Syndicate

USDC

Green

THORChain

ZachXBT

Blockchain investigator <a href="https://cryptoadventure.com/zachxbt-the-on-chain-sleuth-shaping-crypto-accountability/" rel="noopener noreferrer nofollow">ZachXBT</a> says he spent weeks posing as a paying customer of a Chinese laundering network handling stolen crypto for North Korea-linked operators, putting $349,700 of his own USDC at risk to gain access to the group.
The <a href="https://x.com/zachxbt/status/2107081638073319437" rel="noopener noreferrer nofollow">October 5 disclosure</a> details an undercover operation that began after the February 2025 Bybit breach. ZachXBT alleges the wider network processed more than $1 billion across multiple exploits connected to Lazarus Group, although that aggregate figure has not been independently confirmed by law enforcement.
The <a href="https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack" rel="noopener noreferrer nofollow">FBI attributed the Bybit theft</a> of approximately $1.5 billion to North Korean actors it tracks as TraderTraitor on February 26, 2025. The agency warned that the stolen assets were already being dispersed across thousands of addresses and multiple blockchains.
<h2 id="349-700-used-to-build-trust">$349,700 Used to Build Trust</h2>
ZachXBT identified more than 15 accounts in public Telegram and Discord groups seeking help with transactions he linked to stolen Bybit funds. He contacted several before establishing an ongoing relationship with a Telegram operator using the alias “Jimmy Green.”
On March 6, 2025, ZachXBT funded a fresh Ethereum address with 349,700 USDC and began exchanging funds with the operator for USDT on Tron. He says each order cost roughly 5%, with no assurance that the counterparty would return the funds.
One Ethereum address supplied during the transactions had received gas from a wallet ZachXBT traced directly to Bybit exploit proceeds. Bybit had already created a <a href="https://www.bybit.com/en/press/post/bybit-releases-api-of-suspicious-wallet-on-black-list-as-part-of-recovery-bounty-program-blt13b3e11d180654f2" rel="noopener noreferrer nofollow">public blacklist system</a> to distribute identified attacker addresses to investigators and recovery partners.
The access soon produced advance information about fund movements. ZachXBT says Green told him Bybit-linked assets would move into Solana one day before the corresponding transactions appeared onchain.
<h2 id="chats-exposed-a-12m-bybit-fund-cluster">Chats Exposed a $12M Bybit Fund Cluster</h2>
A March 12 exchange gave ZachXBT another point of comparison. Green sent a screenshot of a cross-chain transfer, and the transaction amount and timing matched a <a href="https://cryptoadventure.com/thorchain-dex-review-2026-native-cross-chain-swaps-rune-security-and-slip-based-fees/" rel="noopener noreferrer nofollow">THORChain</a> order created within minutes of the message.
Three Solana addresses supplied during the conversations then exposed more than $12 million in Bybit-linked assets moving through Bitcoin, Ethereum, Solana and Tron. The routing fits the cross-chain laundering pattern previously seen after the Bybit theft, when <a href="https://cryptoadventure.com/inside-north-koreas-favorite-crypto-laundering-tool-thorchain/" rel="noopener noreferrer nofollow">THORChain became a major route</a> for stolen funds.
A USDT address connected to the identified cluster was <a href="https://blocksec.ai/usdt-freeze/addresses/ethereum/0x652d7f9EDaAa8891be2de74Ea568D70Af823D89E" rel="noopener noreferrer nofollow">frozen on March 14, 2025</a>. ZachXBT placed the affected balance at approximately 442,000 USDT, while BlockSec’s onchain tracker confirms the address entered Tether’s frozen state.
The same broader laundering problem has continued into 2026. ZachXBT recently linked wallets from the September <a href="https://cryptoadventure.com/bitget-exploiter-shields-3-8m-in-zcash-as-recovery-effort-continues/" rel="noopener noreferrer nofollow">Bitget exploit</a> to suspected North Korean actors, while separate <a href="https://cryptoadventure.com/lazarus-linked-wallets-move-30m-through-hyperliquid-as-u-s-entry-talks-advance/" rel="noopener noreferrer nofollow">Lazarus-linked wallets</a> moved more than $30 million through Hyperliquid earlier this year.
ZachXBT waited roughly 18 months before publishing details of the undercover operation while related investigations remained active. He says his work on <a href="https://cryptoadventure.com/community/articles/north-korean-cyber-espionage-in-crypto/" rel="noopener noreferrer nofollow">DPRK-linked cases</a> has helped action more than $75 million in asset freezes since 2022.
The post <a href="https://cryptoadventure.com/zachxbt-infiltrates-chinese-syndicate-laundering-north-korean-hack-funds/" rel="noopener noreferrer nofollow">ZachXBT Infiltrates Chinese Syndicate Laundering North Korean Hack Funds</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

ZachXBT Infiltrates Chinese Syndicate Laundering North Korean Hack Funds

Table of Contents

Crypto Adventure

Other articles published on Oct 6, 2026

Bitmine Immersion Technologies Says ETH Holdings Reach 6.02 Million Tokens

Tokenized Stocks Surge 395% in a Year, But DeFi Adoption Remains Surprisingly Low

CFTC joins SEC in proposing crypto framework after failed CLARITY vote

Microsoft’s 2nd act

Why Solana (SOL) Remains 59% Below All-Time Highs Despite Rising ETF Demand

Solana Foundation Unveils DvP Protocol to Slash Trade Settlement From Days to Seconds

Join our free newsletter for daily crypto updates!