Crypto sleuth infiltrates crime syndicate laundering for North Korea's Lazarus Group

According to crypto investigator ZachXBT, he managed to infiltrate a Chinese organized crime group that has laundered more than $1 billion in cryptocurrency for the North Korean hacking group Lazarus.

Last week, ZachXBT discovered several Chinese Telegram and Discord accounts that were seeking assistance with laundering money from the $387 million Bitget hack that occurred in September.

Zach said he got in touch with one of those accounts, which went by the name "Jimmy Green," and pretended to be a client needing money laundering services in order to collect information.

During this process, he sent the syndicate various amounts of money to be laundered while recording cryptocurrency addresses and other important details.

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.

Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. pic.twitter.com/jauRRt8875

— ZachXBT (@zachxbt) October 5, 2026

ZachXBT disclosed that he put up nearly $350,000 for this operation, and each transaction he made with Jimmy Green resulted in a 5% loss.

There was "no guarantee Jimmy wouldn’t disappear with the funds," Zach said, adding that there was "an unknown amount of personal risk from dealing with the syndicate."

The intelligence Zach gathered was subsequently utilized to freeze assets connected to the $1.5 billion Bybit hack in 2025, and to associate cryptocurrency transactions with criminal activity.

Jimmy asserted his group laundered the majority of Bybit funds

Jimmy informed Zach that his team had handled the laundering of the majority of the funds stolen from Bybit, and provided multiple hacker addresses as well as a demonstration of bridging funds via THORSwap.

After Jimmy mentioned laundering $3 million for a different client, Zach connected those funds to Huione Guarantee, a sanctioned conglomerate that operated a multibillion-dollar criminal marketplace.

Additionally, Zach tied a $100,000 freeze in 2024 that targeted Jimmy's transactions to the $100 million Poloniex hack.

Lazarus money launderer enjoys wild game and Disney vacations

Jimmy also mentioned to Zach that he enjoys eating wild rabbit and birds, and sent him photographs of the cooked meals.

Their casual conversations also touched on Jimmy's interest in foods that reduce fat and "American coffee," and they both expressed a fondness for Chinese mahjong and trips to Disney.

11/ Throughout our conversations, Jimmy and I had a lot of small talk in between discussing laundering for DPRK.

He talked about playing mahjong, hunting wild rabbits, food, his fat reducing meal, family life, and vacations at Disney.

(His awkward grammar can be explained by… pic.twitter.com/84HwgBYB9I

— ZachXBT (@zachxbt) October 5, 2026

Zach expressed his hope to "continue receiving grants from foundations and donations from individuals, as it enables me to take on higher risk for unique cases that others may not consider viable."

He pointed out that these investigations cannot be disclosed earlier because of sensitive work with private investigators and law enforcement. Consequently, he claims to be "sitting on significant findings from other cases."