Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers

What it is

ZachXBT's own account of a months-long undercover sting against a Chinese laundering syndicate operating for North Korea's Lazarus Group, run as a self-funded investigation rather than passive on-chain tracing.

How it works

Starting in February 2025, ZachXBT spotted 15+ accounts in public Telegram/Discord groups requesting help with orders tied to Bybit exploit funds. He messaged one, "Jimmy Green," and on March 6, 2025 funded a new Ethereum address with 349.7K USDC to begin trading with him — sending USDC for USDT on Tron. The receiving address had been gas-funded by a wallet already on the public Bybit exploit blacklist, confirming the link. He accepted a 5% loss per transaction to keep building trust and stayed in character (e.g., feigning frustration on March 10 to draw out Jimmy's claim that "the team has prepared $1 million").

Verification was cross-referential: on March 12, 2025, he matched a screenshot Jimmy sent of a bridge transaction against Thorchain explorer timing/amounts to confirm it was real. Jimmy then shared three Solana addresses that exposed a $12M+ cluster of Bybit funds hopping BTC→ETH→SOL→Tron in real time. Jimmy also volunteered checkable details — a ~$300K freeze from 2024 that ZachXBT confirmed on-chain was actually 332,000 USDC frozen from the November 2023 Poloniex hack (also Lazarus-linked), and a separate $3M laundering job that ZachXBT traced to a Huione Guarantee hot wallet.

Preconditions / Affected

Applies to defenders/investigators tracking Lazarus Group laundering infrastructure: the Bybit exploit blacklist, Thorchain swap logs, and wallet clustering across BTC/ETH/SOL/Tron are the specific public data sources used to corroborate an informant's claims in real time.

What to do

• Monitor public Telegram/Discord groups for accounts soliciting help moving stolen funds — this is how the syndicate's intermediaries surface.
• Cross-check gas-funding sources of counterparty addresses against known exploit-fund blacklists before transacting.
• Corroborate informant-supplied screenshots against public swap explorers (Thorchain) by matching amount and timestamp.
• Use shared addresses to pivot into cluster analysis across chains (BTC/ETH/SOL/Tron) to size laundering flows.
• Route findings immediately to private-sector tracing firms and law enforcement rather than publishing in real time, to avoid tipping off the operation.

Caveats

This is a self-reported first-person account with no independent verification of the methodology beyond ZachXBT's own on-chain corroboration; the piece states he delayed publication specifically "for sensitivity," so some operational details may be omitted.