ZachXBT poses as client to freeze $1.5B in stolen Bybit funds

ZachXBT, a well-known on-chain investigator, recently took an unconventional approach to tracking stolen crypto. He wired $349,700 of his own money to pose as a client of a Chinese gang linked to North Korea, gathering intel that helped freeze funds from the $1.5 billion Bybit exploit in February 2025. The group, which ZachXBT linked to North Korea’s Lazarus Group, was openly advertising their services on Telegram and Discord.

The investigator, who has been tracing stolen crypto for years, said he built trust with a member of the gang, going by the name Jimmy Green. After completing several transactions, Jimmy began sharing details about moving Bybit funds for North Korea, including their operations in Hong Kong and mainland China. ZachXBT’s findings led to the freezing of 442,000 USDT by Tether.

Jimmy also revealed that the gang had laundered $3 million in fraud proceeds for another client, which ZachXBT traced to Huione Guarantee, a Telegram marketplace banned in May 2025. The marketplace was part of Huione Group, a Cambodian conglomerate accused of laundering billions. Despite the risks, ZachXBT lost 5% on each order during the operation, totaling $349,700.

ZachXBT has helped action over $75 million in freezes related to North Korean incidents since 2022. His work has been supported by grants and donations, allowing him to take on high-risk cases. The investigator emphasized that his findings were shared immediately with law enforcement and private-sector experts, ensuring the sensitivity of the investigation.