ZachXBT says he infiltrated a Chinese network that laundered over $1 billion for Lazarus Group
ZachXBT says he posed as a client inside a Chinese syndicate that laundered over $1 billion for Lazarus Group, tracing more than $12 million in Bybit hack funds.
Why it matters
If Jimmy Green's claim holds, a small set of intermediaries handled most of the $1.5 billion taken in the Bybit hack, which puts a concentrated target on the laundering layer rather than on the hackers themselves. A Tether freeze of $442,000 shows intelligence gathered outside the exchanges can still prompt an issuer to act, but no official confirmation from Bybit or law enforcement is reported.
Where the sources disagree
Total crypto stolen by North Korean hackers
$1.5 billion
Protos
$1 billion
Cointelegraph
Both figures come from Chainalysis but cover different periods, at least $6.75 billion through 2025 against $2.02 billion during 2025 alone.
Which hack the accounts he found wanted to launder
Funds from September's $387 million Bitget hack
Protos
Funds from the $1.5 billion Bybit hack
Crypto.News, CryptoPotato
Protos says the Telegram and Discord accounts ZachXBT found were seeking help with funds from September's $387 million Bitget hack, while Crypto.News and CryptoPotato describe the same accounts as advertising the $1.5 billion Bybit theft.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$1.5 billion
Protos
$1 billion
Crypto.News
Protos reports $1.5 billion, Crypto.News reports $1 billion (33% apart).
amount taken (chinese)
$1.5 billion
Cointelegraph
$1 billion
Crypto.News
Cointelegraph reports $1.5 billion, Crypto.News reports $1 billion (33% apart).
amount taken (chinese crime syndicate)
$1 billion
Cointelegraph
$1.5 billion
CryptoPotato
Cointelegraph reports $1 billion, CryptoPotato reports $1.5 billion (33% apart).
amount taken (chinese)
$1 billion
Crypto.News
$1.5 billion
CryptoPotato
Crypto.News reports $1 billion, CryptoPotato reports $1.5 billion (33% apart).
Key facts
ZachXBT said he infiltrated a Chinese organized crime syndicate that laundered more than $1 billion for Lazarus Group across multiple crypto exploits.
1,000,000,000 USDDisputed figureReported by Protos
ZachXBT said he funded the operation with 349,700 USDC and accepted a 5 percent loss on every order to build trust with the operator.
349,700 USDReported by Protos
The operator ZachXBT approached uses the alias 'Jimmy Green' on Telegram.
Reported by Protos
Protos reported that Jimmy Green told ZachXBT his team was responsible for laundering most of the funds stolen in the Bybit hack.
Reported by Protos
Protos reported that when Jimmy Green said he had laundered $3 million for another client, ZachXBT linked the funds to Huione Guarantee, a sanctioned conglomerate.
3,000,000 USDReported by Protos
Information supplied during the operation led ZachXBT to a cluster of more than $12 million in Bybit-linked funds moving across several blockchains.
12,000,000 USDReported by Cointelegraph
Tether later froze 442,000 USDT connected to wallets uncovered during the undercover operation.
442,000 USDReported by Cointelegraph
What happened
In an October 5 thread on X, on-chain investigator ZachXBT said he posed as a paying customer to infiltrate a Chinese organized crime syndicate that laundered more than $1 billion from multiple crypto exploits for North Korea's Lazarus Group. He reached the network after finding more than 15 accounts in public Telegram and Discord groups asking for help with stolen funds, with Protos reporting the money as coming from September's $387 million Bitget hack while Crypto.News and CryptoPotato described the same accounts as advertising the $1.5 billion Bybit theft that the FBI attributed to state-backed TraderTraitor actors. One operator, who uses the alias 'Jimmy Green' on Telegram, took his business in late February 2025, and by March 6 ZachXBT had funded a fresh Ethereum address with 349,700 USDC and accepted a 5% loss on each order, Protos putting the total at almost $350,000. Cointelegraph reports the operation ran across Hong Kong and mainland China, and that Jimmy Green claimed his team laundered most of the stolen Bybit funds and shared exploiter addresses and a THORSwap bridging example. The information led ZachXBT to a cluster of more than $12 million in Bybit-linked funds, after which Tether froze $442,000 in associated USDT. The account rests on ZachXBT's own disclosure, with no confirmation reported from Bybit, law enforcement or Jimmy Green, and the two Chainalysis totals quoted by the outlets measure different periods.
