Blockchain investigator ZachXBT has revealed an audacious undercover operation where he personally expended nearly $350,000 to penetrate an alleged Chinese money-laundering network with direct ties to North Korea’s notorious Lazarus Group. This high-stakes infiltration, detailed in a public post on X (formerly Twitter) on October 5, 2025, played a critical role in exposing over $12 million in illicit funds connected to the massive $1.5 billion Bybit cryptocurrency hack that occurred in February 2025. The extraordinary personal financial risk undertaken by the pseudonymous analyst underscores the increasing sophistication and determination required to combat state-sponsored cybercrime in the rapidly evolving digital asset landscape.

The Audacious Undercover Operation: Infiltrating a Global Laundering Ring

ZachXBT’s investigation commenced in early 2025, driven by observations of numerous accounts in public Telegram and Discord groups soliciting assistance with transactions involving funds clearly linked to the Bybit exploit. Recognizing a pattern, the investigator chose a path far more dangerous and costly than typical on-chain analysis: he decided to go undercover. Posing as a client seeking to launder illicit cryptocurrency, ZachXBT deliberately engaged with one of these contacts, who operated under the alias "Jimmy Green." This direct engagement was not merely about tracking transactions from a distance; it was about gaining an insider’s perspective on the operational mechanics, personnel, and infrastructure of a sophisticated criminal enterprise.

On March 6, 2025, ZachXBT initiated his undercover persona by funding a new Ethereum address with a substantial 349,700 USDC (USD Coin), a stablecoin pegged to the US dollar. This significant sum served as his "investment" into the network, a necessary gamble to establish credibility. The initial arrangement involved exchanging USDC for USDT (Tether) on the Tron network, a common method for obfuscating transaction origins and leveraging different blockchain ecosystems. Crucially, ZachXBT noted that the wallet provided by Jimmy Green had already received gas fees from an address directly linked to the Bybit exploit funds and was listed on Bybit’s public blacklist, immediately validating the network’s connection to the stolen assets.

To further cement his credibility and delve deeper into the network’s operations, ZachXBT continued to conduct transactions, consciously accepting financial losses. He revealed that he incurred a loss of approximately 5% on each order processed through the network. This strategic acceptance of financial detriment was a calculated risk, a necessary cost to extract actionable intelligence. The investigator articulated his rationale: "At this point, I realized I needed to continue losing 5% per order and gamble on capturing as much actionable intel as quickly as possible." The inherent danger was twofold: not only the financial loss on each transaction but also the constant threat that the criminal counterparty could simply abscond with the entirety of his principal, leaving him with no recourse. This personal sacrifice of nearly $350,000 highlights the unique commitment and resources independent investigators often bring to such high-stakes cases.

Tracing the Digital Footprints: The $1.5 Billion Bybit Heist

The Bybit attack, which materialized in February 2025, stands as one of the most substantial cryptocurrency thefts in recorded history, with an estimated $1.5 billion in digital assets pilfered. The Federal Bureau of Investigation (FBI) swiftly attributed this colossal theft to North Korean state-sponsored hackers, specifically identifying them under the internal moniker "TraderTraitor." This group, widely recognized as a faction of the Lazarus Group, is notorious for its sophisticated cyber warfare capabilities and its consistent targeting of cryptocurrency exchanges and financial institutions to circumvent international sanctions against the Democratic People’s Republic of Korea (DPRK).

Following the Bybit exploit, the stolen funds were rapidly dispersed across thousands of blockchain addresses, a hallmark tactic employed by state-sponsored actors to obscure their origin and complicate tracing efforts. These funds typically traverse multiple blockchains, utilizing cross-chain bridges, decentralized exchanges (DEXs), and various stablecoins to wash their illicit origins. The scale and speed of these movements often overwhelm traditional law enforcement resources, making independent blockchain sleuths like ZachXBT indispensable in the early stages of incident response.

Lazarus Group’s Modus Operandi: A Persistent Global Threat

The Lazarus Group, a highly sophisticated advanced persistent threat (APT) actor, has been a significant player in the global cybercrime landscape for over a decade. Attributed to North Korea’s primary intelligence agency, the Reconnaissance General Bureau, the group’s primary objective is to generate revenue for the DPRK regime, funding its weapons programs and circumventing international sanctions. Their tactics are diverse, ranging from ransomware attacks and espionage to, most prominently, large-scale cryptocurrency heists.

Notable attacks attributed to Lazarus Group include the 2014 Sony Pictures Entertainment hack, the 2017 WannaCry ransomware attack, and numerous cryptocurrency exchange breaches such as the $625 million Ronin Bridge hack in 2022 and the $100 million Harmony Bridge hack. Their methods typically involve phishing campaigns, supply chain attacks, and exploiting vulnerabilities in blockchain infrastructure and smart contracts. Once funds are stolen, the Lazarus Group employs elaborate laundering techniques, often involving multiple intermediaries, mixing services, and conversion to fiat currencies through over-the-counter (OTC) brokers, much like the network ZachXBT infiltrated. The attribution of the Bybit hack to "TraderTraitor" by the FBI further solidifies the Lazarus Group’s continuous and evolving threat to the global financial system and digital asset ecosystem.

The Anatomy of a Laundering Network: Insights from Undercover Intelligence

The intelligence gathered during ZachXBT’s undercover operation provided invaluable insights into the inner workings of this specific Chinese money-laundering network. As communications with Jimmy Green progressed, the alleged launders began to reveal operational details that could be independently verified on-chain. In one instance, Green shared a screenshot depicting a transaction involving funds being bridged between different blockchain networks. ZachXBT, leveraging his expertise in blockchain forensics, was able to match this screenshot with a corresponding THORChain transaction that had been executed within minutes of their conversation, providing concrete evidence of the network’s activities.

