Crypto sleuth ZachXBT claims he was able to infiltrate a Chinese organized crime syndicate that’s laundered over $1 billion in crypto for North Korean hacker collective Lazarus Group.
Last week, Zach uncovered multiple Chinese Telegram and Discord accounts looking for help with laundering funds stemming from September’s $387 million Bitget hack.
According to Zach, he was able to contact one of these accounts, named “Jimmy Green,” and pose as a money laundering client to gather intel.
As part of this process, he sent them various sums of money to be laundered and noted down crypto addresses and other key information.
1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. pic.twitter.com/jauRRt8875 — ZachXBT (@zachxbt) October 5, 2026
Read more: The solution to crypto’s Lazarus problem could be simpler than expected
He revealed that he fronted almost $350,000 to do this, and that every order with Jimmy Green lost him 5%.
There was “no guarantee Jimmy wouldn’t disappear with the funds” Zach claimed, adding that there was “an unknown amount of personal risk from dealing with the syndicate.”
His intel was later used to freeze funds linked to 2025’s $1.5 billion Bybit hack, and help connect crypto transactions to illicit activity.
Jimmy claimed his team laundered most Bybit funds
Jimmy told Zach that his team was responsible for laundering most of Bybit’s stolen funds, and shared various exploiter addresses and an example of bridging funds using THORSwap.
When Jimmy revealed he laundered $3 million for another client, Zach was able to link the funds to Huione Guarantee, a sanctioned conglomerate that ran a multi-billion-dollar criminal marketplace.
Zach also linked a 2024 $100,000 freeze, targeting Jimmy’s transactions, to the $100 million hack of Poloniex.
Lazarus Group launderer eats wild game and goes to Disney
Jimmy also told Zach that they like to eat wild rabbit and birds, sending him pictures of the cooked dish.
Other small talk covered Jimmy’s interest in fat-reducing foods and “American coffee,” and they also shared their love for Chinese mahjong and vacations to Disney.
11/ Throughout our conversations, Jimmy and I had a lot of small talk in between discussing laundering for DPRK. He talked about playing mahjong, hunting wild rabbits, food, his fat reducing meal, family life, and vacations at Disney. (His awkward grammar can be explained by… pic.twitter.com/84HwgBYB9I — ZachXBT (@zachxbt) October 5, 2026
Read more: Crypto sleuth links $500M in Iranian USDT to stolen Bybit funds
Zach says he hopes he’ll “continue receiving grants from foundations and donations from individuals, as it enables me to take on higher risk for unique cases that others may not consider viable.”
He noted that these investigations can’t be shared sooner due to sensitive investigations with private investigators and law enforcement. As such, he says he’s “sitting on significant findings from other cases.”
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
