Crypto investigator ZachXBT said he posed as a client shortly after the February 2025 Bybit hack and conducted transactions with a representative of a Chinese organized crime syndicate to trace stolen assets. The operation mattered because the group, by his estimate, laundered more than $1 billion from several crypto exploits linked to North Korea’s Lazarus group.

In an account of the operation, ZachXBT said he began investigating after attackers stole about $1.5 billion in crypto assets from Bybit. He identified more than 15 Telegram and Discord accounts publicly seeking help with orders tied to the stolen funds.

ZachXBT posed as a client

ZachXBT contacted the suspicious accounts, including a Telegram user operating under the alias Jimmy Green. On March 6, 2025, the investigator funded a new Ethereum address with 349,700 USDC to conduct several transactions with Jimmy Green.

He proposed swapping USDC on Ethereum for USDT on TRON. According to ZachXBT, the address supplied by Jimmy Green for the transaction had been funded by another wallet that could be traced directly to assets stolen from Bybit. That wallet also appeared on Bybit’s public blacklist site.

ZachXBT said he completed further transactions with Jimmy Green to gain his trust. The counterparty then began sharing information about planned movements of funds linked to North Korea, according to the investigator.

In one instance, Jimmy Green said in advance that funds would be bridged to Solana. ZachXBT said the transfer occurred the following day. The counterparty also claimed that his team had laundered most of the $1.5 billion stolen from Bybit, an assertion ZachXBT said was consistent with the laundering patterns he observed through onchain analysis.

Investigator accepted losses to gather intelligence

ZachXBT said he deliberately accepted losses of about 5% on each swap because his objective was to obtain actionable intelligence rather than profit from the transactions. In total, he put $349,700 of his own money at risk without any guarantee that the counterparty would not disappear with the funds.

“I had to keep taking a 5% loss on every order and take risks to gather as much actionable intel as possible in the shortest time,” ZachXBT said.

He also said that interacting with the alleged syndicate exposed him to an uncertain degree of personal risk.

Funds moved across several networks

On March 12, 2025, Jimmy Green sent ZachXBT a screenshot showing funds moving through a cross-chain bridge. ZachXBT said he matched the amounts and timestamps in the image to a transaction created several minutes after the message.

Jimmy Green later supplied three Solana addresses, allowing ZachXBT to identify a cluster holding more than $12 million in funds linked to the Bybit exploit. According to the investigator, the assets moved from Bitcoin to Ethereum, then to Solana and ultimately to TRON, with the transactions occurring virtually in real time.

Tether later froze 442,000 USDT linked to the cluster. ZachXBT also said participants used a new laundering method involving Uniswap liquidity pools and low-liquidity tokens.

Other alleged laundering operations

Jimmy Green also discussed operations unrelated to the Bybit theft, according to ZachXBT. He mentioned a team that had about $300,000 frozen in 2024. ZachXBT said his onchain review showed that the actual amount was 332,000 USDC and that the funds came from the Poloniex exploit.

In another case, Jimmy Green described laundering $3 million in fraud proceeds for a different client. ZachXBT traced the funds to a Huione Guarantee hot wallet. The entity was later sanctioned, and its former head was arrested.

ZachXBT said the operation therefore produced information about both the movement of Lazarus-linked assets and the group’s handling of proceeds from other cryptocurrency crimes.

Conversations extended beyond money laundering

Jimmy Green gradually disclosed more information about his team’s activities during their extended communications, ZachXBT said. Their conversations also covered mahjong, hunting wild rabbits, food, a weight-loss diet, family and a trip to Disneyland.

ZachXBT suggested that Jimmy Green’s unusual grammar may have resulted from using a translator. He said the source also provided basic information about the group’s operations in Hong Kong and mainland China.

Information shared with law enforcement

ZachXBT said he passed all information obtained during the operation to trusted private-sector representatives and law enforcement agencies working on the case. He said he had withheld the details because of the investigation’s sensitivity.

The investigator said one of the hardest parts of his work was being unable to publish findings immediately. He added that he holds a significant amount of information about several other cases that he cannot yet make public.

Source: Incrypted