USD
ZachXBT Says Undercover Probe Exposed Chinese Crypto Laundering Network
Investigator Risked $349,700 to Trace Funds Tied to Bybit and Bitget Incidents
TL;DR
- ZachXBT said he posed as a client to infiltrate a Chinese organized crime syndicate tied to more than $1 billion in illicit crypto flows.
- He risked $349,700 across 15 suspicious accounts, paid 5% fees and traced funds connected to the Bybit and Bitget incidents.
- His tracking helped Tether freeze $442,000, while his work has helped freeze more than $75 million linked to North Korean hacks since 2022.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Zachary Wolk, the blockchain investigator known as ZachXBT and an Incident Response Advisor at Paradigm, said on October 5, 2026, that he posed as a client to infiltrate a Chinese organized crime syndicate that had moved more than $1 billion tied to multiple blockchain exploits. ZachXBT described the laundering network as connected to the Lazarus Group, which the supplied material identifies as operating on behalf of the North Korean government.
How ZachXBT Traced the Laundering Network
ZachXBT risked $349,700 of his own money across 15 identified suspicious accounts as he sought to gain the group’s trust. He initiated test transactions, paid the network’s standard 5% fees and followed illicit flows across multiple blockchains.
A member of the group using the pseudonym Jimmy Green reassured ZachXBT that the laundered funds were clear of freezing. ZachXBT said the organization handled most of the $1.5 billion involved in the February 2025 Bybit exploit, along with $387 million tied to the September 2026 Bitget incident.
As trust developed, Jimmy shared more information about the operation. He discussed moving Bybit funds ahead of time, referred to activities in Hong Kong and mainland China, and sent bridge screenshots that ZachXBT matched using explorers including THORChain.
Jimmy also supplied Solana addresses tied to a cluster that moved more than $12 million in stolen Bybit funds across Bitcoin, Ethereum and Tron. The addresses gave ZachXBT another set of on-chain links to follow as he mapped the flow of assets.
Tracking Helped Tether Freeze Stolen Funds
ZachXBT’s tracking later helped Tether freeze $442,000 from the stolen funds. His broader investigative work has helped freeze more than $75 million linked to North Korean hacks since 2022, according to the supplied material.
The October 5 disclosure also said ZachXBT is seeking financial support to fund further investigations into on-chain crime.
This article has been refined and enhanced by ChatGPT.
