ZachXBT Posed as a Customer to Contact Group Tied to Bybit Theft

Blockchain investigator ZachXBT said he posed as a customer to contact a Chinese organized crime group, helping freeze funds tied to the February 2025 theft from crypto exchange Bybit and track suspected laundering activity.

ZachXBT said the group was involved in funds totaling more than $1 billion. He also identified on-chain activity he suspected was linked to laundering by Lazarus Group, also known as TraderTraitor, a group described as North Korean.

After the Bybit attack, ZachXBT observed at least 15 accounts publicly seeking help with orders directly tied to the stolen funds in Telegram and Discord groups. One person using the alias “Jimmy Green” became a focus of his outreach.