A pseudonymous investigator says he fronted $349,700 in stablecoins to pose as a customer of a Chinese laundering network, and that what he learned helped freeze funds from the largest crypto theft on record.
ZachXBT, the onchain sleuth whose findings exchanges routinely act on, published the account this week. The Block reports his claim that the network has laundered more than $1 billion across several exploits linked to Lazarus Group, North Korea’s state hacking outfit.
The operation began in March 2025, about two weeks after $1.5 billion was taken from the exchange Bybit. His contact was a vendor using the name Jimmy Green. To build trust, ZachXBT fronted the USDC and had it swapped into USDT through the vendor, losing roughly 5 percent on each transaction.
What he bought was information. He says the vendor told him one day that funds would be moved to Solana, and the next day they were.
That let him tie a cluster of wallets holding more than $12 million to the Bybit theft. Tether then froze 442,000 USDT connected to those funds. He says law enforcement was told immediately and he kept quiet for 19 months because the investigation was sensitive.
The method matters more than the sum. Tracing usually stalls where stolen funds reach an over-the-counter desk, because the ledger shows the handoff but not who stands behind it. Paying to be a customer gets past that, at a cost and legal risk no compliance team would accept.
The caveats are large. Every detail comes from ZachXBT himself, and no agency has confirmed it. A freeze of $442,000, against $12 million identified and $1.5 billion stolen, also shows how little even an inside view recovers. The Block’s account mentions no arrests.
