Pseudonymous on-chain investigator ZachXBT revealed he fronted 349.7K USDC on March 6, 2025, to infiltrate a Chinese organized crime syndicate working for North Korea’s Lazarus Group. Posing as a client named "Jimmy Green" on Telegram, ZachXBT accepted a 5% loss on each order to build trust and gather intelligence related to the February 2025 Bybit exploit, which caused $1.5 billion in losses and was attributed by the FBI to the DPRK-linked TraderTraitor group.
The operation exposed a cluster of more than $12 million in stolen Bybit funds being swapped across Bitcoin, Ether, Solana, and Tron. Tether subsequently froze 442,000 USDT linked to this activity. ZachXBT verified details provided by Jimmy, including a prior freeze of 332,000 USDC from the Poloniex exploit and links to Huione Guarantee, a Cambodian marketplace targeted by U.S. FinCEN for alleged laundering of at least $4 billion. Since 2022, ZachXBT has helped action over $75 million in freezes tied to North Korean incidents, funding these high-risk investigations through grants and donations.
This development underscores the evolving role of private-sector actors in disrupting state-sponsored crypto infrastructure. By directly financing interactions with illicit networks, ZachXBT bypassed traditional passive tracing methods to obtain actionable intelligence that law enforcement and stablecoin issuers could not easily acquire independently. The successful identification of specific wallet clusters and operational details, such as the division of labor within the syndicate, demonstrates how proactive engagement can yield precise data points for freezing assets and mapping money laundering routes.
The case highlights significant compliance and operational risks associated with North Korean laundering networks operating through Chinese intermediaries and Southeast Asian marketplaces like Huione Guarantee. While the infiltration yielded immediate results, it also reveals the resilience and adaptability of these syndicates, which continue to process billions despite regulatory pressure. Future investigations may face increased scrutiny regarding the legal boundaries of private entrapment and the security risks borne by independent researchers who engage directly with criminal entities.
