After the February 2025 Bybit hack, ZachXBT found more than 15 accounts seeking help with orders tied to the stolen funds in public Telegram and Discord groups.
Days after the $1.5 billion theft, the blockchain investigator began posing as a paying client to enter a Chinese organised crime syndicate he says was laundering cryptocurrency for North Korea's Lazarus Group. ZachXBT works as an Incident Response Advisor at Paradigm.
He put forward $349,700 in USDC and accepted a 5% loss on each transaction to earn the confidence of an operator called Jimmy Green. The financial risk was intended to secure real-time information about where funds were headed.
On 6 March 2025, ZachXBT funded a new Ethereum address with 349,700 USDC and began transactions with Green. Green offered addresses that would take USDC in return for USDT on the Tron blockchain.
ZachXBT said one of those addresses had received funds for transaction fees that he traced directly to the Bybit exploit. Green, who used the Telegram alias “long_991” and user ID 7635649994, discussed moving Bybit money for actors linked to the Democratic People's Republic of Korea, or DPRK. He also gave details of operations in Hong Kong and mainland China.
Through their private communications, ZachXBT learned that Green's team claimed to have processed most of the assets stolen from Bybit. Green then forecast that funds would move to Solana a day before the transfers took place, providing a test of the information ZachXBT was receiving.
Using that information, ZachXBT traced a cluster of more than $12 million in Bybit-linked funds as it moved through Bitcoin, Ethereum and Tron. Tether subsequently froze $442,000 in USDT associated with that cluster.
ZachXBT's investigation concluded that the syndicate had laundered more than $1 billion taken in multiple cryptocurrency exploits for Lazarus Group. He also traced the group's involvement in laundering $387 million from the Bitget exploit and funds from the $292 million Kelp DAO exploit in April.
The Bybit theft involved $1.5 billion and was attributed to North Korea's TraderTraitor group. ZachXBT said on 28 September that Chinese actors allegedly laundering money for North Korean hackers had been openly looking for assistance through public Discord servers and Telegram channels.
He set out the undercover operation in a thread on X on 5 October. The identity behind the Jimmy Green alias, and whether Green has faced consequences, remain unknown.
The investigation forms part of a wider effort to stop stolen digital assets before they can be converted. ZachXBT's work has helped freeze more than $75 million linked to North Korean hacks since 2022. Chainalysis says hackers linked to North Korea had stolen at least $6.75 billion in digital assets through 2025.
US authorities have previously pursued alleged intermediaries in such schemes. In 2023, the US Department of the Treasury's Office of Foreign Assets Control sanctioned two crypto traders, one from Hong Kong and one from China, for helping the DPRK convert stolen cryptocurrency. In 2020, US prosecutors charged two Chinese nationals with laundering more than $100 million stolen by North Korean hackers from a cryptocurrency exchange in 2018.
Comments (0)