North Korea's Bybit Launderer Befriended ZachXBT on Telegram

ZachXBT infiltrated a Chinese crew by pretending to be a scammer. The group is accused of laundering most of Bybit's $1.5 billion for North Korea. In return, the launderer sent him Kim Jong-un updates, dinner photos, and a mahjong invitation.

According to the investigator, the intelligence helped freeze funds and trace Bybit flows. He put up $349,700 of his own cash and collected a 5% fee on each order, paid by the very people he was probing.

Where Do You Find North Korea’s Launderer? In THORChain’s Help Chat

ZachXBT picked up a lead in February 2025, just days after the Bybit breach. He identified 15 or more accounts in public Telegram and Discord groups that were asking for assistance with orders linked to stolen funds.

One account, going by the alias Jimmy Green, had posted about a stuck transaction in THORChain's community chat, which has 10,845 members. A THORSwap team member responded by asking where the swap was coming from. ZachXBT says the funds were Bybit money that had passed through THORChain.

Jimmy's Telegram bio functioned as a job advertisement. Written in Chinese, it proposed to handle flagged BTC, ETH, SOL, and TRX via a mixing service, with a promise that nothing would come back. The account used a US phone number with a Virginia area code.

ZachXBT's cover story involved marked ETH from the Railgun privacy tool that needed conversion into clean USDT on Tron. Jimmy quoted 5%. One early order returned exactly 23,750 USDT, representing a 5% deduction on $25,000.

How Many Times Can Kim Jong-un Come Up in One Chat?

Jimmy did not refer to “the client.” He named Kim Jong-un directly and treated him like an unpredictable supplier.

Later messages read like a weather forecast. Kim had ordered a halt because the coins sent back were too tainted and under review. Kim was testing Bitcoin because he worried about USDT freezes. Of 50 BTC released, Jimmy's team received 30.

At one stage “the foreigners” demanded a ten-day pause. Jimmy complained that the North Korean supply was cut off and his team needed more work.

ZachXBT, staying in character, asked if Kim Jong-un had kept him occupied that day. Jimmy replied that he was now busy every day.

He described his outfit as professional coin laundering, isolation, and freeze prevention, and called it China's biggest. He then told ZachXBT that his team had laundered nearly all of Bybit's $1.5 billion in ETH.

ZachXBT says the claim matched laundering patterns he had already observed. It remains Jimmy's assertion, not a confirmed number. The investigator has previously named a Chinese OTC trader for moving Lazarus funds.

Did the Launderer Really Call the Money’s Next Move?

Jimmy's most valuable habit was speaking before taking action. One morning, he said North Korea's work would begin tomorrow and Bitcoin would go back to Solana. The next day, ZachXBT reports, the funds did move to Solana.

On March 12, 2025, Jimmy sent a screenshot showing himself bridging 1.192 BTC into ETH. ZachXBT linked the amount and timing to a THORChain order created minutes after the message.

Jimmy also provided three Solana addresses. They revealed a cluster of $12 million or more in Bybit funds circulating through BTC, ETH, SOL, and Tron. Tether later froze 442,000 USDT tied to it.

He accidentally resolved an older case. Jimmy mentioned a team he knew had about $300,000 frozen in 2024. ZachXBT located it onchain as 332,000 USDC from the Poloniex exploit.

Another boast about washing $3 million in fraud proceeds led to a hot wallet at Huione Guarantee. ZachXBT notes that the Cambodian marketplace has since been sanctioned and its former chairman arrested.

Who Was Chasing Whom?

Between orders, Jimmy sent photos of two steaming pots of stew. The meat came from wild rabbit and wild bird, shot with a gun. He asked if ZachXBT could play Chinese mahjong.

Other days brought his fat-reducing meal, a cup of American coffee, and complaints about the cold. ZachXBT says the chit-chat also touched on family life and Disney vacations.

One photo showed Jimmy's phone displaying a wallet holding roughly 1.2 million USDT. The laptop behind it had Google Translate open, which accounts for the grammar.

Jimmy was explicit about his team's position. “We are honest businessmen,” he said, moments after sending through another batch of USDT.

The pause before that, he explained, happened because his team had suspected ZachXBT of tricking them. Integrity, he said, came first.

Meanwhile, the detective played hard to get. Jimmy sent good morning after midnight, hello an hour later, and a lone question mark before dawn. ZachXBT scolded him.

Jimmy apologized and said his team had $1 million ready to start at any time.

ZachXBT says he passed everything to private investigators and law enforcement, which is why the thread appeared 19 months late. He estimates his DPRK-related freezes since 2022 at $75 million or more, against billions stolen.

The same support-ticket pattern reappeared last month. Launderers moving funds from the $387 million Bitget hack openly asked for help in public groups. North Korea's contractors, it turns out, still need customer service.