ZachXBT staked $349.7K of his own money to pose as a client of North Korea's launderers
ZachXBT says he fronted $349.7K in USDC to pose as a client of the Chinese syndicate laundering North Korea's Bybit haul. The only recovery on record, a 442K USDT freeze by Tether, covers at most 3.7% of the $12M+ cluster he says the sting exposed.
The Investor · Invest desk
What happened
- His counterparty, a Telegram contact called Jimmy Green, took USDC on Ethereum and paid out USDT on Tron.
- After several trust-building trades, Jimmy began describing North Korea's Bybit fund moves before they happened, plus details of the operation in Hong Kong and mainland China.
- The FBI attributed the $1.5 billion February 2025 Bybit exploit to North Korean hackers it tracks as TraderTraitor.
- ZachXBT says he has helped action more than $75 million in North Korea-linked freezes since 2022, paid for by grants and donations.
- He says the same public solicitations reappeared after last week's $387 million Bitget hack, another theft Bitget's CEO, Elliptic and Chainalysis have linked to North Korea.
Why it matters
- What it costs cost An individual investigator's money, backed by grants and donations, ended up as float inside North Korea's laundering pipeline, and every order handed 5% to the people he was investigating.
- What it limits constraint Getting money back for Bybit's victims depended on what one issuer chose to freeze, and that was a small slice of the funds the sting identified.
- What it sets up precedent With the same public solicitations reappearing after the Bitget hack, the approach can be repeated, and the limit on the next case is how much float an investigator can afford to lose.
Next story · Invest · Oct 3
Issuers and protocols have frozen about 0.2% of the $387 million taken from BitgetConfirmed3 publishers
The $349.7K was float [1]. ZachXBT put it in a new Ethereum address and cycled it through Jimmy's swaps [11], so each order sent back USDT for most of what went out. The cost was the 5% each order lost [2]. At that rate, one full pass of the stake costs $17,485 [16]. Decrypt's account does not give the number of orders, the total loss, or whether anyone reimbursed him.
He put the exposure higher than the haircut. "For this case, I fronted $349.7K and lost 5% on each order, with no guarantee Jimmy wouldn't disappear with the funds, and an unknown amount of personal risk from dealing with the syndicate," he said [3]. He chose to keep paying the fee: "At this point, I realized I needed to continue losing 5% per order and gamble on capturing as much actionable intel as quickly as possible," he wrote [4].
The recovery side is Tether's freeze of 442K USDT [6]. Counting both stablecoins at a dollar, the freeze is about 1.26 times the stake [17] and about 0.03% of the $1.5 billion taken from Bybit [19]. It is also under 0.6% of the freeze total he claims since 2022 [20].
There are three ways to score it. On the investigator's own costs, the sting probably paid: his haircuts would only exceed the frozen sum after about 25 full-stake orders [21]. On attribution, the freeze count undersells it. The address Jimmy supplied had been funded with gas by a wallet traceable to Bybit exploit funds [15], Jimmy said funds would move to Solana a day before they did [13], and ZachXBT says the same group has laundered more than $1 billion for Lazarus Group across several exploits [22]. On money returned to victims, the result is thin, at most 3.7 cents per dollar of the cluster he identified [18].
I think the third score is the right one for anyone relying on this model to get stolen money back. The investigation found more than $12 million [5], and what got frozen was the part one issuer acted on [6]. The counter-thesis is that attribution compounds: an investigator who can see a syndicate's next chain move ahead of time can feed freezes on later thefts, and the $387 million Bitget hack, where he says the same pattern reappeared, is the next test [10]. If freezes or seizures traced to the Hong Kong and mainland China details Jimmy gave turn up beyond Tether's 442K [12], my view is wrong.
The capital came from a pseudonymous investigator who says grants from foundations and donations from individuals are what let him take cases this risky [14]. He got in through 15+ accounts asking for help with stolen-fund orders in public Telegram and Discord groups [9].
What to watch
- ZachXBT disclosing his order count or net loss, the figure that sets the sting's real cost against the 442K USDT frozen.
- Freezes or seizures traced to the Hong Kong and mainland China details Jimmy gave, beyond Tether's single action.
