ZachXBT Traces $12 Million in Bybit Hack Laundering
Blockchain investigator ZachXBT says he infiltrated an OTC laundering network allegedly linked to North Korean hacking group Lazarus Group and helped freeze funds from the 2025 Bybit attack. The Bybit hack involved about $1.5 billion in stolen assets.
Using the alias “Jimmy Green”, a suspected intermediary allegedly conducted OTC swaps. On 6 March 2025, ZachXBT transferred $3.497 million in USDC to an Ethereum address in exchange for USDT on the TRON network. The address had received gas funding linked to the Bybit attack and was publicly flagged as a Bybit blacklist address.
By matching transaction timing, amounts and on-chain movements, ZachXBT identified a wallet cluster connected to more than $12 million of Bybit-related funds. The laundering routes reportedly moved assets across BTC, ETH, Solana and TRON. About 442,000 USDT was frozen by Tether. The group also allegedly used Uniswap liquidity pools and low-liquidity tokens to obscure fund flows.
ZachXBT said the same network had handled roughly $3 million in alleged scam proceeds, which he traced to wallets associated with sanctioned crypto platform Huione Guarantee. He said he accepted around 5% risk on each transaction and shared the intelligence with investigators and law enforcement. Since 2022, his investigations have helped freeze more than $75 million linked to North Korea-related incidents.
Neutral
The immediate market impact is likely neutral. The investigation concerns historical Bybit hack funds and a specific laundering network rather than a new exchange failure, protocol exploit or broad market liquidation event. The reported $12 million cluster is small relative to total cryptocurrency market liquidity, so it is unlikely to materially affect BTC, ETH or major altcoin prices.
In the short term, traders may monitor wallets linked to the case for transfers to exchanges, bridges, liquidity pools or low-liquidity tokens. Such movements could create temporary volatility or selling pressure in specific assets. Tether’s freezing of approximately 442,000 USDT may also reinforce counterparty and blacklist risks for OTC traders.
Over the longer term, the case is modestly supportive of market integrity but not directly bullish for prices. Blockchain tracing, law-enforcement cooperation and stablecoin freezes can reduce the usable liquidity of criminal networks and strengthen compliance standards. Similar actions after major hacks have generally produced limited broad-market price effects, while increasing scrutiny of privacy tools, OTC desks, cross-chain bridges and decentralized liquidity pools. Traders should therefore focus on asset-specific wallet activity and regulatory developments rather than expect a major market trend from this news alone.