Blockchain investigator ZachXBT says he spent $349,700 of his own money to pose as a client and infiltrate a Chinese money-laundering network linked to the Lazarus Group and the $1.5 billion Bybit hack. The intelligence he gathered helped authorities freeze funds tied to the exchange heist, according to his account of the operation.
How the undercover operation worked
ZachXBT, whose real identity isn't publicly known, presented himself as a client looking to move illicit crypto. Over time, he built enough trust with the launderers to observe their methods and identify wallets under their control. That access gave him a rare look inside a operation that normally stays hidden behind layers of transactions and aliases.
The $349,700 wasn't a fee he charged — it was money he put up himself to make the cover believable. In the world of on-chain sleuthing, credibility is currency, and a client who won't commit real funds doesn't get past the first conversation.
What the Bybit hack has to do with it
Bybit lost roughly $1.5 billion in February 2025, one of the largest crypto thefts ever recorded. Investigators quickly attributed the breach to Lazarus, the North Korean state-backed hacking crew that has been linked to a long string of exchange robberies and bank heists. The stolen funds didn't sit still. They moved through mixers, bridges, and over-the-counter brokers in a laundering pipeline that spans multiple countries.
ZachXBT's infiltration targeted one node in that pipeline: a Chinese laundering crew that allegedly handled a slice of the Bybit proceeds. His intelligence fed into efforts that led to some of those funds being frozen — a rare win in a cat-and-mouse game where stolen crypto usually vanishes into the ether.
The economics of chasing stolen crypto
There's no bounty system that pays investigators like ZachXBT upfront. He funds these operations himself, often at significant personal cost, and recoups through a mix of donations, grants, and paid work. The $349,700 outlay is the most concrete number he's attached to a single case, and it underscores how expensive real undercover work can be.
For comparison, blockchain analytics firms employ teams and raise venture capital to do similar tracing. ZachXBT operates largely alone, publishing findings to his hundreds of thousands of followers and letting exchanges, law enforcement, and reporters act on them.
The frozen funds represent only a fraction of the $1.5 billion taken from Bybit. But in laundering networks, disruption has a cost beyond the dollar figure. Every frozen wallet forces the crew to change tactics, burn addresses, and take on more risk — friction that compounds over time.
Why this one got attention
Most coverage of the Bybit hack has focused on the exchange's response, the Lazarus attribution, and the slow recovery of assets. ZachXBT's disclosure flips the camera around: it shows what it takes to get inside the laundering side, and what one investigator is willing to spend to do it.
It also highlights an uncomfortable reality. The people moving stolen crypto are often not hardened state actors but freelance brokers and OTC desks who treat the work as a business. Infiltrating them requires speaking their language, which means real money and real patience.
What happens next
The frozen funds will likely be subject to legal proceedings, though the path to returning them to Bybit or its customers is rarely quick. ZachXBT hasn't said whether he'll pursue similar operations against other laundering crews tied to Lazarus. For now, the $349,700 receipt stands as one of the few hard numbers attached to the underground effort to claw back the Bybit billions.
