Investigator ZachXBT Spends $349,700 Infiltrating North Korean Crypto Ring

Blockchain investigator ZachXBT revealed an undercover operation on October 5 in which he spent $349,700 of his own funds to infiltrate a network allegedly laundering money for the North Korea-linked Lazarus Group. According to the investigator, the network was involved in laundering over $1 billion stolen in various cryptocurrency exchange hacks.

The investigation began shortly after the massive Bybit exchange attack in February 2025, in which approximately $1.5 billion was stolen. The investigator tracked over 15 accounts across Telegram and Discord groups seeking fund-transfer services related to the hack. Posing as a client, he contacted an operator using the alias Jimmy Green. On March 6, 2025, he funded a new wallet with 349,700 USDC stablecoins and began executing transactions.

Infiltration and Blockchain Tracking

To build trust, the investigator agreed to absorb an estimated 5% loss on each transaction. He stated that in one transaction, the destination address provided by Jimmy was funded with transfer fees from a wallet directly linked to the Bybit hack funds, which even appeared on a blacklist published by the exchange. He later claimed the operator provided him with advance information regarding North Korean-related fund transfers, which subsequently matched blockchain transaction records.

According to ZachXBT, the gathered intelligence helped identify a cluster of wallets holding over $12 million from the Bybit hack. Tether, the issuer of the USDT stablecoin, subsequently froze $442,700 in cryptocurrency linked to those wallets. The investigator noted he transmitted the intelligence to law enforcement in real-time, but could not publish operation details earlier due to investigation sensitivity.

Crypto as a State Funding Tool

In recent years, the cryptocurrency sector has become a vital revenue source for North Korea, which attempts to bypass international sanctions restricting its access to the global financial system through cyberattacks and digital asset thefts.

North Korean cyber actors have stolen hundreds of millions and even billions of dollars in digital currencies, with a portion of proceeds funding the country's nuclear weapons programs.

United Nations reports have linked North Korean cyber activity to the funding of its ballistic missile and weapons of mass destruction programs, making crypto a central tool in Pyongyang's military financing efforts.