Sleuth, Interrupted: ZachXBT Wired $349.7K of His Own Cash to Play Customer for Lazarus Launderers

The pseudonymous on-chain investigator known as ZachXBT says he transferred $349,700 of his personal funds to a Chinese money-laundering network tied to North Korea's Lazarus Group, disguising himself as a client to help trace proceeds from the February 2025 Bybit exploit that caused $1.5 billion in losses. "Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain," he wrote on X.

According to ZachXBT, the operation began when he observed 15 or more accounts soliciting help with orders connected to stolen funds in public Telegram and Discord groups shortly after the Bybit hack, which the FBI attributed to the North Korean threat actor it tracks as TraderTraitor. He said he observed the same pattern last week following the $387 million Bitget hack, which Bitget's CEO and blockchain tracing firms Ellipic and Chainalysis have linked to North Korea.

On March 6, 2025, ZachXBT funded a new address with 349.7K USDC on Ethereum and engaged a contact using the handle "Jimmy Green" on Telegram, who provided an address for a USDC-to-USDT-on-Tron swap. ZachXBT stated that the address had been funded with gas by a wallet associated with the laundering syndicate, and that he traced the Bybit proceeds to wallets previously linked to the Phemex and BingX hacks.

Paradigm hired ZachXBT as an incident response advisor in February 2025, with co-founder Matt Huang stating that the investigator had returned more than $350 million to victims of hacks and scams. ZachXBT's 2024 tracing of approximately 4,100 BTC stolen from a Genesis creditor contributed to arrests, and on the day of the Bybit exploit he attributed the incident to Lazarus Group using on-chain data, an attribution the FBI confirmed days later. ZachXBT has continued his investigations after a former target sued and doxxed him in 2023, funding his work through foundation grants and individual donations.