ZachXBT Infiltrates Laundering Ring Linked to $1.5B Bybit Hack

The operation centered on an individual using the alias “Jimmy Green,” whom ZachXBT contacted after identifying accounts in Telegram and Discord groups. Over several months, the investigator acted as a customer, trading marked cryptocurrency to gain the syndicate's trust. This access revealed a sophisticated infrastructure that allegedly laundered over $1 billion for the Lazarus Group across multiple exploits. By matching private messages with public blockchain data, ZachXBT tracked funds moving through Bitcoin, Ether, Solana, and Tron.

Mapping the Laundering Network

The investigation produced actionable intelligence, including the identification of a wallet cluster containing $12 million in Bybit-linked assets. This discovery led to the freezing of 442,000 USDT by Tether. While official records from the FBI and the U.S. Treasury confirm North Korea’s role in the $1.5 billion Bybit theft, the specific claims regarding the “Jimmy Green” operation remain unverified by law enforcement agencies. ZachXBT, who has assisted in over $75 million in asset freezes since 2022, noted that he shared his findings with private investigators and authorities before making the details public. The infiltration underscores the persistent role of Chinese-language laundering services in enabling North Korean cyber heists, which Chainalysis reports have reached record-breaking levels in recent years.