{"id":14108,"date":"2026-10-05T21:45:47","date_gmt":"2026-10-05T21:45:47","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14108"},"modified":"2026-10-05T21:45:47","modified_gmt":"2026-10-05T21:45:47","slug":"zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14108","title":{"rendered":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp\" \/><\/p>\n<div data-cs-editorial-figure-scope=\"\" data-cs-editorial-quote-scope=\"\" data-cs-image-viewer-scope=\"\" data-single-article-content=\"\">\n<p>Blockchain investigator ZachXBT said he infiltrated a Chinese laundering syndicate by posing as a cryptocurrency client and funding repeated stablecoin trades.<\/p>\n<p>In an Oct. 5 disclosure, he alleges the network laundered more than $1 billion across exploits for Lazarus Group.<\/p>\n<p>He said he fronted 349,700 USDC to build a relationship with a contact using the alias Jimmy Green. According to his account, the repeated exchanges led to private conversations about moving funds stolen from Bybit in 2025.<\/p>\n<p>He reported tracing a cluster involving more than $12 million in Bybit funds and a later 442,000 USDT freeze by Tether.<\/p>\n<h2>Becoming a client<\/h2>\n<p>ZachXBT said the investigation began after the February 2025 Bybit exploit, when he noticed at least 15 accounts asking for help with orders he linked to stolen funds in public Telegram and Discord groups.<\/p>\n<p>He contacted several of those accounts. One was Jimmy Green, the Telegram alias of the person with whom he subsequently exchanged funds.<\/p>\n<p>On March 6, 2025, ZachXBT said he funded a new Ethereum address with 349,700 USDC in preparation for transactions with the contact. The arrangement involved sending his USDC on Ethereum in exchange for the contact&#8217;s USDT on Tron. He then completed additional transactions to build trust.<\/p>\n<p>As he built trust through repeat exchanges, ZachXBT said the contact began discussing movements of Bybit funds for North Korea before they occurred. The conversations also included details about operations in Hong Kong and mainland China.<\/p>\n<p>In one example, he said the contact told him funds would move to Solana, and the movement happened the following day.<\/p>\n<p>On March 12, 2025, ZachXBT said the contact sent a screenshot of a cross-blockchain transfer. He matched its amounts and timing to an order on the THORChain transaction explorer created within minutes of the message.<\/p>\n<p>According to ZachXBT, the contact also supplied three Solana addresses. He said these exposed a cluster involving more than $12 million in Bybit exploit funds moving through Bitcoin, Ethereum, Solana and Tron.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining The Catalyst\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Catalyst <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">What\u2019s moving crypto. Why it matters.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Get CryptoSlate\u2019s essential stories and what to watch next.<\/p>\n<p>  <svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"16\" fill=\"currentColor\" viewbox=\"0 0 16 16\" aria-hidden=\"true\" focusable=\"false\"> <path d=\"M15 3.604H1v1.891h14v-1.89ZM1 7.208V16l7-3.926L15 16V7.208zM15 0H1v1.89h14z\"\/> <\/svg> <span>Published on Substack<\/span> <\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Seven days a week. Unsubscribe anytime.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<div class=\"cs-inline-newsletter__success\" role=\"status\" aria-live=\"polite\" aria-atomic=\"true\" tabindex=\"-1\"> <span class=\"cs-inline-newsletter__success-icon\" aria-hidden=\"true\"\/><\/p>\n<div>\n<h3 class=\"cs-inline-newsletter__success-title\">Check your inbox.<\/h3>\n<p class=\"cs-inline-newsletter__success-copy\">Your signup request was sent. If confirmation is required, follow the email from Substack.<\/p>\n<p class=\"cs-inline-newsletter__success-hint\">Look in spam or promotions if you don\u2019t see it.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/aside>\n<p>He separately reported that Tether later froze 442,000 USDT linked to the cluster. That is the specific freeze amount described in this part of his investigation; the larger cluster figure represents funds he said he traced.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">Did Tether just freeze $72M in USDT with no link to a hack in Monero money laundering sting?<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>The account also reaches beyond Bybit. ZachXBT said the contact mentioned a team whose funds had been frozen in 2024. He said that matched an on-chain freeze of 332,000 USDC tied to the Poloniex exploit.<\/p>\n<h2>The Bybit backdrop and the cost of access<\/h2>\n<p>In a Feb. 26, 2025 alert, the FBI said North Korea stole approximately $1.5 billion in virtual assets from Bybit on or about Feb. 21. It called the specific malicious activity TraderTraitor.<\/p>\n<p>At the time, the FBI said some stolen assets had been converted into Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It urged private-sector services to block transactions connected to the laundering addresses.