On-Chain Detective ZachXBT: Self-Funded Infiltration of Money Laundering Network
On-chain detective ZachXBT stated that he posed as a client to infiltrate a Chinese organized crime money laundering network. This network is accused of laundering over $1 billion in multiple exploits related to the North Korean Lazarus Group. The intelligence he gathered led to the freezing of funds and on-chain attribution related to the $1.5 billion theft from Bybit in February 2025.
After the Bybit incident, he observed over 15 accounts in public Telegram and Discord groups handling orders related to the stolen funds and contacted an operator using the alias Jimmy Green. On March 6, 2025, he transferred 349,700 USDC to a new Ethereum address, exchanging it in multiple transactions for the counterpart's TRC20 USDT to establish trust. The counterpart later revealed their transfer plans in advance, claiming their team had laundered most of the stolen funds from Bybit. ZachXBT stated he accepted about a 5% loss on each order in exchange for actionable intelligence.
The three Solana addresses provided by the counterpart exposed a cluster of over $12 million in Bybit funds, with paths crossing Bitcoin, Ethereum, Solana, and TRC20. Subsequently, 442,000 USDT was frozen by Tether. The gas fees for the receiving address came from an address on Bybit's public blacklist. The cross-chain screenshots sent by the counterpart matched amounts and times with THORChain orders generated within minutes. The counterpart also mentioned operational arrangements in Hong Kong and mainland China.
Two other claims also matched on-chain. One transaction he claimed was about $300,000 frozen in 2024 corresponds to the 2023 November Poloniex theft case, where 332,000 USDC was frozen in May 2024. Another $3 million from fraud was traced back to a later sanctioned Huaiwang guaranteed hot wallet. Relevant findings have been handed over to private sector investigators and law enforcement. No agency has issued an independent statement regarding this infiltration.
ZachXBT stated that he fronted $349,700 for this case and bore the financial losses and personal risks. Since 2022, he has assisted in freezing over $75 million in assets related to North Korean incidents. The same investigation also linked this network to the $387 million theft from Bitget in September 2026. He simultaneously called for foundation and individual funding to continue pursuing cases that others deem unfeasible.
This is an intelligence-driven freeze, not a market price event. Buyers are the stolen projects, stablecoin issuers, and law enforcement collaborators, while sellers are the money laundering networks handling the stolen funds. The funds did not fully return to the victims, but 442,000 USDT and 332,000 USDC were intercepted, and the blacklisted addresses were marked. The beneficiaries are the investigators who received advance transfer plans and addresses, while the pressure is on the money laundering channels that rely on public groups for orders and treat the counterparties as clients.
Source: Public Information
ABAB AI Insight
ZachXBT has been tracking publicly stolen funds related to North Korea since 2022, cumulatively pushing for the freezing of over $75 million. After the $1.5 billion loss at Bybit in February 2025, the public blacklist and exchange addresses became the reference documents for his infiltration. The Lazarus Group previously left cross-chain splitting traces in the 2017 WannaCry and the 2022 Ronin and Harmony bridge thefts; this time, he pointed not to the hacker entry but to the backend order network.
The $349,700 he fronted did not turn into equity or a bounty but was exchanged for the counterpart's TRC20 USDT, returning instead with advance transfer plans, Solana addresses, and cross-chain screenshots. These materials were then handed over to Tether, private investigators, and law enforcement, resulting in the freezing of 442,000 USDT, the correspondence of 332,000 USDC with the old Poloniex case, and the tracing of $3 million to a later sanctioned Huaiwang guaranteed hot wallet. The capital path is an individual's prepayment of investigation costs, with the stablecoin issuer executing the freeze, and the sanctions list removing off-chain guarantee nodes from usable channels.
The analogy is the exchange cooperation freezes done by chain analysis companies using public ledgers after 2013, rather than government undercover operations. The difference is that the costs are initially borne by individuals, with a 5% loss factored into the intelligence price. The industry is still in a control phase: exploits have not stopped, and the $387 million theft from Bitget in September 2026 is still linked to the same order group, but the freezing points have shifted from hacker wallets to stablecoin issuers and off-chain guaranteed hot wallets.
Structurally, this is a reconstruction of the industry chain. Stolen funds must go through ordering, cross-chain, and guarantee nodes to become spendable balances. Public group ordering allows investigators to enter as clients, while stablecoin issuers hold the final freezing switch. Therefore, the pricing power does not lie with the stolen projects but with those who can provide both the advance dialogue and on-chain addresses to the issuers.
ABAB News · Cognitive Laws
Criminal enterprises rely on orders, investigations rely on pretending to place orders.
The freezing power does not lie with the victims but with the stablecoin issuers.
The price of intelligence is the loss incurred from the initial outlay.