Researcher Infiltrates Chinese Crime Syndicate Laundering Crypto for Lazarus Group

Blockchain investigator ZachXBT has revealed that he infiltrated a Chinese organized crime syndicate believed to have laundered over $1 billion through cryptocurrency exploits linked to North Korea’s Lazarus Group.

In a disclosure on October 5, 2026, he said he posed as a customer to gather intelligence that helped freeze stolen assets and link criminal conversations to observable blockchain transactions.

Researcher Infiltrates Lazarus Group’s Crypto

The investigation began after the February 2025 Bybit exploit, which ZachXBT described as a $1.5 billion theft attributed to the DPRK-linked TraderTraitor group.

He identified more than 15 accounts seeking help with orders connected to stolen funds in public Telegram and Discord communities. These support requests served as an entry point into the suspected money laundering network without needing access to its private infrastructure.

ZachXBT reached out to several participants, including a Telegram user named “Jimmy Green,” whose username was long_991 and numeric account ID was 7635649994.

On March 6, 2025, the investigator funded a new Ethereum address with 349,700 USDC to prepare for transactions designed to build credibility with the suspected intermediary.

Jimmy offered to exchange the investigator’s Ethereum-based USDC for USDT on Tron, directing the payment to an Ethereum address abbreviated as 0xbaa5.

According to ZachXBT, this wallet had received transaction gas funding from 0xbcb4, an address directly linked to proceeds from the Bybit exploit and listed on the public Bybit blacklist. This relationship provided an additional on-chain connection between the intermediary’s wallet and the stolen assets.

After completing further exchanges, ZachXBT noted that Jimmy began discussing planned movements of Bybit funds for North Korean clients, as well as operations in Hong Kong and mainland China.

For instance, Jimmy allegedly predicted a transfer to Solana a day before it occurred. Such advance disclosures allowed the investigator to compare private statements with subsequent blockchain activity.

On March 12, 2025, Jimmy shared a screenshot of a bridging transaction. ZachXBT matched its amount and timing to an order created on THORChain explorer within minutes of receiving the message.

Three Solana addresses Jimmy later disclosed revealed a cluster containing over $12 million in Bybit proceeds moving across BTC, ETH, SOL, and Tron. Tether subsequently froze 442,000 USDT associated with that cluster, according to the investigator.

Additionally, the conversations led to discoveries beyond Bybit. Jimmy mentioned a team whose funds had been frozen in 2024; ZachXBT identified 332,000 USDC linked to the Poloniex exploit.

The investigator stated that he personally funded 349,700 USDC and incurred a five percent loss on each exchange while building trust.

These findings highlight how public support channels, gas-funding relationships, cross-chain transaction timing, and undercover engagement can together expose money laundering operations.

However, the syndicate attribution, aggregate laundering total, and described outcomes remain claims from ZachXBT’s disclosure; the accessible thread does not independently establish the identity of every participant or provide complete transaction records for each allegation.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.