Skip to content

Back to the catalog

ZachXBT poses as money launderer to infiltrate Lazarus network
protos.comarticle

ZachXBT poses as money launderer to infiltrate Lazarus network

Crypto investigator ZachXBT details how he posed as a money-laundering client (contacting a launderer known as "Jimmy Green" over Telegram/Discord) to infiltrate a Chinese organized-crime network laundering funds for North Korea's Lazarus Group. He fronted roughly 350,000 dollars across transactions, collected addresses and bridging methods via THORSwap, and used the intel to link the launderer to the 1.5 billion dollar Bybit hack, the 100 million dollar Poloniex hack, and sanctioned conglomerate Huione Guarantee; findings also contributed to freezing funds tied to the Bybit theft.

TL;DR ZachXBT went undercover as a money launderer to trace a Chinese syndicate laundering Lazarus Group's Bybit and Poloniex hack proceeds, linking it to sanctioned Huione Guarantee.
Open original ↗
Document

What it is

ZachXBT's infiltration operation against "Jimmy Green," a launderer in the Chinese organized-crime network that processes stolen funds for North Korea's Lazarus Group. The page adds the originating trigger and the operational cost/risk details the summary omits.

How it works

Zach first identified multiple Chinese Telegram/Discord accounts soliciting help laundering proceeds from September's $387 million Bitget hack — this is what led him to Jimmy Green in the first place. He then transacted with Jimmy as a paying client, logging crypto addresses and laundering techniques (including a THORSwap bridging example Jimmy demonstrated). Each laundering order cost Zach a flat 5% fee, on top of the ~$350,000 fronted total. Jimmy volunteered that his team handled most of the Bybit theft's laundering, and separately mentioned laundering $3 million for another client, which Zach traced to Huione Guarantee.

Preconditions / Affected

Applies to anyone trying to replicate this kind of source-side infiltration: it requires fronting real capital (not a controlled/sting amount) and tolerating an unbounded loss — Zach states there was "no guarantee Jimmy wouldn't disappear with the funds," plus unspecified personal risk from engaging directly with the syndicate.

What to do

No remediation steps are given (this is investigative journalism, not an advisory). The actionable elements are methodological: the Bitget-hack laundering solicitations were the entry point for finding the launderer, a 5% cut is the going rate this network charged, and THORSwap bridging was the laundering mechanism demonstrated and logged. Zach states he could not disclose this sooner due to coordination with law enforcement/private investigators, and says he is "sitting on significant findings from other cases" — meaning follow-up disclosures are expected.

Caveats

All financial-flow attributions (Bybit, Poloniex, Huione Guarantee links) rest on claims Jimmy made to Zach during the infiltration, not independently verified by the article; the page itself frames these as Jimmy's self-reported admissions rather than confirmed findings.

Technologies named here

Techniques named here

Threat actors named here

Related in Threat Intel