ZachXBT fronted $349,700 to get inside an alleged Lazarus laundering ring

Most blockchain investigators trace stolen money from a safe distance. ZachXBT decided to hand some of his own money to the people he was tracking.

The pseudonymous investigator disclosed in an X thread on October 5, 2026, that he fronted $349,700 in USDC to build trust with a contact inside a Chinese organized crime syndicate. The group is believed to have laundered funds for North Korea’s Lazarus Group.

ZachXBT links the operation to Tether freezing 442,000 USDT after he identified a wallet cluster he tied to the Bybit hack and valued at more than $12 million.

How the operation worked

The undercover effort began on March 6, 2025. That was roughly a week or two after the Bybit exchange hack in February 2025, which saw approximately $1.5 billion in funds stolen.

ZachXBT’s point of contact went by the alias “Jimmy Green.” To earn that person’s confidence, the investigator sent the $349,700 in USDC up front.

Jimmy Green reportedly provided specific Solana addresses, which helped ZachXBT follow funds as they hopped between blockchains. From that intelligence, ZachXBT identified a cluster of wallets holding more than $12 million in funds he connected to Bybit. Tether, the issuer of USDT, then froze 442,000 USDT tied to those funds.

The syndicate’s footprint reportedly stretches across both Hong Kong and mainland China. According to the research findings, the network was allegedly involved in laundering most of the $1.5 billion taken from Bybit.

ZachXBT faced significant personal and operational risks while engaging directly with the group.

A familiar name in North Korea tracing

This is not ZachXBT’s first run-in with funds linked to Pyongyang. He has reportedly assisted in freezing more than $75 million tied to North Korean incidents since 2022.

The Bybit hack, at approximately $1.5 billion, gave the Lazarus Group’s alleged operations a headline number that is hard to ignore. If a hacking unit relies on outside brokers to cash out, those brokers become a pressure point. Disrupting them can strand stolen funds even when the original thieves remain out of reach.

What this means for exchanges, stablecoins and investigators

ZachXBT tied a wallet cluster worth more than $12 million to Bybit, while the Tether freeze covered 442,000 USDT. Against an approximately $1.5 billion theft, both figures are small slices.

Stablecoins are one choke point in laundering routes. Because Tether can act on USDT at the issuer level, laundering routes that touch the stablecoin carry a risk that pure Bitcoin or other decentralized asset flows may not. The 442,000 USDT freeze is a reminder that the second property can bite.

ZachXBT is an independent researcher, not a law enforcement agency. He put up his own capital and took on personal risk to get inside the network. That model has produced results, including the reported $75 million plus in North Korea-linked freezes since 2022, but it also leans heavily on individuals willing to take risks most institutions would not sanction.