ZachXBT Spent $349,700 to Infiltrate Lazarus-Linked Chinese Money Laundering Network

Key facts

• ZachXBT spent $349,700 of his own money to infiltrate an alleged Chinese money-laundering network connected to North Korea's Lazarus Group.
• The operation helped expose more than $12 million in funds linked to the February 2025 Bybit hack, which the FBI attributed to North Korean hackers tracked as TraderTraitor.
• ZachXBT posed as a client after noticing over 15 accounts in public Telegram and Discord groups seeking assistance with Bybit exploit funds.
• On March 6, 2025, he funded a new Ethereum address with 349,700 USDC and began transacting with a contact using the alias 'Jimmy Green.'
• The arrangement involved sending USDC in exchange for USDT on Tron, with ZachXBT losing about 5% per order to establish credibility.
• Green provided information about operations in Hong Kong and mainland China, and shared three Solana addresses that helped identify a cluster of over $12 million in Bybit-linked funds.
• Tether froze 442,000 USDT connected to the wallet cluster; Green also mentioned $300,000 previously frozen, traced to 332,000 USDC linked to the 2023 Poloniex exploit.
• ZachXBT alleged the network laundered over $1 billion across multiple Lazarus-linked exploits and has facilitated over $75 million in freezes tied to DPRK incidents since 2022.