ZachXBT Fronts $349,700 to Infiltrate Alleged Lazarus Laundering Ring

On-chain investigator ZachXBT revealed on October 5, 2026, that he spent $349,700 of his own USDC to gain the trust of a contact within a Chinese organized crime syndicate. The group is suspected of laundering funds for the North Korean Lazarus Group.

The undercover operation began on March 6, 2025, shortly after the February 2025 Bybit exchange hack, which involved the theft of approximately $1.5 billion. ZachXBT worked with a contact using the alias Jimmy Green, who provided Solana addresses that allowed the investigator to track funds across multiple blockchains.

By following these movements, ZachXBT identified a cluster of wallets holding over $12 million in funds connected to the Bybit hack. This intelligence led to Tether freezing 442,000 USDT associated with the wallet cluster.

The research suggests the syndicate operates across Hong Kong and mainland China and was allegedly involved in laundering a significant portion of the $1.5 billion stolen from Bybit. ZachXBT noted that he faced personal and operational risks while engaging with the group.

This effort is part of a broader history for the investigator, who has reportedly assisted in freezing more than $75 million in funds linked to North Korean incidents since 2022. By targeting the brokers that hacking units rely on to cash out, investigators can potentially strand stolen assets.

While the $12 million wallet cluster and the 442,000 USDT freeze represent only a small fraction of the total stolen funds, the operation highlights the role of stablecoin issuers in disrupting laundering routes. Unlike decentralized assets, Tether can act at the issuer level to freeze USDT.

ZachXBT’s approach as an independent researcher involves taking personal risks that most institutions would not sanction. His work continues to serve as a mechanism for tracking and freezing assets linked to high-profile hacks.