ZachXBT Reportedly Risked $350K to Infiltrate a Crypto Network Tied to North Korean Hacks; Here’s What He Found

ZachXBT says he fronted $349,700 of his own money to pose as a client of a Chinese crypto laundering operation after the $1.5 billion Bybit theft, using a Telegram contact who called himself Jimmy Green and operated under the handle long_991. He described the network as a Chinese organized crime syndicate that had laundered more than $1 billion across multiple exploits linked to Lazarus Group, the broader name commonly used by researchers for North Korea-linked cyber activity. Separately, blockchain analytics firm Elliptic reported that more than $1 billion of the Bybit haul had been laundered, much of it through suspected Chinese over-the-counter services.

The FBI attributed the Bybit theft, which occurred on 21 February 2025, to North Korea and identified the activity as TraderTraitor. Bybit, a major cryptocurrency exchange, lost about $1.5 billion in the attack, according to the FBI. ZachXBT said he contacted Jimmy after the theft and, on 6 March 2025, funded an address with $349,700 in USDC as part of the operation. The funds were exchanged for USDT on Tron, while ZachXBT accepted about a 5% loss on each order and said there was no guarantee the money would be returned.

Several reports published on 5 October incorrectly rendered the amount as about $3.5 million, turning the 349.7K figure into $3.497 million. ZachXBT’s original account and the underlying transaction amount show $349,700.

According to ZachXBT, Jimmy described an operation spanning Hong Kong and mainland China and claimed his team had laundered most of the $1.5 billion stolen from Bybit. ZachXBT also said Jimmy supplied advance information about planned transactions, including a Solana transfer that occurred roughly a day after the contact flagged it. The continued access came after ZachXBT had accepted the 5% loss on transactions, according to his accoun

On 12 March 2025, a screenshot supplied during the exchanges matched a THORChain transaction by amount and timing, ZachXBT said. THORChain is a cross-chain liquidity protocol that allows assets to be swapped between different blockchains. He cited the match as support for the information Jimmy was providing.

The Trail Reached a $12M-Plus Bybit Cluster

Three Solana addresses supplied by Jimmy were linked to a cluster containing more than $12 million in Bybit-related funds, according to ZachXBT’s tracing. The funds moved through multiple chains and assets, including BTC, ETH, SOL and Tron, while the operation also used Uniswap liquidity pools involving illiquid tokens.

Jimmy’s Ethereum receiving address was gas-funded by another wallet that ZachXBT traced to the Bybit exploit. That funding address appeared on a public blacklist associated with the Bybit theft, while the transactions also showed the use of Uniswap liquidity pools involving illiquid tokens.

A Tether freeze later affected about 442,000 USDT associated with an address in the cluster, according to ZachXBT’s account. He also matched Jimmy’s reference to roughly $300,000 frozen in 2024 to a 332,000 USDC freeze connected to the November 2023 Poloniex exploit, in which more than $100 million was stolen.

Another path involving about $3 million in fraud proceeds led to a Huione Guarantee hot wallet, ZachXBT said. Huione Guarantee is the marketplace arm of Huione Group, which the US Treasury’s Financial Crimes Enforcement Network identified as a primary money laundering concern in 2025, saying the group had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025.

ZachXBT said he shared the findings with private-sector investigators and law enforcement assigned to the case in 2025 but held the material from publication while the matter remained sensitive. No law enforcement agency has publicly confirmed receiving the specific material.