ZachXBT Posed as Client to Infiltrate North Korean Laundering Ring

The Undercover Operation

ZachXBT, a pseudonymous on-chain investigator, posed as a client to infiltrate an alleged Chinese syndicate suspected of laundering cryptocurrency stolen in the Bybit exchange hack. According to The Defiant, ZachXBT fronted 349,700 USDC to a broker connected to the network, absorbing a 5% loss on every transaction executed through the operation. The investigator said the broker disclosed in advance where the stolen funds were being routed next, allowing ZachXBT to map the flow of illicit capital through the laundering ring.

Mapping the Network and Asset Freeze

By embedding himself as a client rather than approaching the network as an external researcher, ZachXBT was able to observe operational patterns and fund destinations that would not be visible through standard on-chain analysis alone. The personal capital commitment and willingness to take losses on each trade served as the cover story to gain trust within the group. ZachXBT's investigation identified a cluster of addresses he tied to the Bybit theft, with an aggregate value exceeding $12 million. Following his identification of the network, 442,000 USDT associated with the cluster was frozen, according to The Defiant.

Broader Implications

Crypto Briefing noted that ZachXBT's operation highlights how independent researchers can disrupt illicit networks and potentially impact global cybercrime dynamics. The case underscores both the operational sophistication of state-linked laundering rings and the emerging role of private actors in disrupting them. The asset freeze suggests that ZachXBT's findings may have triggered action from exchanges or law enforcement, though no official regulatory agency has publicly confirmed involvement in the investigation or take-down of the syndicate.