ZachXBT Infiltrates Syndicate Laundering Over One Billion Dollars for Lazarus Group

Blockchain investigator ZachXBT disclosed on October 5 that he infiltrated a Chinese organized crime syndicate that laundered more than $1 billion in cryptocurrency for North Korea's Lazarus Group. CryptoSlate, Protos, and Decrypt all reported that the sleuth posed as a money-laundering client and funded repeated stablecoin transactions to track the illicit network in real time. [1][2][3]

According to Decrypt and CryptoSlate, ZachXBT fronted $349,700 of his own funds, incurring a 5 percent fee on every order, to maintain the undercover operation. CryptoSlate reported that his efforts helped trace more than $12 million tied to North Korean hackers and contributed to securing a freeze of 442,000 USDT. Protos added that the investigation began after ZachXBT identified Chinese social media accounts seeking help to launder funds from a $387 million exploit of the Bitget exchange in September. [1][2][3]

The undercover operation aimed to trace illicit proceeds linked to a major February 2025 cyberattack against the Bybit exchange. Decrypt and cybersecuritynews.com reported that the Bybit exploit resulted in $1.5 billion in losses. ZachXBT used private communications and transaction monitoring to gather intelligence on how the syndicate moved stolen assets across blockchains. [1][3][4]

ZachXBT, also known as Zachary Wolk, is an American open-source intelligence researcher who conducts independent forensic investigations into digital asset fraud and theft. The Lazarus Group is a state-sponsored cybercrime organization linked by law enforcement to the North Korean government, responsible for multiple high-profile cryptocurrency thefts. [6][7]