ZachXBT Posed as a Client to Infiltrate Chinese Syndicate Laundering Bybit Hack Funds

HACK OR EXPLOITZachXBT Posed as a Client toInfiltrate Chinese SyndicateLaundering Bybit Hack Funds42IMPORTANCECLOSED8NEWS MEDIA9PIECESOct 5, 2026 12:21blockboard.net
In Exchanges

ZachXBT said he spent months posing as a customer to reach a Chinese laundering network linked to the February 2025 Bybit hack and Lazarus Group. He said he fronted $349,700 in USDC, paid 5% on each order, and used the access to trace funds and help freezes.

Share on X Share on Telegram Share on Reddit Share on WhatsApp

What this rests on

Claim by claim, with its source
✓
ZachXBT said he posed as a customer to contact a group tied to the February 2025 Bybit theft.
ZachXBT Posed as a Customer to Contact Group Tied to Bybit Theft
✓
He said that outreach helped freeze funds linked to the February 2025 theft and track suspected laundering activity.
ZachXBT Posed as a Customer to Contact Group Tied to Bybit Theft
✓
He said he fronted 349,700 USDC and paid 5% on every order while dealing with a broker who told him where North Korea's stolen funds were going next.
ZachXBT Posed as a Client to Infiltrate Chinese Syndicate Laundering Bybit Hack
✓
He said he posed as a customer of a Chinese crime syndicate to follow Lazarus Group's Bybit loot in real time.
Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Laun
✓
He linked the undercover work to a 442,000 USDT freeze after identifying a cluster he tied to Bybit and valued at more than $12 million.
ZachXBT Says He Fronted $349,700 to Infiltrate Alleged Laundering Ring
✓
He said the work exposed a laundering network he put at about $1 billion and helped trace $12 million in Bybit funds.
How ZachXBT traced Bybit hack funds to a Lazarus-linked network
✓
He spent months posing as a customer inside a Chinese criminal network he said laundered more than $1 billion for Lazarus Group.
ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus
✓
The investigation began after the $1.5 billion Bybit hack, when suspicious accounts on Telegram and Discord sought laundering help.
ZachXBT Says He Infiltrated Chinese Laundering Network Tied to Lazarus

Market reaction

BT Bitcoin it is the asset of the company or protocol in the event from 2 h before to 4 h after the line marks the first headline
published
+0.10 % before publication
-0.96 % after
$86,107price at publication
12series points

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 5 18:30
+16 min
Oct 5 18:46
Decrypt context
Its angle: fronting, sleuth, eating; with quotes
+1 h 53 m
Oct 5 20:23
+10 h 9 m
Oct 6 04:39
+12 h 55 m
Oct 6 07:25
+15 h 22 m
Oct 6 09:51
+16 h 3 m
Oct 6 10:33
CR CryptoPotato echo
No new facts: tradertraitor, information, individual; with quotes
+1 d 12 h
Oct 7 06:41
Crypto News Australia adds
Adds $75M, with quotes
+1 d 19 h
Oct 7 14:16
Crypto Economy echo
No new facts: blockchains, soliciting, identified; with quotes

Thefts of a similar size

WhenWhat happenedFigure
2.0 years ago Kalax · Admin Drain incident $350k
2.5 years ago Sumer.money · Reentrancy incident $350k
3.1 years ago Balancer incident $350k
3.6 years ago Zircon Gamma · Incorrect share accounting incident $350k
3.7 years ago fcdep(EPMAX) incident $350k

4197 incidents stored · 1225 were as large as this one or larger ($350k)