An investigator inside a laundering network for North Korea's hackers
Where it stands now. ZachXBT says the undercover work traced a wallet cluster linked to over $12 million stolen from Bybit, and Tether froze 442,000 USDT linked to it.
The record 1 development
Onchain investigator ZachXBT reports going undercover in a laundering network
What happened. On October 5, onchain investigator ZachXBT published a thread on X describing posing as a customer of a Chinese organized crime group that, according to ZachXBT, laundered over $1 billion for North Korea's Lazarus Group. ZachXBT says 349,700 USDC of personal funds were deposited on March 6, 2025, and that the work traced a wallet cluster linked to over $12 million in funds stolen from Bybit. TechFlow reports that Tether froze 442,000 USDT linked to that cluster.
Why it matters. ZachXBT said the findings went to private investigators and law enforcement, and were held back for 18 months because the investigation was in a sensitive phase. TechFlow's analysis says the case shows how much off-chain information and coordination it takes to move from tracing funds to freezing them.
- ZachXBT says they posed as an over-the-counter client of a launderer using the alias "Jimmy Green", paying the 5% laundering fee on each transaction.
- According to ZachXBT, the contact gave advance notice of fund movements, including a move of Bybit funds to Solana that appeared on-chain the next day.
- ZachXBT also traced $3 million the contact said was laundered for another client to a wallet linked to Huione Guarantee, a Telegram marketplace that the US Treasury's FinCEN later found involved in at least $4 billion of illicit activity.
Read the originals (4), usually in their own language
- ZachXBT Spent Nearly $350,000 Out of Pocket as a Customer: How an Undercover Investigation into a Money Laundering Network Unfolded · TechFlow
- ZachXBT infiltrates Lazarus-linked Chinese crime syndicate posing as a customer | identifies fund routes tied to Bybit incident · CoinPost, headline translated by us
- Infiltrating a laundering network for 'over $1 billion' in North Korean funds? | noted crypto investigator · Crypto Times, headline translated by us
- ZachXBT infiltrates a money-laundering ring for North Korean hackers · Coin68, headline translated by us