ZachXBT Spent $350K to Infiltrate North Korean Crypto Launderers

Crypto investigator ZachXBT says he spent $349,700 posing as a client of a crypto laundering group linked to North Korea. He said the operation helped trace wallets handling funds stolen in the $1.5 billion Bybit hack.

ZachXBT detailed the operation in an October 5 post on X. He used his own funds to build trust with a Telegram contact and follow the movement of the money. The effort helped identify more than $12 million in Bybit-linked funds moving across several blockchains.

Fake Client Reveals Laundering Trail

In March 2025, ZachXBT spent $349,700 in USDC to gain the trust of a Telegram contact known as Jimmy Green. The transactions gave him access to wallet addresses and other details tied to suspected laundering activity.

Related: FinCEN Withdraws Crypto Mixing and Self-Hosted Wallet Rules

Green charged a 5% fee on each transaction, ZachXBT said. He then compared the wallet information with public blockchain records, allowing him to trace more than $12 million linked to the Bybit hack.

Investigation Connects Wider Network

ZachXBT also traced some funds to Huione Guarantee, a Cambodian marketplace linked to money-laundering services. His analysis connected parts of the activity to hacks involving Poloniex.

The findings led Tether to freeze 442,000 USDT tied to the wallet cluster. ZachXBT said the investigation contributed to more than $75 million in crypto freezes connected to North Korean activity.

Related: Did Jean Phil Go Viral First — or Was the Viral Persona Built to Launch a Memecoin?