On-chain detective ZachXBT stated that he posed as a client to infiltrate a Chinese organized crime money laundering network. This network is accused of laundering over $1 billion in multiple exploits related to the North Korean Lazarus Group. The intelligence he gathered led to the freezing of funds and on-chain attribution related to the $1.5 billion theft from Bybit in February 2025.

After the Bybit incident, he observed over 15 accounts in public Telegram and Discord groups handling orders related to the stolen funds and contacted an operator using the alias Jimmy Green. On March 6, 2025, he transferred 349,700 USDC to a new Ethereum address, exchanging it in multiple transactions for the counterpart's TRC20 USDT to establish trust. The counterpart later revealed their transfer plans in advance, claiming their team had laundered most of the stolen funds from Bybit. ZachXBT stated he accepted about a 5% loss on each order in exchange for actionable intelligence.

The three Solana addresses provided by the counterpart exposed a cluster of over $12 million in Bybit funds, with paths crossing Bitcoin, Ethereum, Solana, and TRC20. Subsequently, 442,000 USDT was frozen by Tether. The gas fees for the receiving address came from an address on Bybit's public blacklist. The cross-chain screenshots sent by the counterpart matched amounts and times with THORChain orders generated within minutes. The counterpart also mentioned operational arrangements in Hong Kong and mainland China.

Two other claims also matched on-chain. One transaction he claimed was about $300,000 frozen in 2024 corresponds to the 2023 November Poloniex theft case, where 332,000 USDC was frozen in May 2024. Another $3 million from fraud was traced back to a later sanctioned Huaiwang guaranteed hot wallet. Relevant findings have been handed over to private sector investigators and law enforcement. No agency has issued an independent statement regarding this infiltration.

ZachXBT stated that he fronted $349,700 for this case and bore the financial losses and personal risks. Since 2022, he has assisted in freezing over $75 million in assets related to North Korean incidents. The same investigation also linked this network to the $387 million theft from Bitget in September 2026. He simultaneously called for foundation and individual funding to continue pursuing cases that others deem unfeasible.

This is an intelligence-driven freeze, not a market price event. Buyers are the stolen projects, stablecoin issuers, and law enforcement collaborators, while sellers are the money laundering networks handling the stolen funds. The funds did not fully return to the victims, but 442,000 USDT and 332,000 USDC were intercepted, and the blacklisted addresses were marked. The beneficiaries are the investigators who received advance transfer plans and addresses, while the pressure is on the money laundering channels that rely on public groups for orders and treat the counterparties as clients.

Source: Public Information