.5 billion in Ethereum stolen from Bybit. We can’t determine how much of that claim was exaggerated just by taking his word for it. The video preserves ZachXBT’s more cautious assessment: what the other party described matched the on-chain patterns he had observed; taken together, the funds the group processed for Lazarus across multiple attacks may have exceeded $1 billion. The group members’ boasts, the investigator’s estimate, and specific transactions that can be verified do not carry the same evidentiary weight, and should be considered separately.
Three addresses led to more than $12 million
Jimmy had also sent three Solana addresses, saying he was working on them that night and converting the coins on that chain back to Tron. ZachXBT traced the addresses and uncovered an entire stream of Bybit-linked stolen funds in motion, totaling more than $12 million. Until then, the investigator had mainly relied on the conversation to elicit information. At this point, the specific addresses turned those descriptions into traceable paths for the funds. Moving back and forth between different chains certainly made tracking more difficult, but if an operator voluntarily revealed one entry point, addresses that had seemed scattered could potentially be connected again.
The video also describes a method for disguising the source of funds using token liquidity pools. The group issued several tokens that almost nobody traded, including WAFF, FIZZ, BUTTER, and SQUIRT, then used liquidity pools to make the stolen funds look like ordinary trades and liquidity earnings. On the surface, the money appeared to come from the proceeds of a pool; tracing the addresses before and after could still expose its source. ZachXBT gave the addresses he found to investigators. The important evidence is not just “what tools were used,” but whether the funds involved before and after the operation can be matched to known stolen assets.
Jimmy had previously bragged that they monitored risks in advance and could give notice a day before trouble hit. He even claimed to have connections inside Tether. But on March 14, Tether, the issuer of USDT, froze a WAFF-related pool. The address that created the pool had withdrawn about $18,000 just half an hour earlier, leaving roughly 442,000 U locked inside. The video says ZachXBT was able to trace more than $4,000 in fee losses, while the investigation led to a much larger freeze. This doesn’t prove that Jimmy really had inside connections. If anything, it shows that his promised “protection from freezing” failed to protect the funds involved.
ZachXBT gave these materials to the FBI but didn’t immediately make them public. On March 18, four days after the liquidity pool was frozen, he vented in his channel, saying he had been helping freeze Bybit-related funds every day lately and had seen the ugly side of the industry. At the time, outsiders didn’t know who he was chatting with or that he was using his own money to obtain those leads. For someone who posts publicly about their investigations, a post can go out in moments; but when a lead concerns an ongoing investigation, the timing of disclosure is no longer his decision alone. So this story remained silent for a long time.
A year and a half later, the same order-chasing happened again
Freezing $442,000 was only a limited breakthrough. According to figures from August 2026 cited in the video, the total amount recovered and frozen in the Bybit case was less than $80 million, about 5% of the $1.5 billion stolen. Most of the losses remained difficult to recover, and new attacks had not stopped. In September 2026, Bitget suffered another security incident involving about $388 million. Public analyses pointed to North Korea-linked hackers, and ZachXBT observed that people handling the associated stolen funds were once again turning to public groups to chase up their orders. The case had changed, but the operators’ habit of anxiously contacting customer support was strikingly similar.
The video shows an account called jack saying that the Bitcoin he was exchanging still hadn’t arrived after nearly a whole day. He was very worried, saying he’d be in serious trouble if the money was lost. Customer support replied with a picture of Kim Jong Un waving and asked, “Will Kim Jong Un be angry?” before telling him to switch industries. Some people asked customer support for help; another account was simply called “help me.” Even more remarkably, judging by the name, the agent who sent the picture was the same person who had asked Jimmy to provide a transaction ID a year and a half earlier. Behind the amusing group chat was the operators’ fear that something had gone wrong with the funds, and the recurring pattern of public pleas for help giving away clues.
On October 5, 2026, ZachXBT finally made the Jimmy investigation public. He said he had held off for a year and a half because it involved an active investigation and wasn’t suitable for release. He had put up nearly $350,000 of his own money, but that didn’t mean it was all lost; each completed transaction cost about 5% in fees, and there was also the risk the other party would run off with the money. The video says no one paid for this investigation; he usually relies on foundation funding and donations. When someone online urged him to hire a bodyguard, he said 24-hour protection was a bit beyond his budget. Following the trail cost him more than time—it also put his money and personal safety at risk.
Later, Jimmy’s Telegram account was deleted. The messages in the THORChain group where he had chased up an order remained, but his name changed to Deleted Account. ZachXBT didn’t say how the two lost contact, whether Jimmy became suspicious, what his real identity was, or whether he had been arrested. The account’s disappearance can easily make readers think the story is over, but the public materials don’t support that conclusion. What we can see are chat screenshots, money trails, and some of the funds that were frozen. What we can’t see is what happened to this order-taker, or where the case will go from here.
At the end of his public account of the investigation, ZachXBT included a meme: a cartoon character lounges back smoking a cigar, a pile of cash on the table, with the words “crime pays.” It reads more like a bitter joke: huge thefts can happen quickly, while recovering the losses is slow and dangerous. The cryptocurrency industry is close to the money, and investigators can therefore find themselves close to powerful hackers, laundering organizations, and state-level forces. This undercover investigation didn’t recover all the stolen funds, but it brought the division of labor behind the scenes and crucial leads into public view. The person who took those risks deserves to be seen.