ZachXBT infiltrates Chinese crime syndicate laundering $1B for North Korea

Bybit: Bybit is a major cryptocurrency exchange that was targeted in a large-scale cyberattack in February 2025 attributed to North Korea’s Lazarus Group. The platform has since built the LazarusBounty tool to track and support recovery of stolen funds while pursuing legal accountability. In the current context, it is the victim exchange whose hacked assets were linked to the laundering network exposed by ZachXBT’s undercover operation. ZachXBT: ZachXBT is a pseudonymous American blockchain investigator and open-source intelligence researcher known for independent forensic investigations into cryptocurrency fraud, scams, and thefts. He has been active on X since 2021 and joined Paradigm as an incident response advisor in 2025. In this news, he revealed posing as a client under the alias Jimmy Green to infiltrate a Chinese syndicate laundering funds for North Korea’s Lazarus Group, gathering intel that helped freeze assets stolen in the 2025 Bybit hack. Legal Developments: Bybit filed a civil lawsuit in U.S. federal court against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the 2025 theft, securing injunctions to freeze identified stolen assets. Investigation Impact: ZachXBT’s infiltration of the syndicate yielded actionable intelligence shared with law enforcement and private investigators, enabling freezes on funds connected to the Bybit incident and other North Korea-linked cases. Industry Collaboration: Bybit has expanded its LazarusBounty platform to assist other exchanges, such as Bitget, in tracing funds stolen in similar incidents, reflecting ongoing cooperation among platforms facing Lazarus Group threats.