ZachXBT Says He Fronted $349,700 to Infiltrate Alleged Laundering Ring

Blockchain investigator ZachXBT said Oct. 5 that he fronted $349,700 of his own funds to pose as a client of an alleged Chinese laundering network, gathering intelligence that he says helped freeze proceeds from the Bybit hack.

In the 12-post account on X, he alleged that the network laundered more than $1 billion across multiple exploits for North Korea's Lazarus Group. He said he accepted a 5% loss on each order to build trust and obtain advance warning of fund movements.

The clearest result he described was a 442,000 $USDT freeze by Tether. ZachXBT said three Solana addresses supplied by his contact exposed a cluster of more than $12 million in Bybit proceeds moving through Bitcoin, Ethereum, Solana and Tron.

Etherscan shows about 442,399 $USDT at the Ethereum address he identified for the freeze, labeled as a Uniswap V2 liquidity pool. The address balance does not establish a freeze or who controlled the funds; those claims remain ZachXBT's attribution.

From Support Chats to Transaction Plans

ZachXBT said the investigation began after he spotted at least 15 accounts asking for help with orders he linked to stolen Bybit funds in public Telegram and Discord groups following the February 2025 hack. He said he contacted several accounts, including someone using the Telegram alias “Jimmy Green.”

He said he funded a new Ethereum wallet on March 6, 2025, to transact with that contact. An Ethereum transaction recorded by Etherscan shows the address he identified received roughly 349,720 $USDC that day.

According to ZachXBT, the initial arrangement was to send $USDC on Ethereum in exchange for $USDT on Tron. He said repeated transactions built enough trust that the contact began describing planned movements of Bybit funds before they happened, including a move to Solana a day in advance.

The FBI attributed the approximately $1.5 billion Bybit hack, which occurred on or about Feb. 21, 2025, to North Korea and called the activity “TraderTraitor.” The Defiant previously reported on the laundering campaign, including security investigators' concerns about funds being split into smaller transactions.

Separately, in an Oct. 5 reply, ZachXBT said roughly $170,000 connected to the Bitget exploit had recently been frozen at a service on Hyperliquid.

ZachXBT said his findings were shared immediately with private-sector investigators and law enforcement assigned to the case. “Due to sensitivity around the investigation, I was unable to publish sooner,” he wrote.