Investigator Uncovers North Korea's Crypto Laundering Network Through Telegram Sting
Investigator ZachXBT infiltrated a Chinese money-laundering operation linked to North Korea by posing as a client on Telegram. The launderer, who went by the alias Jimmy Green, openly discussed working for Kim Jong-un, sharing daily updates on the North Korean leader's mood and even inviting ZachXBT to play mahjong. Jimmy claimed his team had laundered nearly all of the $1.5 billion in ETH stolen from the Bybit hack, though this figure remains unverified. The investigator, who fronted $349,700 of his own money, used the intelligence to help freeze funds and trace the flow of stolen assets.
ZachXBT first identified Jimmy in February 2025 after spotting him in public THORChain and Discord groups seeking help with transactions tied to stolen funds. Jimmy's Telegram bio advertised services to launder flagged BTC, ETH, SOL, and TRX through a mixing service. The investigator posed as a scammer needing to convert privacy tool Railgun funds into clean USDT on Tron, and Jimmy quoted a 5% fee. One early order returned exactly 23,750 USDT, confirming the 5% cut.
Jimmy frequently mentioned Kim Jong-un by name, treating him like a moody supplier. He shared updates on Kim's decisions, such as halting transactions due to dirty coins or testing Bitcoin due to fears of USDT freezes. On one occasion, Jimmy announced that North Korea’s work would resume the next day with funds moving to Solana, and ZachXBT confirmed the movement matched the timeline. Jimmy also provided three Solana addresses, exposing a cluster of $12 million or more in Bybit funds cycling through various blockchains. Tether later froze 442,000 USDT linked to these addresses.
Between discussions of money laundering, Jimmy shared personal details, including photos of rabbit stew, complaints about the cold, and an invitation to play mahjong. He even showed a wallet holding about 1.2 million USDT, with Google Translate open on his laptop. Despite claiming to be an honest businessman, Jimmy’s team initially suspected ZachXBT of deceiving them. The investigator eventually handed all the information to law enforcement, contributing to $75 million or more in frozen funds related to North Korea since 2022.