Intel · China · Tether · North Korea · Decrypt
Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
Most on-chain sleuths trace stolen crypto from the sidelines.
Key facts
- The real figure was 332,000 USDC, stolen in the Poloniex exploit, the November 2023 hack that drained more than $100 million from the exchange and that researchers have tied to North Korea's Lazarus
- On Mar 6, 2025, I funded a new address with 349.7K USDC on Ethereum in preparation to conduct several transactions with Jimmy Green," he said
- Since 2022, I have helped action $75M+ in freezes related to DPRK incidents," ZachXBT wrote
- Paradigm hired him as an incident response advisor in February 2025, with co-founder Matt Huang saying he had returned more than $350 million to victims of hacks and scams
Summary
ZachXBT says he fronted 349.7K USDC on March 6, 2025, and accepted a 5% loss on each order while posing as a client of a Chinese laundering syndicate. He says the operation exposed a $12M+ cluster of Bybit exploit funds, and that Tether later froze 442K USDT linked to it. He says he has helped action $75M+ in freezes tied to North Korean incidents since 2022, and funds his work through grants and donations. "Posing as a client, the reporter gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. That exploit he is referencing caused $1.5 billion in losses to the crypto exchange Bybit.