ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group

According to reporting by CryptoSlate, blockchain investigator ZachXBT stated that he infiltrated a Chinese laundering syndicate by posing as a client and funding repeated stablecoin trades. In an Oct. 5 disclosure, he alleged the network laundered more than $1 billion across exploits for the Lazarus Group.

ZachXBT reported that he fronted 349,700 USDC to build a relationship with a contact using the Telegram alias Jimmy Green. He stated that these repeated exchanges led to private conversations regarding the movement of funds stolen from Bybit in 2025. He reported tracing a cluster involving more than $12 million in Bybit funds, which subsequently led to a 442,000 USDT freeze by Tether. Additionally, he noted that the contact referenced a team whose funds were frozen in 2024, matching an on-chain freeze tied to the Poloniex exploit.

CryptoSlate noted that the FBI previously reported a February 2025 theft from Bybit attributed to North Korea. ZachXBT stated that the intelligence gathered from his trades and private chats assisted in securing the asset freeze, and he appealed for ongoing donations and grants to support high-risk investigations.