ZachXBT says it spent weeks claiming to be a client to break into a Chinese network that was laundering over $1 billion in stolen cryptocurrency for North Korea's Lazarus Group. The inquiry focused on an operator going by Jimmy Green and tracked money related to the Bybit attack in February 2025.

ZachXBT found a $12 million cluster and assisted in initiating a Tether freeze by investing $349,700 in USDC, taking losses on transactions, and comparing private discussions with live blockchain activity.

ZachXBT Builds Trust With Jimmy Green

Following the Bybit exploit in February 2025, which the FBI gave to the TraderTraitor organisation with ties to North Korea, the inquiry got underway. According to ZachXBT, he observed over fifteen profiles in open Discord and Telegram groups asking for help with orders containing pilfered money. He discovered Jimmy Green, an operator, through one of those accounts.

ZachXBT began trading with the operator on March 6, 2025, after funding a new Ethereum address with $349,700 USDC. As part of the agreement, USDC was exchanged for USDT on Tron. Because keeping access to the operator was more important for the research than avoiding the trading cost, he took a 5% loss on each order.

Jimmy Green said his staff had handled the majority of the stolen Bybit assets and allegedly talked about money laundering related to North Korean funding. ZachXBT added that the operation took place in both mainland China and Hong Kong.

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.

Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. https://t.co/jauRRt8875

— ZachXBT (@zachxbt) October 5, 2026

Private Chats Matched Real Blockchain Movements

Comparing Jimmy's private comments with transactions that appeared on public blockchains was the investigation's strongest point. ZachXBT received information from the discussions that could be compared to wallet activity, cross-chain movements, and transaction timing.

Jimmy allegedly stated that money would be transferred to Solana in one case. The next day, there was a movement. Jimmy shared a screenshot of a cross-chain transfer on March 12, 2025. Within minutes of the interaction, ZachXBT matched its timing and amounts with an order recorded through THORChain.

Jimmy also provided three addresses on Solana. ZachXBT was able to locate a cluster with over $12 million linked to the Bybit hack thanks to those addresses. The money flowed across Solana, Tron, Ethereum, and Bitcoin, providing the inquiry with a more comprehensive picture of how the pilfered assets were transferred between networks.

$442,000 Tether Freeze Follows the Tracing

Eventually, a quantifiable intervention was produced by the wallet information. Tether froze $442,000 in USDT linked to the cluster found by ZachXBT's research. The freeze offered a direct measure against monies linked to the money laundering trail, but it only covered a portion of the more than $12 million cluster he identified.

ZachXBT reported that further verifiable links were generated by Jimmy's information. A claim involving around $300,000 in cash that had previously been blocked matched 332,000 USDC associated with the Poloniex hack. Additionally, Jimmy asserted that his team had laundered $3 million in fraud earnings for a different client, which ZachXBT linked to a Huione Guaranty hot wallet.

Evidence Was Shared With Law Enforcement

ZachXBT stated that while the inquiry was still sensitive, he shared the results with investigators from the business sector and law enforcement. This explains why information on the 2025 activities wasn't made public until October 2026.

There was a direct expense associated with the operation as well. ZachXBT invested $349,700 of his own USDC and kept taking orders with losses of about 5% without any assurance that Jimmy wouldn't steal the money. He explained the strategy as a means of gathering useful information while he was still connected to the network.

The investigation was published by ZachXBT on October 5 in a 12-post X thread, where he described the syndicate as having laundered more than $1 billion across multiple exploits for Lazarus Group. His disclosure also connected the investigation directly to the February 2025 Bybit theft, which the FBI says involved approximately $1.5 billion in stolen virtual assets.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. ZachXBT Exposes Alleged $5M Crypto Scam
2. Worldcoin Faces Fresh Backlash as ZachXBT Exposes Project
3. ZachXBT Exposes Hidden Risk at Stabble DEX
4. ZachXBT Alleges Insider Trading at Axiom Exchange
5. ZachXBT Exposes Hidden Risk at Stabble DEX

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.