ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack

Blockchain investigator ZachXBT said he infiltrated a Chinese organized crime network and gathered intelligence that supported fund freezes linked to the 2025 Bybit hack, according to a detailed thread he published on X. He alleged the syndicate laundered more than $1 billion across multiple exploits on behalf of North Korea's Lazarus Group.

The investigator said his probe began after he spotted a pattern involving more than 15 accounts in Telegram and Discord groups that were seeking help with orders tied to stolen funds following the February 2025 Bybit exploit. Posing as a client, he funded a new Ethereum address with 349,700 USDC to run transactions with a vendor using the pseudonym "Jimmy Green."

Tracing the funds

In March 2025, Jimmy provided the receiving address "0xbaa5" to swap USDC for USDT on Tron, ZachXBT said. He stated that the receiving address had been gas-funded by a wallet directly traceable to Bybit exploit funds and that it appeared on Bybit's public exploit blacklist. Jimmy also discussed plans to move Bybit funds for North Korea ahead of the transactions and shared details about the group's operations in Hong Kong and mainland China, according to the investigator. "One day prior, he stated funds would be moved to Solana and the next day they were," ZachXBT said, adding that Jimmy claimed his team laundered most of the $1.5 billion taken from Bybit.

ZachXBT said other checkable claims pointed to the same conclusion. A March 12 bridge screenshot Jimmy shared matched a THORChain order created within minutes, he said, while three Solana addresses Jimmy provided helped identify a cluster of more than $12 million in Bybit exploit funds swapped across BTC, ETH, SOL and Tron. Tether later froze 442,000 USDT tied to that cluster, he added.

Two further claims also held up. Jimmy's reference to roughly $300,000 frozen in 2024 matched 332,000 USDC from the Poloniex exploit, and his assertion that he laundered $3 million in fraud proceeds for another client traced back to a hot wallet of the sanctioned Huione Guarantee, per ZachXBT. The investigator said he ultimately fronted $349,700 and lost about 5% per order, with no guarantee Jimmy would not disappear with the funds, describing the effort as a gamble to capture as much actionable intelligence as possible.

ZachXBT said he shared his findings with law enforcement immediately but could not disclose them earlier due to the sensitivity of the investigation. He added that he has helped facilitate the freezing of $75 million in funds connected to North Korean incidents since 2022.