Undercover swaps mapped a $12M+ laundering network handling funds from the 2025 Bybit exploit attributed to DPRK's Lazarus Group; 442K USDT was frozen.
After the February 2025 Bybit exploit, which the source thread and Bybit's incident records attribute to DPRK's Lazarus Group, more than 15 accounts appeared in public Telegram and Discord groups asking for help with orders tied to the stolen funds. ZachXBT contacted several of them and began speaking with an operator using the alias “Jimmy Green,” who advertised swaps across Bitcoin, Ethereum, Solana, and Tron.
On March 6, ZachXBT funded a fresh Ethereum address with 349,700 USDC and completed a series of USDC-to-USDT swaps, accepting a five percent loss on each order to build trust. The first receiving address had been funded by an address on Bybit's public exploit blacklist. As the transactions continued, Jimmy discussed moving Bybit funds for DPRK before later movements occurred, described a team operating in Hong Kong and mainland China, and claimed the team had laundered most of the $1.5B stolen from Bybit. The thread connects the operator's laundering activity to DPRK funds but does not establish that Jimmy or every operator was a Lazarus Group member. That amount remains the operator's claim, not an independently verified total.
On March 12, a bridging screenshot Jimmy sent was matched by amount and timing to a THORChain transaction created within minutes. Three Solana addresses he later shared led to a $12M+ cluster moving Bybit proceeds from Bitcoin to Ethereum, Solana, and Tron. Tether later froze 442K USDT linked to the cluster. The same cluster also used Uniswap liquidity pools with illiquid tokens. The findings were published on October 5, 2026.
February 21, 2025
More than $1.5B is taken from Bybit's Ethereum cold wallet during an exploit attributed to DPRK's Lazarus Group.
Late February 2025
More than 15 accounts appear in public Telegram and Discord groups seeking help with orders tied to the stolen funds. Contact begins with an operator using the alias “Jimmy Green.”
March 6, 2025
A fresh address is funded with 349,700 USDC and the first of several undercover swaps is completed with Jimmy.
March 12, 2025+6 days
A bridging screenshot from Jimmy is matched by amount and timing to a THORChain transaction created within minutes.
After March 12, 2025
Three Solana addresses shared by Jimmy reveal a $12M+ multichain cluster. Tether later freezes 442K USDT linked to it.
October 5, 2026
The 12-post investigation thread is published with the transaction trail, chat records, addresses, and freeze.
Thread introduction: infiltrating a Chinese laundering network handling funds for DPRK's Lazarus Group, including proceeds from the Bybit exploit.
ZachXBT@zachxbtOct 5, 2026More than 15 accounts sought public support for orders tied to Bybit exploit funds.
ZachXBT@zachxbtOct 5, 2026Related thread documenting public support requests from actors moving funds tied to the September 2026 Bitget exploit.
ZachXBT@zachxbtSep 28, 2026Contact with the operator using the alias “Jimmy Green,” including the public Telegram username and ID.
ZachXBT@zachxbtOct 5, 2026Funding the 349,700 USDC address used for the undercover transactions.
ZachXBT@zachxbtOct 5, 2026The first swap address and its link to a gas funder labeled in the Bybit exploit blacklist.
ZachXBT@zachxbtOct 5, 2026Additional transactions and addresses used to build trust.
ZachXBT@zachxbtOct 5, 2026Messages about moving Bybit funds for DPRK, the team's operation, planned Solana movement, and a claim about the $1.5B Bybit proceeds.
ZachXBT@zachxbtOct 5, 2026A March 12 bridging screenshot matched by amount and timing to a THORChain transaction.
ZachXBT@zachxbtOct 5, 2026Three Solana addresses, the $12M+ cluster, and 442K USDT later frozen by Tether.
ZachXBT@zachxbtOct 5, 2026A 332K USDC freeze tied to the Poloniex exploit and a separate $3M flow to Huione Guarantee.
ZachXBT@zachxbtOct 5, 2026Personal conversation used to sustain the relationship with the operator.
ZachXBT@zachxbtOct 5, 2026The cost, risk, publication delay, and support behind the investigation.
ZachXBT@zachxbtOct 5, 2026
