ZachXBT Fronted $349,700 to Infiltrate a $1B Lazarus Laundering Ring

An Investigator Paid His Own Money to Get Inside the Cash-Out Machine

Most blockchain investigations happen from the outside, reading public ledgers. This one did not. Blockchain sleuth ZachXBT says he wired $349,700 of his own stablecoins to a criminal vendor, posed as a client for months, and used what he learned to help freeze stolen funds.

The target was a Chinese organised crime network that allegedly laundered more than $1 billion in proceeds from crypto exploits on behalf of North Korea’s Lazarus Group, according to the investigator’s account published on 5 October. He kept the findings private for roughly 18 months while the case was active.

How the Sting Actually Worked

The thread started with a pattern, not a tip. After the February 2025 Bybit exploit, ZachXBT noticed more than 15 accounts across Telegram and Discord groups touting help with orders tied to stolen funds.

He funded a fresh address with 349,700 USDC on Ethereum and began placing orders with a vendor using the pseudonym “Jimmy Green”, The Block reported. In March 2025, the vendor supplied a receiving address to swap USDC on Ethereum for USDT on Tron.

Each order cost him around 5% of the amount moved. That loss was the price of credibility: repeat business from a paying customer is what persuaded the operator to keep talking.

What the Operator Claimed to Be Handling

The conversations are the part a public ledger cannot show. The vendor described a high-volume business and tied his own operation directly to the largest theft in crypto history.

“He stated his team laundered most of the $1.5 billion from Bybit, which was consistent with the laundering patterns I observed,” ZachXBT wrote. The operator also claimed to have washed roughly $3 million in fraud proceeds and discussed handling funds from an earlier exchange exploit.

Screenshots shared during the exchanges included bridge activity that matched movements the investigator was already tracking on-chain. The network’s operations spanned Hong Kong and mainland China, with links to Huione Guarantee, the sanctioned marketplace long associated with illicit crypto services.

How a Stablecoin Issuer Can Freeze Stolen Money

Here is the mechanism in plain terms, because it is what made the operation worth the cost. No one can freeze Bitcoin. Most large stablecoins can.

Companies issue tokens such as USDT and USDC, and the smart contract behind them includes a blacklist function. When the issuer adds an address to that list, the balance sitting there stops being transferable. The coins still exist on the ledger, but nobody can move or redeem them.

That turns identification into recovery. Tracing a theft to an address only helps if someone can act on it before the funds reach cash, which is why investigators race to map wallet clusters while the money is still in stablecoins rather than in a bank account or a self-custodied crypto wallet.

The Freezes the Operation Helped Trigger

Information from the vendor let ZachXBT identify a cluster holding more than $12 million that he attributed to the Bybit exploit. Tether subsequently froze 442,000 USDT connected to that cluster.

The investigator says his work has contributed to freezing around $75 million since 2022. Set against the $1.5 billion taken from Bybit alone, that ratio is the uncomfortable arithmetic of crypto theft recovery: most of it gets away.

Nothing here has been tested in court. The claims come from a pseudonymous investigator relaying statements made by a criminal vendor, and no charges tied to this specific network have been announced.

Why Undercover Tracing May Become More Common

The economics of this approach are worth watching. One individual spent roughly $350,000 and 18 months to reach intelligence no amount of passive ledger analysis would have produced, because the missing piece was a conversation, not a transaction.

State-linked groups have adapted faster than the exchanges chasing them, and the laundering layer has professionalised into a service industry with vendors, pricing and customer support. If that trend holds, attribution may increasingly depend on human intelligence inside those services rather than analytics alone. Readers tracking crypto news today should expect more disclosures like this, and more delay between the work and its publication.

What 18 Months of Silence Says About Crypto Crime

The detail that stands out is not the $349,700. It is the waiting. The investigator sat on a finished investigation while private-sector investigators and law enforcement worked the case, publishing only once the operational value had been spent.

That is a notable inversion for an industry where the incentive usually runs toward posting first. It also underscores how much of crypto’s crime response now falls to individuals and stablecoin issuers rather than formal institutions, even as losses keep climbing: industry totals showed crypto hacks reaching $1.26 billion in the third quarter alone.

North Korea’s operation does not depend on better hacking. It depends on a reliable way to turn stolen tokens into usable money. Every exposed vendor makes that step slower and more expensive, which may prove a more durable defence than trying to harden every exchange against attack.