Blockchain investigator ZachXBT posed as a client to infiltrate a Chinese syndicate laundering funds stolen from Bybit, according to details he shared about the operation. He fronted 349,700 USDC to gain access to the group, which is tied to North Korea’s stolen crypto, and paid a 5% fee to a broker on every order.
The ruse gave him advance notice of where the North Korea-linked funds would move next — intelligence that would normally require subpoenas or undercover agents. The syndicate’s broker told him the destination before each transfer.
The 349,700 USDC buy-in
ZachXBT put up 349,700 USDC as the price of admission. That payment wasn’t a one-off cost. For each order he placed through the broker, he surrendered 5% — a standard cut for the laundering service. The arrangement let him watch the money flow from inside the operation rather than from a block explorer.
He didn’t say how long he maintained the cover or how many orders he placed. What he did say is that the broker volunteered the next hop for the North Korea-linked funds before each move. That kind of forewarning is rare; it suggests the syndicate either trusted him or didn’t care who knew.
What the broker revealed
The broker’s tips gave ZachXBT a live feed of where Bybit’s stolen crypto was headed. He didn’t need to trace the blockchain after the fact — he was told in advance. The funds are linked to North Korea, a state actor that has repeatedly been accused of crypto thefts to fund its weapons programs. The Bybit hack, which surfaced earlier this year, has been attributed to North Korean operatives by multiple blockchain analytics firms.
Laundering networks like the one ZachXBT infiltrated typically use over-the-counter brokers, mixers, and chain-hopping to obscure the origin of stolen coins. The Chinese syndicate he encountered fits that pattern. By posing as a client, he turned one of those brokers into an unwitting source.
Why the infiltration matters
Public blockchains are transparent, but the people moving stolen funds are not. ZachXBT’s approach sidesteps that problem by entering the market as a buyer. The 5% fee he paid is a small price compared to the value of knowing where the money goes next.
His findings add to a growing body of evidence that North Korea’s crypto operations rely on commercial launderers, many of them based in China. Those syndicates don’t just move funds; they provide a service to anyone willing to pay the fee. ZachXBT’s operation shows how easily an outsider can buy into that service — and how much the broker is willing to share.
Bybit has not commented on the specifics of ZachXBT’s infiltration. The exchange has previously said it is cooperating with authorities. North Korean officials have consistently denied involvement in crypto thefts.
What happens to the 349,700 USDC
ZachXBT didn’t say whether he recovered the 349,700 USDC or the 5% fees. Those funds are now part of the laundering chain he was investigating. The broker, meanwhile, remains unidentified. Whether law enforcement will act on the intelligence ZachXBT gathered is unclear. He has a history of publishing his findings, and this operation is no exception. The next step is likely another public disclosure — or a referral to the authorities who can freeze the funds he tracked.
