Pseudonymous on-chain investigator ZachXBT conducted an undercover operation to infiltrate a Chinese criminal syndicate linked to the North Korean Lazarus Group. To gain the trust of a money launderer operating under the alias Jimmy Green, ZachXBT transferred $349,700 in USDC to a target address on March 6, 2025. He accepted a 5% loss on each transaction to maintain his cover while gathering intelligence.
The investigation focused on funds stolen during the February 2025 Bybit exploit, which resulted in losses of $1.5 billion. By tracking transactions and matching screenshots provided by the suspect with on-chain data from the Thorchain explorer, ZachXBT identified a cluster of over $12 million in stolen assets. This intelligence led to the freezing of 442,000 USDT by Tether.
The suspect revealed details about laundering operations in Hong Kong and mainland China, as well as connections to the Huione Guarantee marketplace in Cambodia. ZachXBT linked these activities to previous hacks, including the Poloniex exploit. The investigator noted that since 2022, his work has contributed to the freezing of more than $75 million in assets related to North Korean incidents.
ZachXBT, who was hired as an incident response advisor by Paradigm in February 2025, funds his investigations through grants and donations. His findings are shared with private-sector investigators and law enforcement agencies. The operation provided insights into the syndicate's labor division, which distributes USDT across various acceptors to facilitate the movement of illicit funds.
