{"id":14180,"date":"2026-10-07T10:25:47","date_gmt":"2026-10-07T10:25:47","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14180"},"modified":"2026-10-07T10:25:47","modified_gmt":"2026-10-07T10:25:47","slug":"zachxbt-says-he-infiltrated-chinese-laundering-network-tied-to-lazarus","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14180","title":{"rendered":"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus"},"content":{"rendered":"

<\/p>\n

\n
\n
\n
    \n
  • ZachXBT spent months posing as a customer to infiltrate a Chinese criminal network allegedly responsible for laundering more than US$1 billion for North Korea\u2019s Lazarus Group.<\/span><\/li>\n
  • The investigation began after the US$1.5 billion Bybit hack, when suspicious accounts openly sought laundering assistance through Telegram and Discord.<\/span><\/li>\n
  • Wallet addresses and transaction records helped ZachXBT trace millions in stolen funds, including a cluster linked to 442,000 USDT subsequently frozen by Tether.<\/span><\/li>\n
  • Having helped secure freezes involving more than US$75 million in DPRK-linked funds since 2022, ZachXBT is seeking funding for further investigations.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n

    Nothing screams criminal mastermind like a money launderer swapping stories about rabbit hunting and Disney holidays. Yet that\u2019s what ZachXBT says he got from a man calling himself Jimmy Green.<\/p>\n

    ZachXBT spent months undercover, gaining the trust of suspected Chinese money launderers allegedly responsible for processing more than US$1 billion (AU$1.43 billion) in stolen crypto linked to North Korea\u2019s Lazarus Group. He detailed his findings in a thread on 5 October.<\/p>\n

    Public Groups, Public Mistakes<\/h2>\n

    It began in February 2025, shortly after the US$1.5 billion (AU$2.15 billion) Bybit hack. More than 15 accounts caught his attention, with users openly discussing transactions involving stolen Bybit funds on Telegram and Discord.<\/p>\n

    He approached several accounts, and Jimmy responded. On 6 March, ZachXBT funded a fresh wallet with 349,700 USDC (approx. AU$501,697) to trade for Jimmy\u2019s USDT on Tron. The wallet Jimmy used to send the funds had received gas from an address linked to the Bybit hack, one that was already on a public blacklist.<\/p>\n

    Read more: <\/strong>Australia Opens AFCA Complaints Path for Digital Asset Users<\/strong><\/p>\n

    More trades followed to build trust, each costing ZachXBT roughly 5%.\u00a0<\/p>\n

    Then Jimmy got chatty. He\u2019d flag transactions before they happened. Funds were heading to Solana one day and, sure enough, they turned up the next. Jimmy also claimed his team had laundered most of the stolen Bybit funds.<\/p>\n

    \n
    \n

    [\u2026] Jimmy began to talk about moving Bybit funds for DPRK in advance of it happening, along with basic details about their operation in HK and mainland China.<\/p>\n<\/div>\n

    \n ZachXBT <\/div>\n<\/div>\n

    The evidence began piling up. A screenshot Jimmy shared of a bridging transaction matched an order on THORChain. Three Solana addresses he provided exposed a cluster holding more than US$12 million (AU$17.2 million), with funds moving between BTC, ETH, SOL and Tron in real time.<\/p>\n

    Tether subsequently froze 442,000 USDT (approx. AU$634,179) linked to the cluster.<\/p>\n

    The group had also experimented with another laundering method, using Uniswap liquidity pools filled with illiquid tokens.<\/p>\n

    Some of Jimmy\u2019s claims appeared to check out, too. ZachXBT traced a US$3 million (AU$4.3 million) batch of fraud proceeds to a Huione Guarantee hot wallet. The company has since been sanctioned, while its former chairman was arrested.<\/p>\n

    Who\u2019s Paying for This?<\/h2>\n

    There was no guarantee Jimmy wouldn\u2019t simply disappear with the money. ZachXBT also acknowledged taking \u201can unknown amount of personal risk\u201d during the investigation.<\/p>\n

