ZachXBT disclosed an undercover investigation: infiltrating a group suspected of money laundering for the Lazarus Group and assisting in freezing funds related to the Bybit attack incident

"On-chain detective" ZachXBT posted that he once disguised himself as a client to infiltrate a criminal gang suspected of laundering money for the North Korean-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack incident. ZachXBT stated that after Bybit was attacked for $1.5 billion in February 2025, he found over 15 accounts seeking help with transactions related to the stolen funds in public groups on Telegram and Discord. He then contacted a Telegram user using the alias "Jimmy Green" and built trust through multiple transactions.

According to his disclosure, on March 6, 2025, he transferred $3,497,000 USDC to an Ethereum address for exchanging USDC with TRON chain USDT. The Gas funds for that address can be traced back to the Bybit attack funds and have been publicly marked as a Bybit attack blacklist address. ZachXBT claimed that in subsequent communications, the other party revealed that their team had participated in handling the stolen funds from Bybit and hinted that the funds would be transferred on chains like Solana. By matching transaction times, amounts, and on-chain data, he discovered a wallet cluster involving over $12 million of Bybit attack funds, with funding paths including BTC→ETH→SOL→TRON and others, of which approximately 442,000 USDT had been frozen by Tether. The gang also attempted to launder money through Uniswap liquidity pools and low liquidity tokens. Additionally, the other party revealed that they had helped other clients handle about $3 million in scam proceeds, and ZachXBT tracked the flow of related funds to sanctioned Huione Guarantee-related wallets. ZachXBT disclosed that during this investigation, he initially invested $3,497,000 and bore about 5% loss risk per transaction, with the intelligence obtained being promptly provided to relevant investigative agencies and law enforcement. Since 2022, he has assisted in freezing over $75 million related to North Korea-related incidents.