ZachXBT says he infiltrated a Chinese syndicate that laundered more than $1 billion for Lazarus
ZachXBT says he posed as a client of a Chinese laundering syndicate tied to Lazarus, fronting $349,700 to gather intel that helped freeze stolen funds.
Why it matters
The account describes an investigator trading $349,700 of personal capital to gather intelligence inside a laundering network, which is a different sourcing method from public-ledger tracing and could change how freezes in North Korean-linked cases get pursued. Tether's 442,000 USDT freeze and the reported $75 million in total freezes tied to North Korean incidents since 2022 show centralised issuers acting on traced addresses. The picture of money-laundering orders being advertised in public Telegram and Discord groups, including in connection with the September 2026 Bitget incident, is a claim from one investigator that has not been independently confirmed.
Where the sources disagree
Scope of funds tied to the syndicate
more than $1.5 billion from Bybit plus $387 million from Bitget
Finbold
$12 million-plus Bybit cluster
Decrypt, CryptoSlate
$75 million in stolen funds frozen
Bitcoin.com News
Finbold reports the syndicate handled most of the $1.5 billion from the Bybit exploit plus $387 million from the September 2026 Bitget hack, while Decrypt and CryptoSlate describe a Bybit-linked cluster of more than $12 million and Bitcoin.com News reports a total of $75 million in freezes.
Date the undercover operation began
February 2025
Bitcoin.com News
March 6, 2025
Decrypt, CryptoSlate
Bitcoin.com News dates the infiltration to February 2025, shortly after the Bybit hack, while Decrypt and CryptoSlate date the first funded address to March 6, 2025.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$12
Decrypt
$75
Bitcoin.com News
Decrypt reports $12, Bitcoin.com News reports $75 (84% apart).
amount taken (later tether)
442K USDT
Decrypt
349,700 USDC
CryptoSlate
Decrypt reports 442K USDT, CryptoSlate reports 349,700 USDC (21% apart).
Key facts
ZachXBT says he infiltrated a Chinese laundering syndicate linked to Lazarus Group by posing as a client.
Reported by Finbold
ZachXBT says he risked $349,700 of his own capital across 15 suspicious accounts to build trust with the syndicate.
349,700 USDDisputed figureReported by Finbold
The trading arrangement involved paying a standard 5% fee on each order.
5 %Reported by Finbold
Decrypt and CryptoSlate report that ZachXBT funded the first address with 349,700 USDC on March 6, 2025.
349,700 USDDisputed figureReported by Decrypt
ZachXBT says he traced a Bybit-linked cluster of more than $12 million and that Tether later froze 442,000 USDT from it.
442,000 USDDisputed figureReported by Decrypt
Finbold reports the syndicate also handled $387 million tied to the September 2026 Bitget incident.
387,000,000 USDDisputed figureReported by Finbold
ZachXBT says his investigations have helped action more than $75 million in freezes tied to North Korean incidents since 2022, funded by grants and donations.
75,000,000 USDDisputed figureReported by Decrypt
What happened
Blockchain investigator ZachXBT said on October 5 that he infiltrated a Chinese organised crime syndicate by posing as a client, putting $349,700 of his own money into 15 suspicious accounts to build trust, paying a standard 5% fee per order. Decrypt reported that the money went in as 349,700 USDC on March 6, 2025, and CryptoSlate said the first trade was funded on a new Ethereum address the same day. A contact using the Telegram alias Jimmy Green told him the laundered funds were clear of freezing, shared details about moving funds ahead of time, named activity in Hong Kong and mainland China, and sent screenshots of bridges that ZachXBT matched on explorers such as THORChain. Finbold reported that the syndicate handled most of the $1.5 billion from the February 2025 Bybit exploit plus $387 million tied to the September 2026 Bitget incident, while Decrypt put the frozen Bybit-linked cluster at more than $12 million with 442,000 USDT frozen by Tether afterwards. Bitcoin.com News and CryptoSlate both traced the origin of the investigation to users in public Telegram and Discord groups who were openly advertising help with orders tied to stolen funds, and noted the same pattern with support tickets for the Bitget hack. Decrypt also reported ZachXBT's claim that his work has helped action more than $75 million in freezes tied to North Korean incidents since 2022 and that he funds it through grants and donations. Still unconfirmed by anyone but him: the syndicate's own account of the operations, and how much of the wider $1 billion he traced directly through his undercover work rather than from public blockchain data.
How the story developed
- Official statement
ZachXBT publishes his account on X
Decrypt quotes his post: posing as a client, he gathered intel that helped action freezes for the February 2025 Bybit exploit and attribute illicit activity onchain.
- First report
First report by Finbold
Crypto detective goes undercover in Chinese syndicate laundering $1 billion
- Update
ZachXBT first discloses the undercover operation
Finbold published first, describing the infiltration of a Chinese syndicate linked to Lazarus Group and the $349,700 he committed across 15 accounts.
- Independent corroboration
Independently corroborated by Decrypt
Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
- Update
Further outlets pick up the disclosure
CryptoSlate and Bitcoin.com News both reported the same Oct. 5 disclosure, including the Tether freeze and the Bitget support-ticket pattern.
- Official statement
Official statement from Bitcoin.com News
ZachXBT Infiltrates Crypto Syndicate Tied to $1.5B Bybit Hack
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 5 Oct 2026, 15:19 UTC: Finbold — 1 independent source, 1 reports
- 5 Oct 2026, 18:46 UTC: Decrypt — 2 independent sources, 2 reports
- 5 Oct 2026, 20:50 UTC: CryptoSlate — 3 independent sources, 3 reports
- 6 Oct 2026, 07:30 UTC: Bitcoin.com News, official — 4 independent sources, 4 reports
Affected entities
Also mentioned: Bitcoin, TRON, China, Hong Kong, Chainalysis
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | ZachXBT Infiltrates Crypto Syndicate Tied to $1.5B Bybit Hack | Independent | |
| Finbold Crypto media | Crypto detective goes undercover in Chinese syndicate laundering $1 billion | Original | |
| Decrypt Crypto media | Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers | Independent | |
| CryptoSlate Crypto media | ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group | Independent |
Related events
ZachXBT says he infiltrated a Chinese network that laundered over $1 billion for Lazarus Group
ZachXBT says he posed as a client inside a Chinese syndicate that laundered over $1 billion for Lazarus Group, tracing more than $12 million in Bybit hack funds.
Bybit's 40th proof-of-reserves puts covered assets at $19.6B, USDT user holdings down 11.46%
Bybit's 40th proof-of-reserves report shows $19.6B of covered assets, up from $18.1B, with Bitcoin reserve coverage at 104% and USDT user balances down 11.46% to $3.59B.
Bybit Accepts Franklin Templeton Tokenized Fund Shares as Off-Exchange Collateral
Franklin Templeton and Bybit started a program letting eligible clients pledge Benji tokenized money market fund shares through ByCustody for USDT or USDC trading credit.
Binance Launches 24/7 USD/BRL Perpetual Futures With 100x Leverage
Binance is launching a 24/7 US dollar-Brazilian real perpetual futures contract on September 21, settling in USDT with up to 100x leverage.
Bitget CEO 'not very optimistic' about recovering $388 million lost in breach
Cointelegraph reports Bitget CEO Gracy Chen doubts the exchange can freeze or recover the $388 million lost in last week's breach, citing Bybit's limited 2025 recovery.
North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
Blockchain investigator ZachXBT attributes a $2.84 million BNB Chain theft to North Korea-linked group SquidSquad, tracing funds through Tornado Cash to Tron wallets tied to prior North Korean addresses.
