A Blockchain Sleuth Spent $350,000 Posing as a Client to Infiltrate a Lazarus Group Launderer
Blockchain investigator ZachXBT says he fronted his own money to pose as a client of a Chinese money-laundering syndicate working for North Korea's Lazarus Group, then used what he learned to help freeze stolen funds.
A $1.5 BILLION HACK AND A SUPPORT TICKET IN PUBLIC
The trail starts with the February 2025 theft of $1.5 billion from the exchange Bybit, attributed to the DPRK-linked group TraderTraitor, an attribution the FBI backed days later. Shortly after, ZachXBT observed a pattern of more than 15 accounts asking for help with orders directly tied to the stolen funds in public groups on Telegram and Discord. He saw the same pattern again last week, after a separate hack: a $387 million breach of the exchange Bitget, which Bitget's CEO and the blockchain tracing firms Elliptic and Chainalysis have linked to North Korea.
BUILDING TRUST WITH "JIMMY GREEN"
ZachXBT contacted one of the accounts, who went by the alias "Jimmy Green" on Telegram, and posed as a client. On March 6, 2025, he funded a new Ethereum wallet with 349,700 USDC and began exchanging it for Jimmy's USDT on Tron. He accepted losses of roughly 5% per order to build trust and keep access to the network, ultimately risking close to $350,000 of his own money with no guarantee Jimmy wouldn't simply disappear with it.
The first transaction already gave something away: Jimmy's receiving address had been funded by a wallet traceable to Bybit hack money. Jimmy kept talking. He described fund movements before they happened, once saying funds would move to Solana, and they did the next day, and claimed his team had laundered most of the Bybit haul. Those claims about his team's size and location in Hong Kong and mainland China are allegations from the chats, not independently confirmed facts.
THE TRAIL: $12 MILLION, THREE BLOCKCHAINS, AND A TETHER FREEZE
Jimmy shared three Solana addresses that exposed a cluster of more than $12 million in Bybit loot being swapped in real time, hopping from Bitcoin to Ether to Solana and finally to Tron. Tether later froze 442,000 USDT linked to that cluster.
Jimmy also handed ZachXBT a detail he could check against the public record: he said a team he knew had around $300,000 frozen in 2024, and ZachXBT found the freeze on-chain. The real figure was 332,000 USDC, stolen in the Poloniex exploit, the November 2023 hack that drained more than $100 million and that researchers have tied to Lazarus Group. Jimmy also said he had laundered $3 million in fraud proceeds for a different client, which ZachXBT traced to a hot wallet used by Huione Guarantee, a Telegram marketplace where criminals sold laundering services and stolen data.
The intelligence had a real-world payoff: ZachXBT's work was later used to freeze funds linked to the Bybit hack and help connect crypto transactions to illicit activity. The headline figure attached to the syndicate, more than $1 billion laundered across multiple exploits, is ZachXBT's own assessment rather than a confirmed total from law enforcement.
THE UNVERIFIED PART: WHAT THE CHATS SUGGEST ABOUT NORTH KOREA'S BITCOIN
Alongside the financial trail, screenshots ZachXBT posted show chat messages describing small, specific Bitcoin releases attributed to Kim Jong-un's government, the kind of detail that fueled speculation on the show about an undisclosed North Korean Bitcoin reserve. None of that is independently verifiable. The messages are secondhand claims from an anonymous chat partner in an undercover operation, not confirmed intelligence, and should be read as the show read them: an interesting lead, not a confirmed fact about state holdings.
This story comes from the Simply Bitcoin Live show. Watch the full episode.
