GoKawiilZachXBT says he spent $350K posing as client to track Lazarus laundering network
Pseudonymous investigator ZachXBT disclosed on X that he spent $349,700 of his own money over several months, starting March 6, 2025, to infiltrate a Chinese laundering syndicate tied to North Korea's Lazarus Group. Posing as a client under a Telegram contact named 'Jimmy Green,' he obtained addresses tracing over $12 million from the February 2025 Bybit hack, leading Tether to freeze 442,000 USDT linked to the funds.
GoKawiil's interpretation of the reporting above, not reported fact.
The operation illustrates how individual researchers, rather than exchanges or regulators, are sometimes driving real-time disruption of North Korean cybercrime laundering networks. It also highlights Tether's freezing power as a chokepoint in chains that otherwise hop across Bitcoin, Ethereum, Solana and Tron to evade tracing, though the recurrence of similar patterns after the Bitget hack suggests the underlying laundering infrastructure persists despite such interventions.
- ZachXBT spent $349.7K of personal funds to infiltrate a laundering syndicate linked to Lazarus Group.
- Intelligence gathered helped Tether freeze 442,000 USDT tied to over $12 million from the Bybit hack.
- ZachXBT says he has helped freeze more than $75 million tied to North Korean cyber incidents since 2022.
Source: techreport.com — Krishi Chowdhary, 2026-10-06
Published there as: “ZachXBT spent $350K undercover to infiltrate Lazarus-linked laundering ring”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.