ZachXBT Infiltrates Chinese Crime Syndicate Linked to Lazarus Group and Bybit Hack

Blockchain investigator ZachXBT has revealed how he infiltrated a Chinese organized crime network linked to North Korea's Lazarus Group, helping to freeze funds tied to the 2025 Bybit hack. ZachXBT detailed his undercover operation in a thread on X, alleging that the crime syndicate laundered over $1 billion across multiple exploits. His investigation began after he noticed a pattern involving more than 15 accounts in Telegram and Discord groups seeking help with orders tied to stolen funds following the Bybit exploit in February 2025.

Posing as a client, ZachXBT funded a new address with 349,700 USDC on Ethereum to conduct multiple transactions with a vendor named Jimmy Green. In March 2025, Jimmy provided ZachXBT with the receiving address 0xbaa5 to exchange USDC for USDT on Tron. ZachXBT claimed that Jimmy's receiving address was gas-funded by a wallet directly traceable to Bybit exploit funds and appeared on Bybit's public exploit blacklist. Jimmy also discussed plans to move Bybit funds for North Korea before the transactions occurred and shared details about the group's operation in Hong Kong and mainland China.

ZachXBT noted that Jimmy's claims showed similar ties to illicit funds. Among those operations, a March 12 bridge screenshot shared by Jimmy matched a THORChain order created within minutes. Three Solana addresses Jimmy shared also helped identify a cluster of over $12 million in Bybit exploit funds that had been swapped across BTC, ETH, SOL, and Tron. Tether later froze 442,000 USDT linked to the cluster. Two other claims in their conversations were also checkable, including Jimmy's mention of roughly $300,000 frozen in 2024, which matched 332,000 USDC from the Poloniex exploit.

Throughout their conversations, Jimmy and ZachXBT had small talk in between discussing laundering for the Democratic People's Republic of Korea (DPRK). Jimmy talked about playing mahjong, hunting wild rabbits, food, his fat-reducing meal, family life, and vacations at Disney. ZachXBT noted that he ultimately fronted $349,700 and lost about 5% per order, with no guarantee Jimmy wouldn't disappear with the funds. He continued trading with the group to capture as much actionable intel as quickly as possible. ZachXBT immediately shared his findings with law enforcement but was unable to disclose details sooner due to the sensitivity of the investigation.