On-chain investigator ZachXBT published an extensive thread on his personal X account detailing an undercover operation where he posed as a client to infiltrate a Chinese organized crime syndicate. Through the operation, he uncovered a network that reportedly laundered over $1 billion in stolen crypto funds on behalf of North Korea’s state-sponsored hacking unit, the Lazarus Group.
The revelation provides a rare glimpse into the money-laundering infrastructure that underpins large-scale crypto hacks.
How the Undercover Operation Unfolded
To carry out his mission, ZachXBT posed as a client seeking the services of an organized crime syndicate based in China. Through these undercover interactions, he gathered firsthand data on how the syndicate manages and routes crypto funds.
ZachXBT then used the data obtained from the sting to attribute illicit on-chain activity to specific entities. This attribution linked suspicious transactions on the public ledger directly to the specific groups behind them, breaking through the obfuscation techniques commonly employed by cybercriminals.
Lazarus Group’s $1 Billion Flow
North Korea’s Lazarus Group is widely recognized across the digital asset ecosystem as one of the most prolific cyber threat actors. As a state-sponsored hacking entity, its cyber operations have been responsible for billions of dollars in industry losses through a series of protocol and platform exploits.
The Chinese criminal syndicate infiltrated by ZachXBT served as a laundering intermediary for the hacking group. Investigative findings show that the syndicate laundered over $1 billion from various crypto exploits on behalf of the Lazarus Group, illustrating the sheer scale of the laundering infrastructure behind massive hacking campaigns.
Bybit Exploit Funds Frozen
The most tangible outcome of the intelligence gathered during ZachXBT’s undercover operation was direct action against the stolen assets. The information helped authorities and relevant platforms freeze funds stemming from the February 2025 exploit of crypto exchange Bybit. The Bybit breach in early 2025 stands as one of the largest crypto heists in the history of the digital asset industry.
For the crypto security community, ZachXBT’s infiltration of money launderers underscores the vital importance of inside intelligence gathering. Stolen funds tied to groups like the Lazarus Group can finally be identified and intercepted before moving any further.
Reported via @zachxbt on X.
Also read: Drained $4.9 Million from Fake Job Victims - Crypto Scammers Infiltrated by Ledger Spy Chip
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
