ZachXBT Exposes Bybit Laundering Network
Blockchain investigator ZachXBT says he infiltrated a Chinese-linked crypto laundering network allegedly handling more than $1 billion for North Korea’s Lazarus Group-related operations. The investigation followed the February 2025 Bybit exploit, in which about $1.5 billion was stolen and attributed to the DPRK-linked TraderTraitor group.
ZachXBT posed as a client and used 349,700 USDC to contact a Telegram broker known as “Jimmy Green”. On-chain data linked the broker’s wallet to Bybit hack proceeds. The broker allegedly disclosed laundering activity in Hong Kong and mainland China, including planned transfers to Solana.
The investigation traced more than $12 million in Bybit-linked assets across Bitcoin, Ethereum, Solana and Tron. Tether later froze about $442,000 in related USDT. ZachXBT also identified the use of THORChain, Uniswap liquidity pools and illiquid tokens to obscure stolen funds. The network was allegedly connected to the Poloniex exploit and scam proceeds linked to the sanctioned Huione Guarantee platform.
Evidence was shared with private investigators and law enforcement. ZachXBT said he has helped freeze more than $75 million linked to North Korean hacking operations since 2022. The findings highlight persistent cross-chain laundering risks and could lead to further exchange compliance action, stablecoin freezes and short-term volatility in affected assets. However, the news is unlikely to create a broad market move.
Neutral
The direct price impact is likely neutral because the investigation concerns stolen funds and compliance actions rather than the underlying fundamentals of Bitcoin, Ethereum, Solana or Tron. In the short term, traders may see volatility in assets linked to frozen wallets, exchange transfers or suspected cash-out routes. USDT freezes and stricter exchange screening could temporarily reduce liquidity for affected addresses and tokens, while prompting risk-off positioning around related projects.
The broader market impact should remain limited unless authorities announce major seizures, sanctions or new evidence involving a large exchange. Over the longer term, the case may reinforce demand for on-chain monitoring and institutional compliance, but repeated hacking and laundering reports could also raise regulatory pressure on cross-chain protocols and crypto exchanges. Similar incidents have generally produced asset-specific reactions rather than sustained market-wide price declines.