On-chain sleuth helps freeze $75M hacked funds

TLDR

An independent on-chain investigator has helped authorities freeze tens of millions in hacked crypto linked to North Korea by infiltrating a Chinese laundering syndicate.

1. Blockchain sleuth ZachXBT infiltrated a Chinese crime ring allegedly laundering over $1 billion in crypto for North Koreas Lazarus Group, tied to the $1.5 billion Bybit hack.
2. Intelligence from this undercover work helped Tether and other partners trace exploit flows, freeze specific addresses, and cumulatively block about $75 million in stolen funds since 2022.
3. The case shows how transparent ledgers and centralized chokepoints like stablecoin issuers can slow state-backed hackers, but most stolen funds still escape, and compliance pressure on users keeps rising.

Deep Dive

1. Undercover Operation And Key Hacks

Multiple reports say blockchain investigator ZachXBT posed as a client to infiltrate a Chinese organized crime syndicate that he links to more than $1 billion in laundering for North Koreas Lazarus Group and the $1.5 billion 2025 Bybit hack, codenamed TraderTraitor by the FBI.

He reportedly funded an address with about 349,700 USDC, accepted a 5% loss on each order, and built trust with a broker known as Jimmy Green, who described operations in Hong Kong and mainland China and claimed the group handled most of the Bybit haul. Publications like The Defiant, CryptoSlate and Finbold describe how this access let him identify wallets and cross-chain routes moving exploit funds through networks such as Bitcoin, Ethereum, Solana and Tron, often via bridges like THORChain.

CMCs own coverage notes that the same network was also tied to laundering funds from later incidents such as the Bitget and Kelp DAO hacks, highlighting how a few intermediaries can sit in the middle of multiple large exploits.

2. What Was Actually Frozen

The core of the $75 million headline is cumulative. ZachXBT says that since 2022 his investigations have helped facilitate freezes of more than $75 million in crypto linked to North Korea-related incidents, a figure echoed in CMCs summary of his work.

In the Bybit case alone, his tracing exposed a cluster with more than $12 million in exploit funds; within that, Tether later froze about 442,000 USDT tied to specific addresses identified in his investigation, as reported by outlets such as Crypto.news and Finbold. A CoinsKid article stresses that tracing means mapping fund flows, while freezing requires cooperation from issuers and exchanges and does not automatically mean assets are returned.

By comparison, Chainalysis estimates North Korean-linked hackers stole about $2.02 billion in crypto in 2025 and roughly $6.75 billion in total to date, so $75 million frozen is significant but still a small slice of overall losses.

3. Why This Matters For Crypto Users

This episode shows both the power and the limits of on-chain transparency. Public ledgers let investigators like ZachXBT follow money across chains, but they still depend on centralized actors such as stablecoin issuers, exchanges and custodians to actually block or seize assets.

Tethers ability to freeze hundreds of thousands of USDT in response to this and other cases illustrates how stablecoins function as compliance chokepoints, which can be positive for stopping sanctioned actors but also reinforces centralization and the risk of address blacklisting. At the same time, most hacked funds still move quickly through mixers, OTC brokers and cross-chain bridges, limiting recovery.

Conclusion

An on-chain sleuth going undercover to help freeze roughly $75 million of hacked funds shows how human risk-taking, open ledgers and centralized chokepoints can combine to disrupt even state-backed hacking campaigns.

For crypto users, the case underlines a mixed reality: sophisticated attackers remain highly successful, but the same infrastructure they exploit also gives investigators and regulators new ways to trace and sometimes immobilize stolen assets, with rising implications for everyday users privacy and compliance exposure.