<\/p>\n<p>The syndicate&#8217;s total and the links to Jimmy Green remain ZachXBT&#8217;s findings, separate from the FBI&#8217;s attribution of the theft.<\/p>\n<p>Allegations involving a Chinese over-the-counter trader surfaced in October 2024. The latest account describes how ZachXBT obtained information by becoming a trading counterparty himself.<\/p>\n<p>ZachXBT said he fronted 349,700 USDC for the case and lost 5% on each order. The amount advanced is distinct from his net loss, which he did not quantify in the disclosed figures.<\/p>\n<p>He appealed for continued foundation grants and individual donations to support higher-risk investigations. He said intelligence from these trades helped freeze funds tied to the Bybit exploit.<\/p>\n<\/div>\n<p>Analysis,Crime,Featured,Hacks,Bitcoin,Bybit,ethereum,Solana,stablecoins,Tether,Thorchain,USDCBitcoin,Bybit,ethereum,Solana,stablecoins,Tether,Thorchain,USDC#ZachXBT #infiltrates #crypto #syndicate #expose #Lazarus #Group1791236747<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Blockchain investigator ZachXBT said he infiltrated a Chinese laundering syndicate by posing as a cryptocurrency client and funding repeated stablecoin trades. In an Oct. 5 disclosure, he alleges the network laundered more than $1 billion across exploits for Lazarus Group. He said he fronted 349,700 USDC to build a relationship with a contact using the<\/p>\n","protected":false},"author":1,"featured_media":14109,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[91,592,62,31,379,929,7269,6682,152,282,7270,218,4515,1582,2866],"class_list":["post-14108","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bitcoin","tag-bybit","tag-crypto","tag-ethereum","tag-expose","tag-group","tag-infiltrates","tag-lazarus","tag-solana","tag-stablecoins","tag-syndicate","tag-tether","tag-thorchain","tag-usdc","tag-zachxbt"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"ZachXBT says he infiltrated a Chinese laundering network by posing as a crypto client, tracing more than $12 million in Bybit funds tied to North Korean hackers.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=14108\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group\" \/>\n<meta property=\"og:description\" content=\"ZachXBT says he infiltrated a Chinese laundering network by posing as a crypto client, tracing more than $12 million in Bybit funds tied to North Korean hackers.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=14108\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-05T21:45:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14108\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=14108\",\"name\":\"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14108#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14108#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp\",\"datePublished\":\"2026-10-05T21:45:47+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"ZachXBT says he infiltrated a Chinese laundering network by posing as a crypto client, tracing more than $12 million in Bybit funds tied to North Korean hackers.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14108#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=14108\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14108#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14108#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group - Crypto News: Latest Cryptocurrency News and Analysis","description":"ZachXBT says he infiltrated a Chinese laundering network by posing as a crypto client, tracing more than $12 million in Bybit funds tied to North Korean hackers.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=14108","og_locale":"en_US","og_type":"article","og_title":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group","og_description":"ZachXBT says he infiltrated a Chinese laundering network by posing as a crypto client, tracing more than $12 million in Bybit funds tied to North Korean hackers.","og_url":"https:\/\/cryptonews.uk.com\/?p=14108","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-10-05T21:45:47+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp","type":"image\/webp"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=14108","url":"https:\/\/cryptonews.uk.com\/?p=14108","name":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=14108#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=14108#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp","datePublished":"2026-10-05T21:45:47+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"ZachXBT says he infiltrated a Chinese laundering network by posing as a crypto client, tracing more than $12 million in Bybit funds tied to North Korean hackers.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=14108#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=14108"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=14108#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zachxbt-client-mask-network.webp","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=14108#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14108"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14108\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/14109"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}