Skip to content
ZachXBT Exposes Chinese Laundering Operation for Lazarus Group

ZachXBT Exposes Chinese Laundering Operation for Lazarus Group

First seen 5 Oct 2026, 23:26 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 6, 2026 at 00:27 UTC
  • •ZachXBT infiltrated a Chinese syndicate laundering over $1 billion for North Korea.
  • •He lost 5% on each transaction while posing as a client to gain trust.
  • •The investigation led to the freezing of funds linked to the Bybit hack.

Blockchain investigator ZachXBT infiltrated a Chinese money-laundering syndicate linked to North Korea's Lazarus Group, which allegedly laundered over $1 billion, including funds from the $1.5 billion Bybit hack in February 2025. Posing as a client, he fronted $349,700 and lost 5% on each transaction to gain the trust of the launderers. His investigation led to the freezing of Bybit-linked funds and the identification of illicit on-chain flows. The FBI attributed the Bybit theft to a North Korean faction known as TraderTraitor. ZachXBT's interactions revealed operational details of the laundering process, including the division of labor among the crew and the movement of funds through various cryptocurrencies. His findings were shared in a detailed thread on X, showcasing the laundering patterns and the crew's methods.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-02-25
ZachXBT initiates contact
ZachXBT contacted a launderer using the alias 'Jimmy Green' to exchange flagged ETH for clean USDT.
Cyberkendra
2025-03-06
ZachXBT funds Ethereum wallet
He funded a new Ethereum wallet with 349.7K USDC to facilitate transactions with the laundering crew.
Cyberkendra
2025-03-10
Launderers report reduced activity
The launderer mentioned that North Korean flows had been suspended for 10 days, affecting their operations.
Cyberkendra

More articles in this cluster (3)

Following this threat?

Track Lazarus Group, TraderTraitor and Bybit in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 2

Common questions

What was the scale of the laundering operation?
The operation reportedly laundered over $1 billion for North Korea's Lazarus Group.
How did ZachXBT gain access to the laundering crew?
He posed as a client and fronted $349,700 to build trust with the launderers.
What actions were taken as a result of ZachXBT's investigation?
His findings led to the freezing of funds linked to the Bybit hack and helped trace illicit on-chain flows.