On Monday, October 5, 2026, independent on-chain investigator ZachXBT published a 12-post X thread describing how he fronted 349.7K USDC, posed as a client, and gathered intelligence on an alleged Chinese organized crime syndicate that — per his account — has laundered more than $1 billion across exploits for North Korea’s Lazarus Group. He says that intel helped action freezes tied to the February 2025 Bybit exploit. Trade desks including Decrypt, The Block, Cointelegraph, BeInCrypto, and crypto.news covered the thread within a day.
Every claim about the syndicate below is ZachXBT’s. The “$1B+ laundered” figure and Jimmy’s boast that his team moved most of Bybit’s ~$1.5 billion are not independently confirmed by public FBI, Treasury, or Tether releases — a caveat Olivia Stephanie flagged at crypto.news. We use “alleged” throughout. And as always on this site: this is news, not trade advice.
How the Sting Started
Shortly after the February 2025 Bybit hack — roughly $1.5 billion, attributed by the FBI to North Korean hackers it tracks as TraderTraitor, per Decrypt — ZachXBT says he watched public Telegram and Discord groups fill with more than 15 accounts asking for help with orders tied to stolen funds. One used the alias “Jimmy Green.”
On March 6, 2025, ZachXBT funded a new Ethereum address with 349.7K USDC and began trading USDC for USDT on Tron with Jimmy — the classic OTC pattern of swapping one stablecoin for another across chains. Per ZachXBT, Jimmy’s receiving address was gas-funded by a wallet “directly traceable to Bybit exploit funds” and listed on Bybit’s public exploit blacklist. We are not reprinting any addresses or Jimmy’s Telegram handle.
What Jimmy Allegedly Said — and What On-Chain Matched
After several trust-building trades, ZachXBT says Jimmy talked about moving Bybit funds for DPRK before it happened, and about operations in Hong Kong and mainland China. “One day prior he stated funds would be moved to Solana and the next day they were,” ZachXBT wrote. Jimmy also claimed his team had laundered most of the $1.5 billion — Jimmy’s claim, relayed by ZachXBT, not independently confirmed.
On March 12, ZachXBT matched a screenshot of Jimmy bridging funds to a THORChain order created within minutes. Jimmy later shared three Solana addresses that, per ZachXBT, mapped to a $12 million-plus cluster of Bybit funds swapping BTC → ETH → SOL → Tron in real time. Tether later froze 442K USDT linked to that cluster — again, per ZachXBT’s documentation.
Other checks ZachXBT says lined up: Jimmy’s offhand “~$300K frozen in 2024” matched 332K USDC from the Poloniex exploit, and about $3 million in fraud proceeds traced to a Huione Guarantee hot wallet. Huione Guarantee is part of Cambodia’s Huione Group, which FinCEN has targeted; Telegram banned the marketplace in May 2025, per Decrypt.
The Human Texture — and the Cost
Between swaps, ZachXBT says the small talk covered mahjong, hunting wild rabbits, food, a fat-reducing meal, family life, and Disney vacations — the kind of ordinary chat that makes a Telegram “vendor” feel like just another OTC contact. Harsh Notariya at BeInCrypto leaned into that color when covering the thread.
The bill, per ZachXBT’s closing post: he fronted $349.7K, lost 5% on each order, and had no guarantee Jimmy wouldn’t disappear with the funds. The float came from grants and donations. He says he has helped action $75 million-plus in DPRK-related freezes since 2022; findings went to private-sector investigators and law enforcement immediately, with publication delayed for sensitivity — as Decrypt and The Block both report.
Why Bitget Fits the Same Pattern
ZachXBT told Decrypt he saw the same Telegram “help with orders” pattern after the $387 million Bitget wallet-backend breach — which Bitget’s CEO and Elliptic/Chainalysis linked to North Korea. The method is familiar: stolen coins need a buyer who will not ask hard questions, and public chat groups are where those introductions happen. We covered that incident here: Bitget’s $387M wallet-backend breach and phased withdrawals.
Press reaction has been strong on X and at Tier-1 crypto desks (Decrypt, The Block, Cointelegraph, BeInCrypto, crypto.news); Reddit, Hacker News, and YouTube were still thin as of the morning of October 7, 2026 SGT. Timmy Shen at The Block and Jose Antonio Lanz at Decrypt carried the core facts; Olivia Stephanie’s crypto.news piece is the clearest public reminder that FBI, Treasury, and Tether releases do not name Jimmy Green or independently confirm the $1 billion syndicate total. No public reporting has identified Jimmy’s real identity, and we are not speculating about arrests or charges.
Jamoraquai Take
The $1 billion headline is the syndicate’s own boast, and we can’t verify it. What we can verify is quieter and more useful: stolen crypto doesn’t vanish — it gets sold, often through friendly “vendors” in Telegram groups who chat about mahjong and Disney trips. That’s the same kind of OTC swap regular users get offered every day.
If a stranger’s USDT rate looks a little too good, ask where the coins came from. Stablecoin issuers can freeze tokens after the fact, and a freeze can land on whoever is holding them — not just the person who stole them. P2P and OTC USDT swaps arranged in Telegram or Discord are not automatically clean just because the chat feels casual. You do not need an undercover sting to learn that lesson; you only need to remember that the coin in your wallet can carry someone else’s history.
Sources
- ZachXBT — How I infiltrated a Chinese organized crime syndicate… (X thread, Oct 5, 2026)
- Jose Antonio Lanz, Decrypt — ZachXBT Fronted $350K to Pose as Client of Lazarus’ Chinese Crypto Launderers (Oct 5, 2026)
- Timmy Shen, The Block — ZachXBT infiltrated Chinese launderers tied to Lazarus / Bybit (Oct 6, 2026)
- Harsh Notariya, BeInCrypto — ZachXBT Lazarus launderer Jimmy Green (Oct 6, 2026)
- Olivia Stephanie, crypto.news — How ZachXBT traced Bybit hack funds to a Lazarus-linked network (Oct 6, 2026)
- Cointelegraph — Chinese crime network laundered over $1B for Lazarus, ZachXBT says
- Jamoraquai — Bitget’s $387M wallet-backend breach and phased withdrawals
