On-chain investigator ZachXBT spent weeks posing as a client of a Chinese money laundering syndicate he says moved stolen funds for North Korea's Lazarus Group, fronting $349,700 of his own money to win the broker's trust. The infiltration helped expose a cluster holding more than $12 million in proceeds from the February 2025 Bybit hack and led Tether to freeze 442,000 USDT tied to it. ZachXBT detailed the operation in a 12-post thread on X, roughly 18 months after it happened.
A $349,700 sting
ZachXBT funded a fresh Ethereum address with 349,700 USDC on March 6, 2025, then traded it away for stablecoin on Tron at a 5% loss on every order to a broker who went by "Jimmy Green" on Telegram. He said he found the opening after noticing more than 15 accounts asking for help with orders tied to stolen funds in public Telegram and Discord groups following the Bybit exploit.
According to ZachXBT: "I realized I needed to continue losing 5% per order", he added, with no guarantee the broker would not disappear with the funds.
Tracing the Bybit money
Hackers stole about $1.5 billion from Bybit on Feb. 21, 2025, and the FBI attributed the theft to the North Korean group it tracks as TraderTraitor. Jimmy Green gave ZachXBT a wallet address that had been funded with gas by a wallet tied directly to the Bybit exploit and labeled on Bybit's public blacklist.
The broker predicted funds would move to Solana a day before it happened, ZachXBT said. On March 12, 2025, he matched a screenshot the broker sent of himself bridging funds to a Thorchain swap order created minutes later.
Three Solana addresses the broker then shared exposed a cluster moving more than $12 million in Bybit funds from Bitcoin to Ether to Solana to Tron. Tether later froze 442,000 USDT linked to the cluster.
Other cases confirmed along the way
Jimmy Green also volunteered details from unrelated cases that ZachXBT was able to verify on-chain. He mentioned a team that had about $300,000 frozen in 2024, which ZachXBT traced to 332,000 USDC stolen in the November 2023 Poloniex exploit.
He also described laundering $3 million in fraud proceeds for another client, funds ZachXBT linked to a hot wallet used by Huione Guarantee. The Cambodian marketplace is part of a group the U.S. Treasury's FinCEN has accused of laundering at least $4 billion.
ZachXBT said he has helped action more than $75 million in freezes tied to North Korean incidents since 2022, funding the work through grants and donations rather than fees.
Sources: Decrypt, The Defiant
Trading involves risk.
Risk Disclaimer
