Blockchain investigator ZachXBT has revealed details of a $349,700 undercover operation that exposed an alleged Chinese laundering network connected to North Korea-linked hackers. According to his October 5 X thread, the investigation identified more than $12 million in Bybit-linked funds moving across several public blockchains, with the operation spanning from late February to March 2025. The investigator posed as a paying customer after finding more than 15 accounts in public Telegram and Discord groups seeking help with transactions tied to the Bybit hack.
ZachXBT's investigation led him to an operator using the alias 'Jimmy Green', whose chats and wallet details helped map Bybit-linked funds across multiple networks. As reported by ZachXBT, after contacting the operator in late February 2025, he presented himself as a customer holding marked crypto and asked to exchange funds for USDT on Tron. By March 6, he had funded a fresh Ethereum address with 349,700 USDC and accepted a 5% loss on each order while building trust. The first on-chain link came from the payment route used for one of those trades, with the receiving address having been funded for gas by a wallet traceable to the Bybit exploit. Jimmy described an operation spanning Hong Kong and mainland China and claimed his team had laundered most of the $1.5 billion stolen from Bybit. The most useful aspect was that Jimmy would announce moves before acting, such as predicting that North Korea's work would start tomorrow and Bitcoin would return to Solana, which ZachXBT matched to actual fund movements.
The investigation revealed three Solana addresses that exposed a wallet cluster containing more than $12 million in Bybit-linked funds, according to ZachXBT's tracing. His work showed assets moving from Bitcoin to Ether, then Solana and Tron while the transactions were occurring. As reported by ZachXBT, Tether later froze 442,000 USDT connected to the cluster, though Tether has separately confirmed larger freezes tied to the Bybit theft. By October 31, 2025, Tether said T3-related cases had frozen $19 million linked to the Bybit incident, with the March 26, 2025 freeze involving nearly $9 million. ZachXBT also matched Jimmy's reference to roughly $300,000 frozen in 2024 to a 332,000 USDC freeze connected to the November 2023 Poloniex exploit, where more than $100 million was stolen. A separate brag about washing $3 million in fraud proceeds led to a hot wallet at Huione Guarantee, with ZachXBT noting that the Cambodian marketplace has since been sanctioned and its former chairman arrested.
The FBI officially attributed the $1.5 billion Bybit theft to North Korea's state-backed TraderTraitor actors in a public notice issued five days after the attack on February 21, 2025. According to the FBI, actors tracked as TraderTraitor stole approximately $1.5 billion in virtual assets, converted part of the haul into Bitcoin and other assets, and spread funds across thousands of addresses on multiple blockchains. Bybit's forensic update revealed that compromised credentials belonging to a Safe developer allowed the attacker to gain unauthorized access to Safe infrastructure and deceive signers into approving a malicious transaction, with the exchange's incident timeline putting the loss at $1.46 billion including 401,347 ETH. Blockchain analytics firm Elliptic separately reported that more than $1 billion of the Bybit haul had been laundered, much of it through suspected Chinese over-the-counter services.
Chainalysis estimates that North Korean hackers stole $2.02 billion in crypto during 2025, pushing their cumulative total to at least $6.75 billion. The firm identified Chinese-language laundering services, bridges and mixing services among recurring tools in North Korea-linked fund movements. ZachXBT's investigation also pointed to other illicit flows, including 332,000 USDC from the 2023 Poloniex hack that had been frozen in 2024, and another $3 million batch traced to a wallet associated with Huione Guarantee. The US Treasury's Financial Crimes Enforcement Network identified Huione Group as a primary money laundering concern, saying the group had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. The same support-ticket pattern resurfaced last month, with launderers moving funds from the $387 million Bitget hack openly asking for help in public groups, demonstrating that North Korea's contractors still require customer service.
