ZachXBT reveals sting freezing $75M hacked funds

TLDR

On-chain investigator ZachXBT says an undercover sting helped freeze over $75 million in hacked crypto funds linked to North Korea-related exploits.

1. ZachXBT infiltrated a Chinese laundering syndicate tied to the $1.5 billion Bybit hack, fronting about $349,700 in stablecoins to gather on-chain intelligence.
2. That intelligence exposed clusters of stolen funds across Bitcoin, Ethereum, Solana and Tron, enabling issuers like Tether to freeze specific wallets holding hundreds of thousands of USDT.
3. The case highlights both the growing role of forensic investigators and stablecoin issuers in clawing back stolen funds, and the continued scale of Lazarus Group-style crypto crime.

Deep Dive

1. Undercover Operation Details

Multiple reports say ZachXBT went undercover in 2025, posing as a client of a Chinese organized crime syndicate that laundered over $1 billion for North Koreas Lazarus Group and others tied to the $1.5 billion Bybit exploit in February 2025. He identified more than 15 Telegram and Discord accounts advertising laundering services, then focused on a broker using the alias Jimmy Green.

On March 6, 2025, he funded a fresh Ethereum address with roughly 349,700 USDC and repeatedly swapped into USDT on Tron at a deliberate 5 percent loss per order to build trust, even though he risked losing the funds and exposing his identity. The broker shared screenshots, addresses and movement plans that ZachXBT matched on-chain, revealing a cluster of more than $12 million in Bybit exploit proceeds flowing among BTC, ETH, SOL and TRX, as detailed in coverage by The Defiant and Decrypt (operation description, undercover client role).

2. Impact On Hack Recovery

With those clusters identified, ZachXBT says he worked with private investigators, law enforcement and issuers to target specific wallets rather than broad network censorship. Tether is reported to have frozen about 442,000 USDT in a Uniswap-related pool tied to the Bybit funds, while other freezes included 332,000 USDC from the Poloniex exploit and additional amounts linked to fraud via Huione Guarantee, a large peer to peer marketplace (freeze totals and Poloniex link).

Aggregating several North Korea related incidents since 2022, ZachXBT says his investigations helped action more than $75 million in freezes, a figure echoed in outlets like Cryptopotato and Cointelegraph (sting results, Chinese crime network scale). These are not full recoveries of the initial hacks but targeted clawbacks that reduce realized losses and can support restitution.

3. Broader Crime And Risk Signals

The operation reinforces how sophisticated state-linked groups use chain-hopping, bridges and decentralized exchanges to launder large sums, often with help from Chinese intermediaries. Chainalysis estimates North Korea-linked hackers had stolen at least $6.75 billion in digital assets by 2025, much of it laundered through complex multi-chain routes that mirror the flows ZachXBT traced.

At the same time, it shows the growing influence of individual investigators and analytics firms in shaping enforcement. ZachXBT notes he largely self-funded the sting and relies on grants and donations to pursue similar high-risk work, which raises questions about sustainability and personal safety for such actors. For regular users, the case is a reminder that assets like USDT and USDC can be frozen when linked to hacks, and that public on-chain traces can be powerful tools against organized crypto crime.

Conclusion

ZachXBTs sting illustrates a new pattern in crypto enforcement, where independent investigators, stablecoin issuers and law enforcement combine on-chain intelligence to freeze significant portions of hacked funds. The Lazarus-linked hacks remain large in absolute terms, but targeted freezes in the tens of millions show that laundering infrastructure is not untouchable and that visible, stablecoin-heavy flows are increasingly vulnerable to disruption.