What happened?
The blockchain investigator known as ZachXBT published an account on October 5 of an operation in which, according to him, he posed as a client of a crypto service and thereby penetrated an alleged Chinese money laundering network. He links it to the North Korean group Lazarus. By his account, the network laundered over $1 billion across various exploits (CryptoSlate, Cointelegraph).
The key figure: ZachXBT says he personally pre-funded $349,700 in USDC to build a relationship with a contact who used the alias "Jimmy Green" (CryptoSlate, The Defiant). According to his account, repeated stablecoin trades opened the door to private conversations about moving funds stolen from the Bybit exchange in 2025.
How was the infiltration supposed to work?
ZachXBT describes getting into the network "from the inside." Instead of merely monitoring on-chain movements, he posed as a customer and funded repeated stablecoin swaps. This supposedly earned him the contact's trust and access to information he could not have obtained from the outside (CryptoSlate).
Based on this information, he says he traced a cluster of addresses that he links to the Bybit hack and values at more than $12 million (The Block, The Defiant). ZachXBT connects his work to the later freezing of $442,000 USDT (The Defiant, CryptoSlate).
What is the context of the Bybit hack?
The 2025 Bybit exchange hack is, according to the cited sources, an attack worth $1.5 billion (The Block, Cointelegraph). Laundering such a large volume of funds typically runs through chains of swaps, mixers, and intermediaries who offer to convert "dirty" tokens for others. One such link in the chain is what ZachXBT was supposedly targeting.
What is verified and what is not yet?
It is important to separate what is documented from what is so far only a one-sided claim.
| Detail | Source | Status |
|---|---|---|
| ZachXBT published an account of the operation on October 5 | CryptoSlate | investigator's claim |
| Pre-funding of $349,700 USDC | CryptoSlate, The Defiant | investigator's claim |
| Network laundered over $1B for Lazarus | Cointelegraph, CryptoSlate | unverified allegation |
| Cluster holding more than $12M from Bybit | The Block, The Defiant | investigator's claim |
| Freezing of $442,000 USDT | The Defiant, CryptoSlate | reported, without official confirmation in the sources |
The sources present ZachXBT's version. In the source material we have no independent confirmation from exchanges, law enforcement, or court documents. The identity of the person behind the alias "Jimmy Green" remains unknown, and the allegations against the network have not been proven in court in any of the cited sources.
What to watch out for with this type of story?
Reports about infiltrations and "exposed" laundering operations tend to be heavily one-sided, because they are based on the investigator's own account. When reading, it helps to track three things: whether there is on-chain evidence that can be independently verified, whether some exchange or authority confirms the freezing of funds, and whether any official charges or a response from the other side emerge. Until these elements are present, this is a documented claim by one person, not a confirmed fact.
charliedesk will track whether the freezing of $442,000 USDT and the cluster's connection to Bybit are confirmed by an independent source. We will openly reassess this story as it develops.