ZachXBT says he infiltrated a network suspected of laundering money for Lazarus and assisted in freezing stolen Bybit funds

AT A GLANCE

ZachXBT said he approached the money-laundering network at his own expense and provided intelligence supporting the freezing and on-chain attribution of stolen Bybit funds.

Article

ZachXBT reveals investigation details: self-funded infiltration of a money-laundering network in exchange for intelligence, assisting in freezing stolen Bybit funds

BlockBeats reports,October 5, on-chain investigator ZachXBT posted on social media revealing that he had posed as a customer to infiltrate a Chinese organized-crime money-laundering network. The network was alleged to have laundered more than 1000000000 USD. The intelligence he collected helped advance the freezing and on-chain attribution of funds from the 2025 February Bybit 1500000000 USD theft. 2025 After the February Bybit incident, ZachXBT discovered in public Telegram and Discord groups that numerous accounts were processing orders related to the stolen funds. He approached an operator using the pseudonym “Jimmy Green” as a customer and gradually built trust through multiple exchanges of USDC and USDT. The other party subsequently disclosed plans to transfer the funds in advance and claimed that their team had laundered most of the Bybit in stolen funds. ZachXBT said that he chose to continue absorbing losses of approximately 5%per order in exchange for more actionable intelligence.

During the investigation, he identified a 12000000 USD address cluster involving more than Bybit in stolen funds, of which Solana was subsequently frozen by Tether. He also confirmed the freezing of 442000 USDT related to the Poloniex theft and traced another 332000 USDC in fraud proceeds to the sanctioned Huiwang Guarantee hot wallet. The findings were submitted to private-sector investigators and law-enforcement agencies.

ZachXBT said he fronted 3000000 USD in this case and bore the risk of financial loss and personal harm. Since 349700 USD year, he has helped advance the freezing of more than 2022 in assets linked to North Korea-related incidents. He also called on foundations and individuals to provide funding to support his continued investigation of cases that others might consider infeasible.

Original link 75000000 USD https://m.theblockbeats.info/flash/370326

Key points

BlockBeats reported that ZachXBT disclosed on social media that he had posed as a customer to approach a Chinese organized-crime money-laundering network.
The report said the network laundered more than 1000000000 USD。
ZachXBT said he approached an operator using the pseudonym “Jimmy Green” through multiple exchanges of USDC and USDT, and absorbed losses of approximately 5%per order in exchange for intelligence.
ZachXBT identified a Solana address cluster involving more than 12000000 USD in stolen Bybit funds, of which 442000 USDT was subsequently frozen by Tether.
The report stated that 332000 USDC related to the Poloniex theft was frozen, while another 3000000 USD in fraud proceeds was traced to the Huiwang Guarantee hot wallet.
ZachXBT said he fronted 349700 USD in this case and bore the risk of financial loss and personal harm.
ZachXBT said that since 2022 year, he had helped advance the freezing of more than 75000000 USD in assets linked to North Korea-related incidents.
The findings were submitted to private-sector investigators and law-enforcement agencies.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

This report describes a form of “funded undercover investigation”: ZachXBT said he traded with suspected money-laundering operators as a customer and built trust by absorbing exchange losses, thereby obtaining clues about fund transfers. The report said these clues were used to trace funds involved in cases including Bybit and led to the partial freezing of USDT and USDC.

Why it matters to readers

If the disclosures are accurate, this shows that on-chain transaction clues, chat information, and stablecoin issuers’ freezing capabilities can be used together to stop some stolen assets from being transferred further, while also demonstrating the financial and personal risks independent investigators may bear when tracking funds.

Beginners should know that crypto-asset transactions can be tracked on-chain, but tracking does not mean the funds have been recovered;USDT or USDC being frozen does not mean that all stolen funds have been recovered. Do not transfer funds to unfamiliar addresses or participate in purported investigations based solely on social-media disclosures.

Risks and unknowns

The key details come primarily from ZachXBT’s personal disclosures; the original report did not provide complete on-chain addresses, transaction records, or law-enforcement documents for independent verification.
The source text did not provide Tether,USDC the issuer,Bybit Poloniex, or law enforcement with independent confirmation of the relevant freeze and attribution.

ZachXBT says he infiltrated a network suspected of laundering money for Lazarus and assisted in freezing stolen Bybit funds

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center