ZachXBT exposes $1 billion crypto laundering syndicate tied to Lazarus Group

Blockchain investigator ZachXBT infiltrated a suspected Chinese crypto laundering syndicate by posing as a client and facilitating stablecoin trades. In an Oct. 5 disclosure, he claimed the network laundered over $1 billion tied to exploits linked to the Lazarus Group. ZachXBT fronted 349,700 USDC to build trust with a contact known as Jimmy Green, engaging in repeated exchanges that led to private discussions about moving stolen funds from Bybit in 2025.

The investigation began after the February 2025 Bybit exploit, where ZachXBT noticed accounts seeking help with orders linked to stolen funds. He traced a cluster involving $12 million in Bybit funds across Bitcoin, Ethereum, Solana, and Tron. Additionally, Tether froze 442,000 USDT connected to the cluster.

ZachXBT reported that Jimmy Green shared details about upcoming fund movements, including transfers to Solana, which occurred as described. The contact also provided Solana addresses that exposed the larger cluster of stolen funds. The investigation extended beyond Bybit, with references to a 2024 Poloniex exploit involving 332,000 USDC.

ZachXBT incurred a 5% loss on each order but emphasized the value of intelligence gathered, which helped freeze funds tied to the Bybit exploit. He appealed for continued support to fund high-risk investigations.