How the story developed
- Update
ZachXBT publishes his findings in an October 5 thread on X
The thread is the single basis for every figure reported, including the $1 billion laundering claim and the Jimmy Green chats.
- First report
First report by Protos
ZachXBT poses as money launderer to infiltrate Lazarus network
- Independent corroboration
Independently corroborated by Cointelegraph
Chinese crime network laundered over $1B for Lazarus: ZachXBT
- Update
ZachXBT poses as a customer and reaches the operator 'Jimmy Green'
He says he made contact in late February 2025, days after the Bybit hack, and took a 5 percent loss on each order to build trust.
- Update
Tether freezes 442,000 USDT from wallets found in the operation
No freeze date is given in the reporting, and Tether is not quoted.
- Update
Cointelegraph adds the Hong Kong and mainland China detail and Chainalysis totals
Cointelegraph says the operations spanned Hong Kong and mainland China and cites Chainalysis for at least $6.75 billion stolen through 2025.
- Update
ZachXBT funds a new Ethereum address with 349,700 USDC
Jimmy Green gave him an address to send USDC in exchange for USDT on Tron, and ZachXBT found that address had been funded with gas by a wallet traceable to the Bybit exploit.
- Update
Crypto.News publishes the late-February contact and March 6 funding dates
It also cites Chainalysis for a $2.02 billion record year for North Korean hackers in 2025 and repeats the FBI's attribution of the Bybit theft to TraderTraitor.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 5 Oct 2026, 18:37 UTC: Protos — 1 independent source, 1 reports
- 6 Oct 2026, 01:47 UTC: Cointelegraph — 2 independent sources, 2 reports
- 6 Oct 2026, 04:39 UTC: Crypto.News — 3 independent sources, 3 reports
- 6 Oct 2026, 04:41 UTC: Bitcoin Insider — 4 independent sources, 4 reports
- 6 Oct 2026, 10:33 UTC: CryptoPotato — 5 independent sources, 5 reports
Affected entities
Also mentioned: Bitcoin, TRON, China, Chainlink, Hong Kong, United States, Chainalysis
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Protos Crypto media | ZachXBT poses as money launderer to infiltrate Lazarus network | Original | |
| Cointelegraph Crypto media | Chinese crime network laundered over $1B for Lazarus: ZachXBT | Independent | |
| Crypto.News Crypto media | How ZachXBT traced Bybit hack funds to a Lazarus-linked network | Independent | |
| CryptoPotato Crypto media | How ZachXBT Infiltrated a Crypto Laundering Network Handling Bybit and Other Stolen Funds | Independent | |
| Bitcoin Insider Aggregator | ZachXBT Links Chinese Crime Network to $1B Laundering Operation for Lazarus Group | Syndicated |
Related events
ZachXBT says he infiltrated a Chinese syndicate that laundered more than $1 billion for Lazarus
ZachXBT says he posed as a client of a Chinese laundering syndicate tied to Lazarus, fronting $349,700 to gather intel that helped freeze stolen funds.
Bybit's 40th proof-of-reserves puts covered assets at $19.6B, USDT user holdings down 11.46%
Bybit's 40th proof-of-reserves report shows $19.6B of covered assets, up from $18.1B, with Bitcoin reserve coverage at 104% and USDT user balances down 11.46% to $3.59B.
Bybit Accepts Franklin Templeton Tokenized Fund Shares as Off-Exchange Collateral
Franklin Templeton and Bybit started a program letting eligible clients pledge Benji tokenized money market fund shares through ByCustody for USDT or USDC trading credit.
Binance Launches 24/7 USD/BRL Perpetual Futures With 100x Leverage
Binance is launching a 24/7 US dollar-Brazilian real perpetual futures contract on September 21, settling in USDT with up to 100x leverage.
Bitget CEO 'not very optimistic' about recovering $388 million lost in breach
Cointelegraph reports Bitget CEO Gracy Chen doubts the exchange can freeze or recover the $388 million lost in last week's breach, citing Bybit's limited 2025 recovery.
North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
Blockchain investigator ZachXBT attributes a $2.84 million BNB Chain theft to North Korea-linked group SquidSquad, tracing funds through Tornado Cash to Tron wallets tied to prior North Korean addresses.
