ZachXBT Discloses Investigation Details: Funded His Own Operations to Infiltrate Money Laundering Networks for Intelligence, Aided in Freezing Stolen Bybit Funds

On-chain detective ZachXBT disclosed in a social media post that he once posed as a client to infiltrate a Chinese organized crime money laundering network. The network is accused of laundering over $1 billion across multiple exploit attacks for hackers linked to North Korea’s Lazarus Group. The intelligence he gathered helped facilitate the fund freeze and on-chain attribution for the $1.5 billion Bybit hack in February 2025. After the February 2025 Bybit incident, ZachXBT discovered in public Telegram and Discord groups that a large number of accounts were processing orders related to the stolen funds. He reached out to an operator using the alias "Jimmy Green" posing as a client, and gradually built trust through multiple exchanges of USDC and USDT. The operator subsequently disclosed the fund transfer plan in advance, claiming his team had laundered most of the stolen Bybit funds. ZachXBT said he chose to absorb a roughly 5% loss per order at the time in exchange for more actionable intelligence. During the investigation, he identified a Solana address cluster holding over $12 million in stolen Bybit funds, of which 442,000 USDT was subsequently frozen by Tether. He also confirmed the freeze of 332,000 USDC linked to the Poloniex hack, and traced another $3 million in fraudulent proceeds to the hot wallet of Huiwang Guarantee, which was later sanctioned. The relevant findings have been submitted to private sector investigators and law enforcement agencies. ZachXBT stated that he advanced $349,700 in this case, and bore both financial losses and personal risks. Since 2022, he has helped facilitate the freezing of over $75 million in assets linked to North Korea-related incidents. He also called on foundations and individuals to provide funding to support his continued investigation of cases others may deem unfeasible.