ZachXBT says he fronted $349.7K of his own money to pose as a laundering client, exposing a Chinese syndicate behind hacks at Poloniex, Bybit and Bitget.
In an X thread on October 5, the pseudonymous on-chain investigator detailed an undercover operation that began on March 6, 2025, when he funded a fresh Ethereum address with 349.7K USDC. His contact, who used the alias Jimmy Green on Telegram, did not know him and there was no guarantee the money would come back at all. “For this case, I fronted $349.7K and lost 5% on each order, with no guarantee Jimmy wouldn’t disappear with the funds, and an unknown amount of personal risk from dealing with the syndicate” , ZachXBT wrote.
The trail started after the February 2025 Bybit exploit, which cost the exchange $1.5 billion and which the FBI attributed to the North Korean group it tracks as TraderTraitor. ZachXBT said he saw 15-plus accounts in public Telegram and Discord groups asking for help moving orders tied to stolen funds. Green’s address had been funded with gas from a wallet directly traceable to Bybit exploit funds, and three Solana addresses Green shared exposed a cluster of more than $12 million in Bybit loot hopping from Bitcoin to Ether to Solana to Tron. Tether later froze 442,000 USDT linked to the cluster.
ZachXBT wrote that Green claimed a team he knew had roughly $300K frozen in 2024. The real figure, per ZachXBT’s tracing, was 332,000 USDC stolen in the November 2023 Poloniex exploit, which drained more than $100 million from the exchange and which researchers have tied to Lazarus Group. Per ZachXBT, the syndicate has laundered more than $1 billion across multiple exploits for Lazarus. The same pattern resurfaced again after the $387 million Bitget hack in late September 2026, which Bitget’s CEO and the tracing firms Elliptic and Chainalysis have linked to North Korea.
“Since 2022, I have helped action $75M+ in freezes related to DPRK incidents” , ZachXBT wrote. Paradigm hired him as an incident response advisor in February 2025, with co-founder Matt Huang saying he had returned more than $350 million to victims of hacks and scams.
