Onchain detective ZachXBT stated that he infiltrated a Chinese criminal syndicate and collected evidence that supported asset freezes connected to the 2025 Bybit security breach.
Via an extensive thread published on X, ZachXBT claimed that this Chinese underground ring laundered upwards of $1 billion across multiple hacks for North Korea’s Lazarus Group.
The cryptocurrency investigator explained that he commenced his inquiry after spotting a recurring trend involving more than 15 profiles inside Telegram and Discord channels asking for help with transactions related to stolen assets following the Bybit exploit that occurred in February 2025.
Disguising himself as a customer, ZachXBT deposited 349,700 USDC on Ethereum into a freshly generated wallet to execute several swaps with a supplier who used the alias “Jimmy Green.”
During March 2025, Jimmy supplied ZachXBT with a deposit destination denoted as “0xbaa5” to trade USDC for USDT running on the Tron network. The analyst pointed out that Jimmy’s receiving wallet received gas funds from an address “directly tied to Bybit exploit assets” and featured on the official Bybit blacklisted exploit registry.
Furthermore, ZachXBT mentioned that Jimmy conversed about upcoming plans to transfer the stolen Bybit capital on behalf of North Korea before the transfers actually happened, while also revealing particulars concerning the syndicate’s infrastructure situated in Hong Kong and mainland China.
“One day prior, he stated funds would be moved to Solana and the next day they were,” ZachXBT remarked. “He stated his team laundered most of the $1.5 billion from Bybit, which was consistent with the laundering patterns I observed.”
Repeated pattern
ZachXBT stated that additional assertions made by Jimmy displayed identical connections to tainted coins.
Among those activities, a bridge transfer screenshot delivered by Jimmy on March 12 aligned with a THORChain transaction generated within a matter of minutes, according to ZachXBT. Three Solana wallets provided by Jimmy additionally assisted in tracking down a cluster holding over $12 million worth of Bybit stolen assets that moved across BTC, ETH, SOL, and Tron blockchains, he noted. Tether later froze 442,000 USDT tied directly to that cluster.
Two other statements from their dialogues were similarly verifiable, he noted. Jimmy’s mention of roughly $300,000 locked in 2024 corresponded with 332,000 USDC originating from the Poloniex breach.
Jimmy also bragged about laundering $3 million in illicit gains for another user. ZachXBT stated he tracked those tokens to an active deposit address operated by Huione Guarantee, which currently faces sanctions.
“Throughout our conversations, Jimmy and I had a lot of small talk in between discussing laundering for DPRK,” ZachXBT commented. “He talked about playing mahjong, hunting wild rabbits, food, his fat-reducing meal, family life, and vacations at Disney.”
ZachXBT highlighted that he ultimately put up $349,700 upfront and suffered an approximate 5% loss per swap, “with no guarantee Jimmy wouldn’t disappear with the funds.” He mentioned that he kept trading alongside the network in an attempt to “gamble on capturing as much actionable intel as quickly as possible.”
The security analyst stated he promptly passed his discoveries to law enforcement authorities but could not reveal specifics earlier because of the delicate nature of the probe. He concluded by stating that he has helped secure the freezing of $75 million in assets linked to North Korean operations since the year 2022.
Originally published at https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767.
