BTC $85,574 
ETH $2,709 
USDT $0.9999 
BNB $787.15 
XRP $1.50 
USDC $0.9999 
SOL $119.99 
TRX $0.3368 
FIGR_HELOC $1.05
ZEC $1,327 ZachXBT says he posed as a client to infiltrate Lazarus launderers
The on-chain investigator says he sent $349,700 of his own funds to a Chinese group that launders crypto for North Korea's Lazarus Group.
Key takeaways
- The stake was $349,700. ZachXBT said he wired $349,700 of his own money and lost 5% on every order.
- The network is large. ZachXBT says the group laundered over $1 billion across multiple exploits for Lazarus Group.
- The intel helped freezes. ZachXBT says his work supported freezes for the $1.5 billion Bybit exploit from February 2025.
What happened
ZachXBT said he posed as a client of a Chinese organized crime group that launders crypto for North Korea's Lazarus Group. The pseudonymous investigator said he wired $349,700 of his own money to people moving stolen funds. He said the syndicate is a Chinese gang that works for North Korea.
He said he contacted a Telegram account named Jimmy Green and fronted almost $350,000 to the operation, losing 5% on each order. On March 6, 2025, he said he funded a new address with 349.7K USDC on Ethereum to begin transactions with Jimmy Green. That contact gave him an address for the USDC in return for USDT on Tron.
ZachXBT said the intelligence helped support freezes for the February 2025 Bybit exploit and helped identify the activity onchain. That exploit cost Bybit $1.5 billion. The FBI attributes the attack to North Korean hackers it tracks as TraderTraitor.
Why it matters
The account suggests the laundering pipeline works in public. ZachXBT said he saw a pattern of 15+ accounts asking for help with orders tied to stolen funds in public groups on Telegram and Discord after the Bybit exploit. He reported the same pattern after the $387 million Bitget hack last week, which Bitget's CEO and tracing firms have linked to North Korea.
ZachXBT drew links from the talks to other cases. He also linked a 2024 freeze of $100,000 against Jimmy's transactions to the $100 million Poloniex hack.
The work carried a price for the investigator. He said each order with Jimmy Green lost him 5%, on top of the almost $350,000 he fronted to the group.
What the data shows
The reported figures span several cases. ZachXBT says the syndicate laundered over $1 billion across exploits for Lazarus Group. He wired $349,700 of his own money and later funded an address with 349.7K USDC on Ethereum. The Bybit exploit he cites caused $1.5 billion in losses, and the Bitget hack he cites caused $387 million.
Background
ZachXBT has a record of tracing stolen crypto. In 2024, his tracing of the theft of roughly 4,100 BTC from a Genesis creditor helped lead to arrests. Paradigm hired him as an incident response advisor in February 2025.
Paradigm co-founder Matt Huang said he had returned more than $350 million to victims of hacks and scams. ZachXBT says grants from foundations and donations from individuals let him take on riskier cases.
Questions readers ask
Who is ZachXBT?
He is a pseudonymous on-chain investigator who traces stolen crypto and names the people behind scams and hacks. Paradigm hired him as an incident response advisor in February 2025.
What is the Lazarus Group?
It is the North Korean hacker collective that the FBI tracks as TraderTraitor and has linked to the $1.5 billion Bybit exploit. ZachXBT says a Chinese organized crime group launders crypto for it.
How much did ZachXBT spend on the investigation?
He said he wired $349,700 of his own money and fronted almost $350,000 to the group. He lost 5% on each order with Jimmy Green.
What was the Bybit hack?
It was a February 2025 exploit that caused $1.5 billion in losses to the crypto exchange Bybit. The FBI attributes it to North Korean hackers it tracks as TraderTraitor.
