ZachXBT spent $349.7K of his own money to infiltrate a Chinese laundering syndicate working for Lazarus Group. Posing as a client, he traded with a launderer called “Jimmy Green” in March 2025. As a result, he gathered intel that helped freeze funds from the $1.5B Bybit exploit. This ZachXBT Lazarus story is the boldest piece of onchain sleuthing we have covered.
The ZachXBT Lazarus Sting in Short
The story starts in February 2025, right after the Bybit exploit. Investigators attributed that hack to TraderTraitor, a group linked to North Korea. Shortly after, Zach noticed something strange in public Telegram and Discord groups. More than 15 accounts were asking for support on orders tied directly to the stolen funds.
In other words, the launderers were filing support tickets in the open. So Zach started messaging them. One of them used the alias Jimmy Green on Telegram.
According to Zach’s full thread on X, the syndicate behind Jimmy has laundered over $1B across multiple Lazarus exploits
How He Built Trust With a Launderer
First, Zach funded a fresh Ethereum address with 349.7K USDC on March 6, 2025. Then he acted like any other OTC client. He sent USDC to Jimmy and received USDT on Tron in return.
However, the first deal already gave something away. Jimmy’s receiving address got its gas from a wallet on the public Bybit exploit blacklist. That link tied him straight to the stolen funds.
Afterwards, Zach completed several more swaps to look like a regular. Each order cost him 5%. Still, he kept going, because every trade bought more conversation.
What the Intel Revealed
Once trust was there, Jimmy started talking. For example, he announced that Bybit funds would move to Solana the next day. The following day, they did. He also shared basic details about the operation in Hong Kong and mainland China.
Zach then matched Jimmy’s own screenshots to onchain activity:
- A bridging screenshot from March 12 matched a THORChain order created minutes after the message.
- Three Solana addresses exposed a $12M+ cluster moving from BTC to ETH to SOL to Tron.
- Tether later froze 442K USDT linked to that cluster.
- The same cluster used a new laundering trick with illiquid tokens in Uniswap LPs.
In addition, Jimmy bragged about other jobs. He mentioned a team with roughly $300K frozen in 2024. Zach found it onchain as 332K USDC from the Poloniex exploit. Jimmy also described washing $3M in fraud proceeds for another client. Those funds led to a Huione Guarantee hot wallet. Huione has since been sanctioned, and its former chairman was arrested.
Rabbit Hunting, Mahjong and Disney
Honestly, this is my favorite part. Between laundering updates, the two made small talk like old friends. Jimmy chatted about mahjong, hunting wild rabbits, his fat-reducing meal, family life and Disney vacations.
Meanwhile, Zach played the friendly client and kept digging. Jimmy’s awkward grammar came from a translator app, which makes the chats even funnier. Picture a man moving billions for North Korea while sharing diet tips with crypto’s top detective.
Why the Risk Was Enormous
Above all, remember this was his own money. Zach fronted $349.7K with no guarantee Jimmy would send anything back. On top of that, he lost 5% per order by design.
Then there is the personal risk. He was dealing with organized crime tied to a state hacking group. Nobody knows how far such a syndicate would go.
Because the investigation was sensitive, he waited over a year to publish. His findings went to trusted investigators and law enforcement immediately. Since 2022, he says he has helped action $75M+ in freezes on DPRK cases. He funds this work through grants and donations, and he is sitting on more unpublished findings.
Tremendous respect from me. Nobody else operates on this level.
Why It Matters for Your Funds
Lazarus is not slowing down. Zach noted the same pattern after the recent Bitget hack. Launderers were again posting support tickets in public groups. We broke down what went wrong there in the Bitget post mortem.
Similarly, DPRK-linked wallets showed up in our Hyperliquid Lazarus coverage. Therefore, the question of self-custody or exchange matters more every month.
Keep This Content Free
Stories like this sting take hours to verify and write up. If you want to support our work, sign up through our links. Use OKX or Bybit and it costs you nothing extra.
Final Words
ZachXBT pulled a boss move here. He risked his money and his safety to map a billion-dollar laundering network. Consequently, real funds got frozen and real addresses got flagged.
This is not his first headline either. We covered his earlier bombshell in our ZachXBT Axiom recap. Frankly, the man deserves his own “Who Is ZachXBT” profile. We will get to that one soon.
FAQ
How much did ZachXBT spend on the Lazarus sting?
He funded an address with 349.7K USDC of his own money. In addition, he lost 5% on every order.
Who is Jimmy Green?
Jimmy Green is the Telegram alias of a launderer in the syndicate. According to ZachXBT, his team moved most of the $1.5B Bybit funds.
Did the sting lead to frozen funds?
Yes. For instance, Tether froze 442K USDT linked to a cluster Jimmy revealed.
Why did ZachXBT wait so long to publish?
The investigation was sensitive. Therefore, he shared findings privately with investigators and law enforcement first.
How is ZachXBT funded?
He relies on grants from foundations and donations from individuals.
Credit: Source link