    His findings were shared with private-sector investigators and law enforcement, which explains why he\u2019s only now making the details public.<\/p>\n

    Since 2022, ZachXBT says he\u2019s helped secure freezes involving more than US$75 million (AU$107.6 million) in DPRK-linked funds. He is now publicly seeking grants and donations to finance investigations involving greater personal and financial risks.<\/p>\n

    \n
    \n

    I hope to continue receiving grants from foundations and donations from individuals, as it enables me to take on higher risk for unique cases that others may not consider viable.<\/p>\n<\/div>\n

    \n ZachXBT <\/div>\n<\/div>\n

    And there\u2019s more to come. ZachXBT plans to release further data in the coming weeks on groups allegedly involved in laundering funds from the US$387 million (AU$555.2 million) Bitget exploit.<\/p>\n

    Read also: <\/strong>CFTC Moves Ahead With Crypto Rulebook Despite CLARITY Setback<\/strong><\/p>\n<\/p><\/div>\n

    China,Laundering,ZachXBT#ZachXBT #Infiltrated #Chinese #Laundering #Network #Tied #Lazarus1791368747<\/p>\n","protected":false},"excerpt":{"rendered":"

    ZachXBT spent months posing as a customer to infiltrate a Chinese criminal network allegedly responsible for laundering more than US$1 billion for North Korea\u2019s Lazarus Group. The investigation began after the US$1.5 billion Bybit hack, when suspicious accounts openly sought laundering assistance through Telegram and Discord. Wallet addresses and transaction records helped ZachXBT trace millions<\/p>\n","protected":false},"author":1,"featured_media":14181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[1479,7299,1881,6682,605,224,2866],"class_list":["post-14180","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-chinese","tag-infiltrated","tag-laundering","tag-lazarus","tag-network","tag-tied","tag-zachxbt"],"yoast_head":"\nZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=14180\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus\" \/>\n<meta property=\"og:description\" content=\"ZachXBT spent months posing as a customer to infiltrate a Chinese criminal network allegedly responsible for laundering more than US$1 billion for North Korea\u2019s Lazarus Group. The investigation began after the US$1.5 billion Bybit hack, when suspicious accounts openly sought laundering assistance through Telegram and Discord. Wallet addresses and transaction records helped ZachXBT trace millions\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=14180\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-07T10:25:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.cryptonews.com.au\/2024\/04\/23124917\/ZachXBT.jpg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14180\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=14180\",\"name\":\"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14180#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14180#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zach-launder.jpg\",\"datePublished\":\"2026-10-07T10:25:47+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14180#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=14180\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14180#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zach-launder.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zach-launder.jpg\",\"width\":1920,\"height\":1072},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=14180#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=14180","og_locale":"en_US","og_type":"article","og_title":"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus","og_description":"ZachXBT spent months posing as a customer to infiltrate a Chinese criminal network allegedly responsible for laundering more than US$1 billion for North Korea\u2019s Lazarus Group. The investigation began after the US$1.5 billion Bybit hack, when suspicious accounts openly sought laundering assistance through Telegram and Discord. Wallet addresses and transaction records helped ZachXBT trace millions","og_url":"https:\/\/cryptonews.uk.com\/?p=14180","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-10-07T10:25:47+00:00","og_image":[{"url":"https:\/\/cdn.cryptonews.com.au\/2024\/04\/23124917\/ZachXBT.jpg","type":"","width":"","height":""}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=14180","url":"https:\/\/cryptonews.uk.com\/?p=14180","name":"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=14180#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=14180#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zach-launder.jpg","datePublished":"2026-10-07T10:25:47+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=14180#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=14180"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=14180#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zach-launder.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/10\/zach-launder.jpg","width":1920,"height":1072},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=14180#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14180"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/14180\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/14181"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}