ZachXBT infiltrates laundering network linked to Bybit hack with $3.5 million

A $3.5 million infiltration. ZachXBT claims to have committed its own funds to pose as a client of a Chinese money laundering network suspected of working for North Korean Lazarus hackers. Unveiled on October 5, its investigation made it possible to document circuits linked to the hacking of Bybit and to contribute to the freezing of funds.

The objective: to go beyond transaction monitoring to obtain information directly from the intermediaries responsible for moving stolen cryptocurrencies.

Key Points

ZachXBT claims to have raised approximately $3.5 million of its own funds.

He increased his exchanges with an operator using the pseudonym “Jimmy Green”.

The investigation identified a set of addresses associated with more than $12 million from the Bybit hack.

Around 442,000 USDT was frozen by Tether.

ZachXBT becomes a client to go up the network

After the Bybit hack, ZachXBT spotted accounts in public Telegram and Discord groups that appeared to deal with transactions related to stolen funds. He approaches one of these intermediaries, known under the pseudonym Jimmy Green, presenting himself as a client.

To establish the relationship, the investigator performs several exchanges between USDC and USDT. He claims to have mobilized approximately $3.497 million in USDC and accepted losses close to 5% per trade in order to gather more intelligence. This sum corresponds to the capital committed, and not to an announced total loss.

As trust builds, the intermediary communicates information about future movements of funds. He also claims that his team processed a significant portion of Bybit's loot. These declarations constitute avenues to be compared to the transactions visible on the blockchains.

ZachXBT thus identifies a set of addresses on Solana linked to more than 12 million dollars from the hack. According to his account, approximately 442,000 USDT was subsequently frozen by Tether. The information collected was passed on to private investigators and law enforcement.

Bybit: Track funds, then successfully block them

The starting point remains the theft of approximately $1.5 billion in cryptocurrencies, suffered by Bybit on February 21, 2025. Five days later, the FBI attributed the attack to North Korea and designated the malicious activity under the name TraderTraitor.

The American agency then describes a rapid dispersion: part of the assets were converted into bitcoins and other cryptocurrencies, then distributed among thousands of addresses on several blockchains. It calls on industry players to block transactions associated with identified addresses.

Infiltration provides a complementary piece to this monitoring. Public transactions make it possible to reconstruct pathways; exchanges with an operator can help link addresses and anticipate certain transfers.

But identifying, freezing and returning funds are three separate steps. The 12 million dollars identified therefore do not correspond to an amount recovered. Likewise, the freezing of the 442,000 USDT does not mean that Bybit has already obtained its restitution.