The $350,000 Crypto Sting: How ZachXBT Infiltrated a North Korea-Linked Laundering Network | Daily Crypto Deep Dive

SPEAKER_1 (0:00)

Welcome back to the Daily Crypto Deep Dive. Imagine deliberately sending nearly $350,000 of your own cryptocurrency to people you believe are professional money launderers working with North Korea. Not because you've been hacked, not because you've been scammed. You send it voluntarily, and every time you do business with them, you knowingly lose around 5% of the transaction. There is no contract, no protection, no guarantee they don't simply take the money and disappear.

And the people you're dealing with aren't alleged teenage scammers sitting in bedrooms trying to steal a few thousand dollars. According to blockchain investigator ZachXBT, this was part of an organized Chinese laundering network that had moved more than one billion dollars connected to multiple crypto exploits for North Korea's Lazarus Group. That is exactly what ZachXBT says he did.

And the reason he did it was simple. He wanted to get inside the operation. To understand how extraordinary this is, we need to go back to February 2025 and one of the biggest thefts ever recorded.

Crypto exchange Bybit was hit by an attack in which roughly 1.5 billion dollars worth of cryptocurrency was stolen.

The FBI subsequently attributed the attack to North Korean actors at tracks under the name TraderTrader, associated with the wider ecosystem commonly referred to as Lazarus Group. The FBI warned at the time that the stolen assets were already being converted into Bitcoin and other cryptocurrencies and dispersed across thousands of addresses on different blockchains.

Stealing 1.5 billion dollars, however, creates a massive problem for the thief. You may control the crypto, but that doesn't mean you've got 1.5 billion dollars you can actually spend.

Every transaction on a public blockchain potentially leaves evidence. Exchanges can blacklist addresses. Stablecoin issuers can freeze assets. Investigators can watch money moving in real time. And if you eventually send obviously stolen funds directly into a major regulated exchange and ask for hundreds of millions of dollars, you can probably imagine how that conversation ends. So after the theft comes an entirely different operation which is laundering it. Investigators tracking the Bybit money watched it move through huge numbers of wallets, decentralized exchanges and bridges between different blockchains. TRM Labs estimated that more than 400 million dollars had already been moved through the laundering process within five days of the attack. Eventually, Elliptic reported that more than a billion dollars of the stolen assets had been processed. With some funds apparently reaching suspected Chinese over-the-counter trading services. And this is where our story gets very strange. ZachXBT says that shortly after the Bybit hack, he noticed more than 15 accounts appearing in public telegram and discord groups asking for help with transactions connected to stolen funds. Instead of simply watching them from outside, he decided to become a customer. One of the people he began communicating with used the name Jimmy Green. On March 6, 2025, ZachXBT says he funded a brand new Ethereum address with 349,700 USDC.

The arrangement was essentially to send one type of dollar-backed stablecoin and receive another stablecoin on a different blockchain. But ZachXBT wasn't really interested in the exchange itself. He was interested in the wallets on the other side. He says one address provided by Jimmy had received cryptocurrency needed to pay transaction fees from a wallet directly traceable to the stolen Bybit funds and already publicly identified on Bybit's blacklist. That was the first major clue that he wasn't simply speaking to somebody pretending to know the attackers. So he kept trading. And this is the bit I find absolutely extraordinary. ZachXBT says he was effectively paying for intelligence. Every order could cost him around 5%. The person he was dealing with could disappear at any moment. And ZachXBT says there was also an unknown amount of personal risk involved in communicating with an organized crime network. But as the relationship developed, Jimmy allegedly started talking.

According to ZachXBT, Jimmy began discussing future movements of North Korean linked funds before those movements appeared on chain.

On one occasion, ZachXBT says Jimmy told him that funds were going to move on to Solana. And the following day, that's what happened. That changes the investigation completely. Because now you're not looking backwards at a blockchain trying to work out what happened. You've potentially got somebody telling you what is about to happen next. On March 12, another breakthrough reportedly occurred. Jimmy sent a screenshot relating to a cross-chain transaction. ZachXBT says he matched the amount and timing against publicly visible blockchain information and identified the corresponding transaction. Jimmy then shared three Solana addresses. Those addresses, according to ZachXBT's analysis, helped expose a cluster containing more than $12 million worth of Bybit exploit funds, with assets being moved between Bitcoin, Ethereum, Solana and eventually Tron. Tether later froze 442,000 USDT associated with that cluster.