ZachXBT Details Infiltration of Chinese Crime Syndicate Linked to $1B+ DPRK Laundering
Blockchain investigator ZachXBT has detailed an undercover operation in which he posed as a client of a Chinese organized crime syndicate he says laundered more than $1 billion across multiple exploits linked to North Korea's Lazarus Group. The investigation helped support freezes connected to the February 2025 Bybit exploit and provided information used to attribute illicit onchain activity.
ZachXBT said the operation began after the $1.5 billion Bybit exploit in February 2025, which was attributed to the DPRK-linked group TraderTraitor. He observed more than 15 accounts publicly seeking assistance with orders tied directly to stolen funds across Telegram and Discord groups.
Contact With a Suspected Laundering Operator
ZachXBT said he contacted several accounts that were complaining about orders associated with the Bybit exploit. One was an individual using the Telegram alias Jimmy Green, with the Telegram username long_991 and user ID 7635649994.
 |
| Source: ZachXBT |
On March 6, 2025, ZachXBT funded a new Ethereum address with 349.7K USDC to conduct transactions with Jimmy Green. His address was 0x073256b50d66a7eb005f2a504d0a4fb6ea62a276. Jimmy provided 0xbaa551da0ae0c93025d9a983a68025a27dc15337 to receive USDC in exchange for USDT on Tron. ZachXBT said that address had been funded for gas by 0xbcb4, which he traced directly to Bybit exploit funds and said was listed on a public Bybit exploit blacklist.
The addresses ZachXBT associated with Jimmy Green included 0xbaa551da0ae0c93025d9a983a68025a27dc15337 and TPwXAPwYaDCm7GrzNFiMmNnofrxEVURXRM. He said he completed several additional transactions to build trust, later identifying 0x1893ef01e700b1359280e11736d1b89fe97ed216, TS5hY6mm6UsCLNdVDWnsRA69LuAwfdn158 and TMGjdFeBf9T6kGB9ZmLzeaAPYWBokuyTuS as additional addresses associated with the account.
Tracking Bybit Funds Across Networks
According to ZachXBT, Jimmy subsequently discussed plans to move Bybit funds for DPRK-linked actors and provided basic information about the group's operations in Hong Kong and mainland China. ZachXBT said Jimmy predicted that funds would be moved to Solana one day before the transfers occurred. Jimmy also claimed that his team had laundered most of the $1.5 billion taken in the Bybit exploit, which ZachXBT said was consistent with the laundering patterns he observed.
To continue gathering information, ZachXBT said he accepted a 5% loss on each order. On March 12, 2025, Jimmy shared a screenshot showing himself bridging funds. ZachXBT said he matched the amounts and timing with an order recorded on the THORChain explorer within minutes of the message. The transaction hash was 81a85130b36057428e64b6f97215f77b5a197776a8f1b3a61c8cd0ee1ebfa8c1.
Jimmy also shared three Solana addresses that ZachXBT said exposed a cluster containing more than $12 million in Bybit exploit funds. The funds were swapped across BTC, ETH, SOL and Tron in real time. ZachXBT said 442K USDT connected to the cluster was later frozen by Tether. He also identified a laundering technique involving Uniswap liquidity pools and illiquid tokens.
The Solana addresses identified by ZachXBT were 9gSwa2Mew9P21Wxs8nFgDujTurKZx1nBEVRv6K5sJP6e, EvZJGsDymrSUQyF23HLKEgUpjfd9XN1GTmm8AG6pFS7H and 8S6T5gL2w5z4M9TCehMgQjxVm3Q6R7WDHp6WFfbtZSAy. The Tether freeze address was 0x652d7f9edaaa8891be2de74ea568d70af823d89e.
Other Funds Identified During the Investigation
ZachXBT said Jimmy also described a team that had approximately $300K frozen in 2024. His onchain investigation identified the freeze as 332K USDC originating from the Poloniex exploit. Jimmy additionally described laundering $3 million in fraud proceeds for another client. ZachXBT traced those funds to a hot wallet belonging to Huione Guarantee, which has since been sanctioned and whose former chairman was arrested.
Beyond discussions about cryptocurrency laundering, ZachXBT said his conversations with Jimmy included everyday subjects such as mahjong, hunting wild rabbits, food, a fat-reducing meal, family life and vacations at Disney. He said Jimmy's awkward grammar could be explained by the use of a translator.
ZachXBT said his findings were shared immediately with trusted private-sector investigators and law enforcement officials assigned to the case, but that the sensitivity of the investigation prevented him from publishing the details earlier. He said he has helped action more than $75 million in freezes connected to DPRK incidents since 2022.
For the operation, ZachXBT said he fronted 349.7K USDC and lost 5% on each order, while facing the possibility that Jimmy could disappear with the funds and an unspecified level of personal risk from dealing with the syndicate. He said grants from foundations and donations from individuals allow him to pursue higher-risk investigations and that he is currently holding significant findings from other cases.
Writer: Marcus RenfieldCrypto Market Analyst & Onchain WriterMarcus Renfield covers cryptocurrency markets with a focus on onchain data, Bitcoin price action, and emerging market narratives. His writing examines how capital flows, network activity, and broader market structure influence short- and medium-term trends.He aims to provide clear, data-informed analysis for readers seeking a deeper understanding of crypto market dynamics.