ZachXBT: On-chain sleuth went undercover with Lazarus Group launderers

The Deep Cover Operation

Real talk: most people in the space track hacks from behind a screen, but ZachXBT just leveled up. The pseudonymous on-chain investigator revealed today that he went full 'main character energy' to take down a Chinese crime syndicate linked to North Korea's notorious Lazarus Group. To get the goods, he fronted $349,700 of his own money, posing as a client to infiltrate a crew that moves stolen crypto.

He targeted a figure known as 'Jimmy Green' on Telegram, a contact he connected with while investigating the massive $1.5 billion Bybit exploit from February 2025. Zach, who currently serves as an incident response advisor for Paradigm, says he had to accept a 5% loss on every transaction just to build trust and keep the intel flowing.

Following the Money

It’s giving high-stakes thriller vibes, but the receipts are all on-chain. By gaining Jimmy’s trust, Zach was able to get granular details on how the group operates. Jimmy even bragged about their internal labor divisions for moving USDT. The intel paid off: Zach managed to link screenshots sent by Jimmy to Thorchain transactions, eventually exposing a cluster of $12 million in Bybit loot being shuffled across chains.

Thanks to the data gathered, Tether was able to freeze 442,000 USDT. Jimmy also spilled info that tied the group to the Huione Guarantee marketplace—the same Cambodian hub recently targeted by U.S. Treasury's FinCEN for laundering billions.

High Risk, High Reward

Throughout the operation, the chats were surprisingly casual. Between laundering millions for a state-sponsored hacker group, Jimmy chatted with Zach about mahjong, his diet, and Disney vacations.

ZachXBT, who is in his 20s, has been the industry's go-to for tracking hacks for years, but this move was highkey dangerous. He stressed that he only proceeded after coordinating with private-sector investigators and law enforcement. Since 2022, he’s helped freeze over $75 million in DPRK-linked assets.

Why it matters

This is a massive W for on-chain transparency, but don't get it twisted—this is not financial advice. Zach’s investigation highlights how state-backed hackers operate in the shadows, but it also proves that even with laundering services, the blockchain remembers everything. As always, stay vigilant with your bags because the plot always thickens in crypto.