On-chain sleuth helps freeze $75M hacked funds

TLDR

Blockchain investigator ZachXBT says his undercover on-chain work helped issuers and authorities freeze more than $75 million in stolen crypto tied to major hacks.

1. Posing as a client of a Chinese laundering syndicate, ZachXBT fronted about $349,700 in stablecoins and traced funds from Bybits $1.5 billion 2025 exploit.
2. The intelligence exposed a cluster of over $12 million in Bybit loot and contributed to freezes including 442,000 USDT by Tether, with more than $75 million linked to North Korean incidents since 2022.
3. The case shows how on-chain sleuthing plus issuer freezes can disrupt sophisticated cross chain laundering, but also highlights growing pressure on privacy and the importance of investigator funding.

Deep Dive

1. How The Operation Worked

Multiple reports describe ZachXBT infiltrating a Chinese organized crime syndicate that allegedly laundered more than $1 billion for North Koreas Lazarus Group by posing as a paying client in early 2025. He identified at least 15 Telegram and Discord accounts soliciting help with suspicious transactions, then engaged one operator using the alias Jimmy Green as a trading counterparty.

On March 6, 2025, he funded a fresh Ethereum address with about 349,700 USDC and repeatedly swapped it for USDT on Tron at a deliberate 5 percent loss to build trust and gather intelligence, as detailed by Decrypt and other outlets. One receiving address was traceable to Bybit exploit funds, anchoring the link between the broker and the $1.5 billion Bybit theft.

Green then shared screenshots and addresses that ZachXBT matched to live cross chain swaps via THORChain and Solana, revealing a cluster of more than $12 million in Bybit proceeds moving across Bitcoin, Ethereum, Solana and Tron in real time.

2. The $75 Million In Freezes

The same investigations report that Tether subsequently froze about 442,000 USDT connected to the identified cluster, and that ZachXBTs work has helped action more than $75 million in freezes tied to North Korean incidents since 2022. The Defiant, Cointelegraph and others describe this as part of a broader pattern in which stablecoin issuers cooperate with law enforcement to block suspect funds.

This is significant for crypto users because it shows that major stablecoins are not censorship resistant in practice. If funds touch identifiable clusters linked to sanctioned actors or big exploits, issuers can and do freeze balances, even on otherwise permissionless chains.

3. Broader Market And Security Implications

For the market, the case illustrates both the strengths and limits of cryptos transparency. Multi hop laundering using bridges, DEXs and cross chain tools like THORChain makes tracing complex, yet public ledgers allow skilled investigators to follow money when they have enough context.

It also underlines the role of independent researchers. ZachXBT says he funded the operation himself and now seeks grants and donations to support similar high risk investigations, which suggests that some of the most effective defenses against large scale hacks still depend on a small number of individuals.

Looking ahead, users should expect more collaboration between on-chain sleuths, analytics firms, exchanges and stablecoin issuers, and continuing tension around privacy tools that can be used both for legitimate protection and for laundering.

Conclusion

This story shows how a single well executed undercover on-chain investigation can convert blockchain transparency into real world impact, helping freeze tens of millions of dollars in stolen funds. At the same time, it reinforces that large stablecoins and major venues are deeply tied into traditional enforcement, so serious exploit money is increasingly likely to be traced and blocked rather than disappearing quietly into the wider crypto economy.