Undercover Operation Unmasks Billion-Dollar Crypto Ring

An independent blockchain investigator spent several weeks operating under the guise of a customer to penetrate a Chinese organized crime syndicate. According to findings published in a 12-post thread on X on October 5, 2026, the group is accused of laundering over $1 billion on behalf of the Lazarus Group, a cyber espionage collective tied to North Korea.

The undercover intelligence gathering was initiated shortly after a massive $1.5 billion theft from the cryptocurrency exchange Bybit on February 21, 2025. Five days after the breach, the Federal Bureau of Investigation (FBI) attributed the incident to TraderTraitor, a North Korean hacking cluster.

Following the heist, blockchain researcher ZachXBT discovered more than 15 accounts offering money laundering services across public Discord and Telegram channels, including communities focused on the THORChain network.

Infiltrating the Network

On February 25, 2025, ZachXBT reached out to an operator on Telegram using the handle long_991 and the alias "Jimmy Green." The investigator proposed processing a 100 ETH test transaction using the privacy protocol Railgun. A graph provided by TRM Labs subsequently illustrated 64.38 ETH moving from an address linked to the Bybit exploit into a wallet connected to Jimmy Green, before entering THORChain 14 minutes later.

To further establish trust with the syndicate, ZachXBT initiated another transaction on March 6, 2025. He funded a new Ethereum address with 349,700 USDC to exchange for USDT on the Tron network, deliberately accepting a 5% loss on each transaction order to appear as a legitimate, motivated client.

"1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group," ZachXBT wrote on X. "Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain."

Tracing Stolen Assets

During the interactions, the launderer provided three Solana (SOL) addresses. This allowed the investigator to map a broader wallet cluster moving over $12 million in proceeds connected to the Bybit breach across the Bitcoin, Ethereum, Solana, and Tron networks. Tether subsequently froze 442,000 USDT associated with the laundering operation.

However, analyzing the action, journalists at The Defiant introduced a cautious perspective. While Etherscan data indicated a 442,399 USDT balance at an Ethereum address marked as a Uniswap V2 liquidity pool, The Defiant team noted: "The address balance does not establish a freeze or who controlled the funds; those claims remain ZachXBT's attribution."

The same money laundering ring is also accused of processing $387.5 million stemming from the September 2026 exploit of the Bitget exchange. Furthermore, the operator bragged about cleaning $3 million in separate fraud proceeds, which ZachXBT traced to wallets affiliated with Huione Guarantee, a U.S.-sanctioned marketplace. He also located on-chain evidence of roughly $300,000 that Jimmy Green claimed to have had frozen during 2024.

Due to the sensitive nature of the intelligence, the findings were kept unpublished for 18 months, though ZachXBT shared his data immediately with law enforcement and private-sector analysts. More than 80% of the stolen Bybit assets were laundered within six months. According to his reports, his pro bono tracking efforts have contributed to over $75 million in asset freezes linked to North Korean operations since 2022.