Crypto investigator ZachXBT says he spent $349,700 posing as a client of a crypto laundering group linked to North Korea. He said the operation helped trace wallets handling funds stolen in the $1.5 billion Bybit hack.
ZachXBT detailed the operation in an October 5 post on X. He used his own funds to build trust with a Telegram contact and follow the movement of the money. The effort helped identify more than $12 million in Bybit-linked funds moving across several blockchains.
Fake Client Reveals Laundering Trail
In March 2025, ZachXBT spent $349,700 in USDC to gain the trust of a Telegram contact known as Jimmy Green. The transactions gave him access to wallet addresses and other details tied to suspected laundering activity.
Related: FinCEN Withdraws Crypto Mixing and Self-Hosted Wallet Rules
Green charged a 5% fee on each transaction, ZachXBT said. He then compared the wallet information with public blockchain records, allowing him to trace more than $12 million linked to the Bybit hack.
Investigation Connects Wider Network
ZachXBT also traced some funds to Huione Guarantee, a Cambodian marketplace linked to money-laundering services. His analysis connected parts of the activity to hacks involving Poloniex.
The findings led Tether to freeze 442,000 USDT tied to the wallet cluster. ZachXBT said the investigation contributed to more than $75 million in crypto freezes connected to North Korean activity.
Related: Did Jean Phil Go Viral First — or Was the Viral Persona Built to Launch a Memecoin?
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
