North Korea-Linked Hackers Laundered $1 Billion Through Chinese Network, ZachXBT Says

TLDR

• Blockchain investigator ZachXBT says he spent $349,700 posing as a client to infiltrate an alleged Chinese money laundering network.
• The network is accused of laundering more than $1 billion for North Korea’s Lazarus Group across multiple hacks.
• His tracing helped identify over $12 million in wallets linked to the $1.5 billion Bybit hack.
• Tether reportedly froze 442,000 USDT connected to the wallet cluster he uncovered.
• Chainalysis says North Korean hackers stole $2.02 billion in crypto during 2025, pushing their total past $6.75 billion.

---

Blockchain investigator ZachXBT says he spent months undercover to expose a crypto money laundering network with ties to North Korea. He detailed his findings in an X thread posted on October 5.

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.

Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. pic.twitter.com/jauRRt8875

— ZachXBT (@zachxbt) October 5, 2026

ZachXBT said he posed as a paying customer starting in February 2025, just days after the Bybit hack. He found accounts in public Telegram and Discord groups seeking help moving stolen funds.

He said he funded an Ethereum address with $349,700 in stablecoins. He accepted a 5% loss on each trade to build trust with an operator known by the alias Jimmy Green.

How the laundering network operated

ZachXBT described the group as a Chinese organized crime syndicate. He said its operations spanned Hong Kong and mainland China.

bro zachxbt is actually insane

this man went undercover as a money laundering client

spent $350K of his OWN money to gain the trust of a chinese launderer who was moving bybit hack funds for north korea

the guy started sharing everything. screenshots. wallet addresses. bridge… https://t.co/LPtopGfOAU

— Bala 🧤 (@BalaiBB) October 5, 2026

He claimed the network laundered more than $1 billion across several crypto exploits on behalf of Lazarus Group. The operator allegedly told him that almost all funds from the Bybit theft moved through the group’s services.

One trade route gave ZachXBT his first clue. He said a receiving wallet had been funded by an address already on Bybit’s public blacklist.

Later conversations gave him advance details about planned fund movements. He compared these messages to public blockchain transactions to confirm matches.

On March 12, the operator sent a screenshot showing a swap of 1.192 Bitcoin for 51.73 Ether. ZachXBT matched this to a THORChain transaction tied to Bybit funds.

Wallet tracing leads to frozen funds

Three Solana addresses shared during the conversations exposed a cluster holding more than $12 million in Bybit-linked funds. ZachXBT said the money moved between Bitcoin, Ether, Solana and Tron.

He said Tether later froze 442,000 USDT connected to these wallets. Tether has separately confirmed larger freezes tied to the Bybit case through its T3 Financial Crime Unit.

By October 2025, T3-related cases had frozen $19 million connected to the Bybit theft, according to Tether. The 442,000 USDT figure was not mentioned in those earlier public releases.

ZachXBT also said the same contact gave him information about other cases. This included funds from the 2023 Poloniex hack and a batch linked to Huione Guarantee.

The FBI attributed the Bybit theft to North Korea five days after the attack happened. The agency said actors it tracks as TraderTraitor stole about $1.5 billion in assets.

Bybit said compromised credentials from a developer allowed the attacker to access its systems. The exchange said reviews found no breach of its core infrastructure.

ZachXBT said he shared his findings with investigators and law enforcement while the operation was active. He said he waited until October 2026 to publish the details due to the sensitivity of the case.

Public records from the FBI, Treasury and Tether have not named the operator called Jimmy Green. No court filing has confirmed the full scale of the laundering network described in the thread.

Chainalysis says North Korean hackers stole $2.02 billion in crypto during 2025. The firm says investigators are still tracing funds from the $387 million Bitget hack that happened in September 2026.