ZachXBT Uncovers $1B Crypto Laundering Network Linked to Lazarus Group

Highlights:

• ZachXBT says he infiltrated a Chinese crime network laundering over $1 billion for North Korea’s Lazarus Group.
• He posed as a client, traced Bybit-linked funds, and gathered intelligence that helped investigators freeze assets.
• The investigation also connected suspected laundering activity to Poloniex, Bitget, and other crypto-related fraud proceeds.

Blockchain investigator ZachXBT says he infiltrated a Chinese organized crime network that laundered more than $1 billion linked to multiple crypto exploits for North Korea’s Lazarus Group. He said he posed as a client and gathered information that later helped investigators freeze funds and trace illicit activity onchain.

ZachXBT revealed the investigation in an X thread on October 5. According to him, the operation also provided information connected to the $1.5 billion Bybit hack in February 2025. He said the Bybit attack was linked to TraderTraitor, a group associated with North Korea. Shortly after the exploit, ZachXBT noticed more than 15 accounts asking for help with transactions tied to the stolen funds in public Telegram and Discord groups.

ZachXBT Posed as a Client to Track Bybit Funds

ZachXBT contacted several accounts that appeared to have problems processing orders linked to the Bybit funds. One of those people used the Telegram alias “Jimmy Green.” On March 6, ZachXBT funded a new Ethereum address with 349,700 USDC. He then used the funds to carry out several transactions with Jimmy while posing as a customer.

Jimmy provided an address where ZachXBT could send USDC in exchange for USDT on the Tron network. ZachXBT said another wallet funded that address with gas fees. He traced that wallet directly to funds from the Bybit exploit. He continued making transactions to build trust. Eventually, Jimmy began discussing plans to move funds linked to North Korean actors before some transfers took place.

In one example, ZachXBT said Jimmy told him that funds would move to Solana. The transfer reportedly happened the following day.

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.

Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. pic.twitter.com/jauRRt8875

— ZachXBT (@zachxbt) October 5, 2026

Investigation Linked Other Crypto Exploits

The investigation also uncovered connections to other stolen funds. Jimmy told ZachXBT that a team he knew had about $300,000 frozen in 2024. ZachXBT later traced the transaction onchain and identified 332,000 USDC linked to the Poloniex exploit. Jimmy also claimed that his operation had laundered about $3 million in fraud proceeds for another client. ZachXBT said he traced those funds to another wallet during his investigation.

The findings followed similar activity around the September 2026 Bitget incident. ZachXBT previously reported that Chinese illicit actors allegedly laundering funds from the $387 million exploit were openly asking for transaction support in public Telegram groups and Discord servers.

ZachXBT Says Investigation Helped Freeze DPRK-Linked Funds

ZachXBT said the operation carried significant financial and personal risk. He used $349,700 of his own funds and said he lost around 5% on each order while dealing with the suspected network. He also faced the risk that the counterparty could disappear with the funds. According to ZachXBT, he has helped authorities and private investigators freeze more than $75 million connected to DPRK-related incidents since 2022.

He said he immediately shared his latest findings with trusted private-sector investigators and law enforcement officials working on the case. However, he could not publish the information earlier because of the investigation’s sensitive nature.