Further breakthroughs occurred when Green provided three Solana addresses. These addresses proved pivotal, enabling ZachXBT to identify a large cluster of wallets containing over $12 million in Bybit-linked funds. These funds were actively being moved and converted across various major blockchains, including Bitcoin, Ethereum, Solana, and Tron, showcasing the network’s cross-chain capabilities and its efforts to diversify and obfuscate the assets.

The actionable intelligence derived from these exchanges quickly led to tangible results. Following ZachXBT’s findings, Tether, the issuer of the USDT stablecoin, successfully froze 442,000 USDT connected to the identified wallet cluster. This swift action demonstrated the effectiveness of combining on-chain analytics with direct intelligence gathering, allowing for proactive intervention against illicit financial flows.

Beyond the Bybit funds, the alleged laundering network also demonstrated knowledge of other significant crypto thefts. Green reportedly mentioned approximately $300,000 that had previously been frozen. ZachXBT meticulously traced this figure to 332,000 USDC connected to the 2023 Poloniex exploit, another incident that security researchers have widely associated with North Korean hacking activities. Green also claimed to have laundered approximately $3 million in fraud proceeds for another client, which ZachXBT traced to a wallet associated with Huione Guarantee, a marketplace known for facilitating cryptocurrency laundering and other illicit services. These revelations painted a picture of a versatile and extensive criminal enterprise, not limited to a single exploit or client.

The investigation suggested that this was not merely a lone broker, but a highly organized structure. ZachXBT alleged that the Chinese network had laundered "more than $1 billion across multiple exploits linked to Lazarus Group," including a substantial portion of the Bybit funds. This claim, based on a meticulous analysis of private conversations, wallet movements, and transaction timings, highlights the massive scale of state-sponsored illicit finance. The organization reportedly operated through distinct divisions, with specialized roles for individuals responsible for receiving stolen stablecoins, converting them, and distributing them to other participants for further obfuscation or off-ramping to fiat. This hierarchical structure underscores the industrial scale of modern crypto laundering, where stolen funds are systematically processed through a complex web of intermediaries.

The Perilous Path of a Pseudonymous Investigator

ZachXBT’s latest operation further solidifies his reputation as one of the most prominent independent figures in the cryptocurrency incident response landscape. Since 2022, he has played a crucial role in facilitating over $75 million in freezes connected to DPRK-related incidents, demonstrating a consistent track record against state-sponsored cybercrime. His proactive investigation into the Bybit attack notably preceded the FBI’s public attribution of the theft to North Korea, showcasing his ability to identify and track sophisticated threats ahead of official pronouncements.

Operating under a pseudonym, ZachXBT leverages publicly available blockchain data to trace stolen assets, identify patterns, and uncover connections between seemingly disparate hacks. This work, however, is not without significant personal risk and controversy. He has previously been sued and doxxed by former targets, exposing him to real-world threats. Despite these challenges, he has remained steadfast in his mission to investigate major cryptocurrency thefts and expose malicious actors.

While ZachXBT often relies on grants from foundations and donations from individuals to fund complex investigations, for this specific undercover operation, he personally fronted the nearly $350,000. This immense personal financial commitment, coupled with the inherent personal security risks of directly interacting with an organized money-laundering network, underscores the unique dedication required for such work. The investigator deliberately kept the details of this undercover operation private, sharing information only with trusted law enforcement agencies and other investigators to protect the integrity of the probe and ensure his own safety. His actions exemplify a new frontier in cybercrime fighting, where independent expertise often complements and sometimes spearheads efforts traditionally led by state actors.

Broader Implications for Cybersecurity and Geopolitics

The ZachXBT investigation carries significant implications for both cybersecurity and international geopolitics. It vividly illustrates how cryptocurrency laundering continues to evolve alongside advances in blockchain surveillance. While criminals strive to move stolen assets across multiple chains, using various stablecoins, bridges, and decentralized exchanges to obscure their tracks, the inherent transparency of blockchain technology still allows skilled investigators to reconstruct the trail. ZachXBT’s approach takes this a step further, demonstrating that sometimes, "stepping inside the network moving it" can yield intelligence impossible to obtain through external analysis alone.

The continued success of the Lazarus Group in siphoning vast sums from the crypto ecosystem highlights the persistent challenge posed by North Korea’s illicit finance operations. These funds are vital for sustaining the regime’s military programs, including its nuclear and ballistic missile development, directly impacting global security. The collaboration, even informal, between independent investigators like ZachXBT and official law enforcement agencies is becoming increasingly critical in this fight. The intelligence provided by private entities can accelerate investigations, lead to quicker asset freezes, and provide crucial operational details that aid in dismantling criminal infrastructure.

For the cryptocurrency industry, this incident serves as a stark reminder of the ongoing security vulnerabilities and the imperative for robust security measures, continuous monitoring, and effective incident response protocols. Exchanges like Bybit face immense pressure to protect user assets and to cooperate fully with investigations following a breach. Stablecoin issuers like Tether play a vital role in asset recovery through their ability to freeze illicitly moved funds, underscoring the importance of centralized controls within certain decentralized ecosystems.

Ultimately, ZachXBT’s daring undercover operation not only resulted in the exposure of millions in stolen funds but also offered an unprecedented look into the sophisticated machinery of state-sponsored crypto laundering. It highlights the growing importance of multidisciplinary approaches—combining cutting-edge blockchain analytics with traditional investigative techniques—to combat the evolving threats posed by global cybercriminal networks. As the digital asset space matures, the role of such dedicated, and often self-funded, independent investigators will likely become even more central to maintaining the integrity and security of the global financial system.