ZachXBT Went Undercover in a Ring That Laundered $1B+ for Lazarus: How the Scheme Works and What It Means for Your USDT

How the detective got inside

On February 21, 2025, about $1.5 billion was stolen from the Bybit exchange, the largest theft in crypto history. On February 26, the FBI attributed the attack to North Korea and named the activity TraderTraitor. Stealing is only half the job: the coins then have to become money that no label database will recognize. That is where intermediaries come in.

ZachXBT found more than 15 accounts in public Telegram and Discord groups offering to "process" transfers of funds from the Bybit hack. He approached one operator, who called himself Jimmy Green, posing as a client. According to Jimmy, his team works out of Hong Kong and mainland China and handled most of the funds stolen from Bybit. There is no way to verify this from the outside, and ZachXBT himself presents it as the operator's claim.

The price of trust

On March 6, 2025, the detective set up a fresh Ethereum address and funded it with 349,700 USDC of his own money. The first deal was a swap of USDC for USDT on Tron through Jimmy's addresses. Each deal cost roughly 5% of the amount, and ZachXBT accepted the loss so he would be treated as a regular client.

The operator shared freely: addresses, screenshots, and advance details of upcoming transfers. The detective checked every word against the blockchain:

• the wallet where Jimmy received funds got its gas money from an address linked to the Bybit hack;
• timestamps and amounts from the chats matched transactions on Bitcoin, Ethereum, Solana and Tron;
• when the operator sent a screenshot of a bridge transfer, a matching order appeared on THORChain within minutes.

What got frozen

Three Solana addresses supplied by Jimmy led to a wallet cluster moving more than $12 million of Bybit funds in real time: from bitcoin to ether, then to Solana and Tron. Tether froze about 442,000 USDT held in that cluster at a Uniswap V2 pool address.

Two more stories surfaced along the way. Jimmy mentioned that his team had about $300,000 frozen in 2024. On the blockchain, ZachXBT found that freeze: 332,000 USDC from the Poloniex exchange hack. The operator also described moving about $3 million in fraud proceeds for another client. The detective traced those funds to a hot wallet of Huione Guarantee, part of Cambodia's Huione Group. In May 2025, FinCEN, the US Treasury's financial crimes unit, named that group a primary money laundering concern.

In total, ZachXBT says he has helped freeze more than $75 million tied to North Korean incidents since 2022. The hackers are not slowing down: Chainalysis recently linked them to the $387 million Bitget theft as well, and we covered what analysts found in the Bitget hack. A freeze is not the same as getting money back, though: it only gives victims a chance.

How the laundering works

The Jimmy Green case shows the whole scheme:

1. The intermediary. In effect an underground OTC desk: it takes stolen coins and hands back different ones, on a different chain, for a fee. You can find one in a public chat, and it earns the same few-percent fee the detective was paying.
2. Bridges. The money hops between chains: BTC, ETH, SOL, TRX. Through THORChain and similar protocols the trail breaks at every hop, and an investigator has to stitch it back together by time and amount.
3. Offloading stablecoins. The exit is most often USDT on Tron, the most common coin on the over-the-counter market. In Chinese slang, dirty USDT is called "black U", and it is usually sold below market to people who just want cheaper dollars.

Why it matters to an ordinary person

The last step of the scheme is exactly where it meets an ordinary buyer. You find a P2P seller offering USDT 2-3% below the rate and receive coins that may have an exchange hack behind them. The USDT stablecoin has an issuer that can freeze addresses, which is what happened to the 442,000 USDT in this story. If the coins pass through a blacklisted address, they are stuck there for good, and an exchange you send such a transfer to may hold the deposit and ask where it came from. The burden of proof is on you.

We explained how the issuer's blacklist works in our article on how Tether froze $550 million and whether your USDT can be frozen.

What to do

• Do not take "cheap" USDT from strangers on P2P platforms or in chats. A discount to market with no clear reason is the main red flag.
• Check the sender's address before you accept a transfer: open it in a block explorer. A fresh address that moved millions in a day, or chains of bridge transfers, is a reason to walk away.
• Keep your coins in your own wallet and save transaction hashes: if you ever need to explain where the money came from, the history is at hand.

Swapping without strangers from a chat

If you need a different asset, you do not have to look for a seller on P2P: a crypto exchange shows you the rate and the final amount before the swap. VertEXchange does the swap itself, with no account, email or phone number. You pick a pair, enter your address, send your coins and receive the other coins directly to it. The rate can be floating or fixed; a fixed rate holds for about 15 minutes.

For example, you can exchange USDT TRC20 to bitcoin and keep your reserve at your own address, or, if you want to stay in dollars on another network, swap USDT TRC20 to USDC on Ethereum.

FAQ

Who is ZachXBT?

An independent onchain investigator who works under a pseudonym. He investigates hacks and scams using public blockchain data and publishes his findings on X. The money for this operation was his own.

Will the funds stolen from Bybit be returned?

A freeze only blocks coins at an address; returning them to victims is a separate process through the issuer and law enforcement. Only small portions of the $1.5 billion have been found and blocked so far. Bybit customers did not lose money, though: the exchange covered the hole in its reserves at its own expense.