Blockchain investigator ZachXBT disclosed an undercover operation that began on March 6, 2025, shortly after the February 2025 hack of the Bybit exchange, which resulted in the theft of approximately $1.5 billion. To infiltrate a Chinese crime syndicate suspected of laundering funds for the Lazarus Group, the researcher transferred $349,700 in USDC to a contact known as Jimmy Green.
By gaining the trust of the syndicate, ZachXBT obtained Solana addresses that allowed him to track funds across multiple blockchains. This intelligence enabled the identification of a wallet cluster containing over $12 million linked to the Bybit incident. Following this discovery, Tether froze 442,000 USDT associated with the identified wallets.
The investigation revealed that the syndicate operates across Hong Kong and mainland China and is allegedly involved in laundering a significant portion of the funds stolen from Bybit. ZachXBT noted that this operation involved substantial personal and operational risks, highlighting the challenges of tracking illicit flows through stablecoin issuers.
Since 2022, ZachXBT has contributed to the freezing of more than $75 million in assets linked to North Korean activities. While the recent freeze of 442,000 USDT represents only a small fraction of the total stolen amount, the researcher emphasizes that targeting laundering brokers remains a critical method for disrupting the movement of stolen capital.
