How ZachXBT traced Bybit hack funds to a Lazarus-linked network

How ZachXBT traced Bybit hack funds to a Lazarus-linked network

By Olivia Stephanie

Oct 6, 2026 at 4:39 AM UTC

Blockchain investigator ZachXBT has said an undercover operation costing him $349,700 exposed an alleged Chinese laundering network that moved more than $1 billion for North Korea-linked hackers and helped trace funds from Bybit’s $1.5 billion 2025 theft.

ZachXBT says he spent $349,700 posing as a client inside an alleged Lazarus-linked laundering network. His investigation identified more than $12 million in Bybit-linked funds moving across several public blockchains. ZachXBT says Tether later froze 442,000 USDT connected to wallets uncovered during his undercover operation.

The FBI previously attributed the $1.5 billion Bybit theft to North Korea’s state-backed TraderTraitor actors. Chainalysis estimates North Korean hackers stole $2.02 billion in crypto during 2025, a new record.

ZachXBT said in an Oct. 5 X thread that he posed as a paying customer after finding more than 15 accounts in public Telegram and Discord groups seeking help with transactions tied to the Bybit hack. He said the work led him to an operator using the alias “Jimmy Green,” whose chats and wallet details later helped map Bybit-linked funds across several networks.

In his thread, ZachXBT stated: "How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain."

After contacting the operator in late February 2025, ZachXBT said he presented himself as a customer holding marked crypto and asked to exchange funds for USDT on Tron. By March 6, he had funded a fresh Ethereum address with 349,700 USDC and accepted a 5% loss on each order while building trust. He described the group as a “Chinese organized crime syndicate” and said it had “laundered $1B