- Whether issuers freeze funds from the $387 million Bitget hack, where he says the same public solicitations reappeared.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+35
- Incentives40
- Confidence55
Perspective Coverage
8 publishers- Builder
- Builder 15%
- Operator
- Operator 54%
- Investor
- Investor 31%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ZachXBT says that on March 6, 2025 he funded a new Ethereum address with 349.7K USDC to transact with a member of a Chinese laundering syndicate while posing as a client; Decrypt describes it as his own money.
- [2]
ZachXBT says he accepted a 5% loss on each order he placed with the syndicate.
- [3]
"For this case, I fronted $349.7K and lost 5% on each order, with no guarantee Jimmy wouldn't disappear with the funds, and an unknown amount of personal risk from dealing with the syndicate," ZachXBT said.
- [4]
"At this point, I realized I needed to continue losing 5% per order and gamble on capturing as much actionable intel as quickly as possible," ZachXBT wrote.
- [5]
ZachXBT says the operation exposed a $12M+ cluster of Bybit exploit funds.
- [6]
ZachXBT says Tether later froze 442K USDT linked to the cluster.
- [7]
ZachXBT says he has helped action $75M+ in freezes tied to North Korean incidents since 2022, and funds his work through grants and donations.
- [8]
The February 2025 Bybit exploit caused $1.5 billion in losses; the FBI attributed it to North Korean hackers it tracks as TraderTraitor.
- [9]
ZachXBT says that after the Bybit exploit he observed 15+ accounts asking for help with orders directly tied to stolen funds in public groups on Telegram and Discord.
- [10]
ZachXBT says he saw the same pattern last week after the $387 million Bitget hack, which Bitget's CEO and blockchain tracing firms Elliptic and Chainalysis have linked to North Korea.
- [11]
One account, 'Jimmy Green' on Telegram, gave ZachXBT an address to send USDC to on Ethereum in exchange for USDT on Tron.
- [12]
"I completed several additional transactions with him in order to build up trust," ZachXBT said. "After that, Jimmy began to talk about moving Bybit funds for DPRK in advance of it happening, along with basic details about their operation in [Hong Kong] and mainland China."
- [13]
ZachXBT wrote that "one day prior he stated funds would be moved to Solana and the next day they were."
- [14]
ZachXBT says grants from foundations and donations from individuals are what let him take on riskier cases like this one.
- [15]
ZachXBT wrote that the address Jimmy supplied had been funded with gas by a wallet directly traceable to Bybit exploit funds and labeled on the public Bybit exploit blacklist site.
- [16]
One full pass of the $349.7K stake at a 5% loss per order costs $17,485.
- [17]
The 442K USDT freeze equals about 1.26 times the $349.7K stake, taking both stablecoins at $1.
- [18]
The 442K USDT freeze is at most about 3.7% of the $12M+ cluster; an upper bound because the cluster exceeds $12M.
- [19]
The 442K USDT freeze is about 0.03% of the $1.5 billion Bybit loss.
- [20]
The 442K USDT freeze is under 0.6% of the $75M+ in freezes ZachXBT says he has helped action since 2022.
- [21]
The 5% haircuts would exceed the 442K frozen only after about 25 full-stake orders.
- [22]
ZachXBT says the Chinese syndicate has laundered $1B+ across multiple exploits for Lazarus Group.
Sources
8 independent publishers whose own reporting we read for this story.
- cointelegraph.comChinese crime network laundered over $1B for Lazarus: ZachXBT
1 article · October 5, 2026
- crowdfundinsider.comZachXBT Posed as Client to Map Chinese Money Laundering Network that Allegedly Laundered $1B+ for North Korea’s Lazarus Group
1 article · October 6, 2026
- crypto.newsHow ZachXBT traced Bybit hack funds to a Lazarus-linked network
1 article · October 5, 2026
- cryptobriefing.comZachXBT fronted $349,700 to get inside an alleged Lazarus laundering ring
1 article · October 5, 2026
- cryptopolitan.comZachXBT infiltrates Chinese laundering crew tied to Bybit and Bitget thefts
1 article · October 5, 2026
- cryptoslate.comZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group
1 article · October 5, 2026
- decrypt.coCrypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
1 article · October 5, 2026
- news.bitcoin.comZachXBT Infiltrates Crypto Syndicate Tied to $1.5B Bybit Hack
1 article · October 6, 2026
Topics and entities
Topics
- Cryptocurrency-based money laundering
- On-chain investigation
- Stablecoin freezes and seizures
- North Korea Crypto Theft