Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
The on-chain sleuth says he posed as a customer of a Chinese crime syndicate, fronting $349,700 and eating 5% on every order, to track Lazarus Group's Bybit loot in real time.
Renowned on-chain investigator ZachXBT revealed that he personally fronted $349,700 to infiltrate a Chinese crime syndicate responsible for laundering funds on behalf of North Korea's Lazarus Group. Operating undercover as a client, ZachXBT absorbed a 5% fee on every transaction processed through the network, allowing him to monitor the movement of stolen assets from the high-profile Bybit hack in real time. The operation provided investigators with rare, ground-level visibility into how large-scale crypto theft proceeds are cleaned and redistributed.
The context centers on Lazarus Group's February 2025 breach of the Bybit exchange, widely reported as one of the largest crypto hacks in history, with losses estimated at approximately $1.5 billion. Lazarus, a state-sponsored hacking collective linked to North Korea, has long relied on networks of overseas money launderers — frequently operating through Chinese organized crime channels — to convert stolen digital assets into usable funds, helping Pyongyang evade international sanctions.
The undercover effort highlights the increasingly sophisticated and resource-intensive methods that independent blockchain analysts are employing to counter state-level cybercrime. It also underscores persistent vulnerabilities in crypto's compliance infrastructure, as illicit actors continue to exploit over-the-counter brokers and peer-to-peer networks to move stolen funds with relative ease.
Observers will be watching whether ZachXBT's findings are shared with law enforcement agencies and whether the data gathered leads to identifications, asset freezes, or formal legal action against individuals connected to the laundering network.
Source: Decrypt
