Blockchain investigator ZachXBT says he spent months posing as a paying cryptocurrency client to infiltrate a Chinese organized crime syndicate that allegedly laundered more than $1 billion in stolen crypto for North Korea’s Lazarus Group.
The pseudonymous investigator revealed details of the operation on October 5, 2026, saying he used his own money to build trust with an alleged operator of the network. The investigation was connected to funds stolen in the $1.5 billion Bybit hack in February 2025 and eventually helped identify a wallet cluster containing more than $12 million in Bybit-linked funds. Tether later froze about $442,000 in USDT connected to the cluster, according to ZachXBT and reporting on his investigation.
ZachXBT Spent $349,700 to Go Undercover
The operation began after the Bybit hack, when ZachXBT said he noticed more than 15 accounts in public Telegram and Discord groups offering services connected to transactions involving stolen funds. One operator, using the alias “Jimmy Green,” eventually became the focus of his investigation.
On March 6, 2025, ZachXBT said he funded a new Ethereum address with $349,700 in USDC so he could conduct transactions with the operator. Rather than simply watching the transactions from a blockchain explorer, he acted as a genuine customer.
That meant accepting financial losses to maintain the relationship. ZachXBT said he lost approximately 5% on every order, while also taking the risk that the people he was dealing with could disappear with his money.
The Undercover Operation Connected Private Chats to Blockchain Activity
The most important part of the operation was the combination of private conversations and public blockchain data.
According to ZachXBT, “Jimmy Green” began discussing the movement of funds connected to the Democratic People’s Republic of Korea, or DPRK, before those transactions happened. In one example, the operator allegedly told him that funds would be moved to Solana. ZachXBT then observed the movement on-chain the following day.
The investigator said the operator eventually provided several Solana addresses. By comparing those addresses with blockchain activity, ZachXBT identified a cluster containing more than $12 million in funds he linked to the Bybit exploit.
The funds moved between several blockchain networks, including Bitcoin, Ethereum, Solana and Tron. Tether subsequently froze approximately 442,000 USDT associated with the wallet cluster.
This demonstrates why blockchain investigations can be powerful. Transactions may be pseudonymous, but they remain publicly recorded, allowing investigators to follow movements between wallets and compare them with information obtained from other sources.
The Investigation Goes Back to the Bybit Hack
The investigation is closely tied to the February 2025 attack on Bybit, which resulted in approximately $1.5 billion in cryptocurrency being stolen.
ZachXBT linked the attack to North Korea’s Lazarus Group using on-chain evidence shortly after the incident. The FBI later attributed the theft to North Korean actors it identified as TraderTraitor.
ZachXBT’s latest investigation focuses on another part of the story: what happens after stolen cryptocurrency leaves the victim’s wallet.
According to his account, the Chinese syndicate provided laundering services that helped move funds through different networks and services. He said the network claimed to have different divisions responsible for receiving and distributing USDT and other assets.
The investigator also said information from his conversations helped him trace activity connected to other crypto thefts.
Huione Connection Raises More Questions
Another significant part of the investigation involved Huione Guarantee, a Cambodian online marketplace that has previously attracted attention from U.S. authorities over alleged money-laundering activity.
The U.S. Treasury’s Financial Crimes Enforcement Network identified Huione Group as a major money-laundering concern in 2025, citing its role in laundering proceeds from cryptocurrency investment scams and DPRK cyber heists.
The U.S. Department of Justice also announced in June 2026 that it had seized cloud infrastructure used by subsidiaries of Huione Group. The department alleged that the infrastructure helped criminal actors transfer and conceal proceeds from cryptocurrency scams and other criminal activity.
ZachXBT said “Jimmy Green” also described laundering millions of dollars for another client. The investigator then traced some of those funds to a wallet associated with Huione Guarantee.
These connections do not mean every transaction involving Huione or every Chinese crypto trader is criminal. They are part of the specific allegations and evidence described in ZachXBT’s investigation.
Why the ZachXBT Investigation Matters
The case highlights a difficult problem facing the cryptocurrency industry: blockchains are transparent, but the people behind wallet addresses are not always immediately identifiable.
Investigators can see funds moving from one wallet to another, but understanding who controls those wallets and why the money is moving often requires additional information.
That is where ZachXBT’s undercover operation became significant. By communicating directly with an alleged operator, he obtained information that could then be compared with public blockchain records.
The investigator said he provided his findings to private investigators and law enforcement agencies working on the case. He also said he waited before publishing the details because the investigation remained sensitive.
ZachXBT has previously investigated cryptocurrency thefts involving Lazarus Group. In 2024, he published research tracing more than $200 million in stolen cryptocurrency from more than 25 hacks to laundering channels.
He now says his investigations have helped facilitate more than $75 million in freezes connected to DPRK-related incidents since 2022.
Crypto Laundering Is Becoming More Complex
The latest investigation also shows how quickly stolen cryptocurrency can move across different networks.
A criminal group does not necessarily need to keep stolen assets in one wallet. Funds can be exchanged for stablecoins, moved between blockchains and routed through different services, creating a complicated trail for investigators to reconstruct.
But blockchain transactions also leave permanent records. That gives investigators an opportunity to reconstruct those movements, especially when on-chain evidence can be combined with information from exchanges, stablecoin issuers, private companies and law enforcement.
For the crypto industry, the case is another reminder that security does not end when stolen funds leave an exchange. Following the money, identifying the people behind wallet addresses and getting assets frozen can require months of investigation and cooperation across multiple organizations.
Conclusion
The ZachXBT Lazarus Group investigation provides a rare look at how an alleged crypto laundering network operated behind the scenes. By posing as a paying customer and putting nearly $350,000 of his own money at risk, ZachXBT says he gained access to an operator connected to a network that allegedly moved more than $1 billion in stolen cryptocurrency for North Korea’s Lazarus Group.
His investigation also connected private conversations with public blockchain transactions, helping identify more than $12 million in Bybit-linked funds and leading to the freezing of approximately $442,000 in USDT.
The allegations remain claims made through ZachXBT’s investigation rather than a court finding against every person or entity mentioned. Even so, the case demonstrates the growing role of blockchain investigators in tracing stolen cryptocurrency and providing intelligence that can help exchanges, stablecoin issuers and law enforcement respond to major crypto crimes.
