ZachXBT Infiltrates Laundering Syndicate Linked to Lazarus Group

Blockchain investigator ZachXBT revealed he gained access to a Chinese laundering network by posing as a cryptocurrency client. By funding repeated stablecoin trades, he says he built a relationship with a contact to track funds connected to the Lazarus Group.

The investigation began following the February 2025 Bybit exploit. ZachXBT identified accounts in public Telegram and Discord groups that he linked to stolen funds, eventually connecting with a contact using the alias Jimmy Green. To establish trust, ZachXBT fronted 349,700 USDC, losing 5% on each order to facilitate the exchanges.

Through these interactions, the contact allegedly shared details about moving stolen Bybit funds, including operations in Hong Kong and mainland China. ZachXBT reported that the contact provided specific information on fund movements, such as transfers to Solana, which he was able to verify on-chain. He traced a cluster involving more than $12 million in Bybit exploit funds across Bitcoin, Ethereum, Solana, and Tron.

The investigation resulted in Tether freezing 442,000 USDT linked to the cluster. ZachXBT also noted that the contact mentioned a team whose funds were frozen in 2024, which he matched to an on-chain freeze of 332,000 USDC tied to the Poloniex exploit.

The FBI previously reported that North Korea stole approximately $1.5 billion in virtual assets from Bybit on or about February 21, 2025, under the name TraderTraitor. While the FBI noted that stolen assets were dispersed across thousands of addresses, ZachXBT's findings regarding the syndicate's total and the connection to his contact are his own.

ZachXBT stated that the intelligence gathered through these trades was instrumental in freezing funds related to the Bybit exploit. He is currently seeking continued foundation grants and donations to support future high-risk investigations.