ZachXBT infiltrating a Chinese criminal syndicate

[LuckyCrypto777]

ZachXBT infiltrating a Chinese criminal syndicate that was laundering crypto for Lazarus Group.
He posed as a client and began making trades with one of the network's participants. ZachXBT used his own $349,000 and lost 5% on each transaction to gain the gangsters trust.
While engaged in conversation, the criminal then disclosed information about the movement of $1.5 billion in stolen funds from Bybit.

Ultimately, the detective was able to gather data from the chatty criminal and hand it over to law enforcement. If I understand correctly, this information could help freeze Lazarus funds, if they are in USDT.

https://x.com/zachxbt/status/2107081638073319437


What a guy:

We make money from our heart

[ElDorado_21]

ZachXBT used his own $349,000 and lost 5% on each transaction to gain the gangsters trust.

I want to clarify this amount. Several sources indicate he transferred $3.497m of USDC to an Ethereum wallet on March 6 2025 in order to convert to USDT on Tron while accepting roughly a 5% loss risk per transaction. This means it was more like $3.5M he had at risk, not $349k as I incorrectly stated, which is a considerable difference in scale for an off-the-books transaction.

If I understand correctly, this information could help freeze Lazarus funds, if they are in USDT.

Freezing capability does exist (limited to the stablecoin part of course), as Tether has frozen ~442,000 USDT related to the Bybit attack wallet cluster (> $12 million worth of funds).

Unfortunately, any of the laundered funds that were converted to actual BTC (or other coins, especially privacy coins) along the way in the BTC→ETH→SOL→TRON laundering process are gone for good.

He has a track record for helping to freeze stolen/illicit crypto. Reportedly has been involved with >$75 million freezes since 2022 (many NK-related incidents). So this UC op is nothing new. Just another example.

[LuckyCrypto777]

ZachXBT used his own $349,000 and lost 5% on each transaction to gain the gangsters trust.

I want to clarify this amount. Several sources indicate he transferred $3.497m of USDC to an Ethereum wallet on March 6 2025 in order to convert to USDT on Tron while accepting roughly a 5% loss risk per transaction. This means it was more like $3.5M he had at risk, not $349k as I incorrectly stated, which is a considerable difference in scale for an off-the-books transaction.

If I understand correctly, this information could help freeze Lazarus funds, if they are in USDT.

Freezing capability does exist (limited to the stablecoin part of course), as Tether has frozen ~442,000 USDT related to the Bybit attack wallet cluster (> $12 million worth of funds).

Unfortunately, any of the laundered funds that were converted to actual BTC (or other coins, especially privacy coins) along the way in the BTC→ETH→SOL→TRON laundering process are gone for good.

He has a track record for helping to freeze stolen/illicit crypto. Reportedly has been involved with >$75 million freezes since 2022 (many NK-related incidents). So this UC op is nothing new. Just another example.

You're wrong about two things: first, I was right about the 349,000. We're not talking millions there.

0x073256b50d66a7eb005f2a504d0a4fb6ea62a276

And second, it's not "nothing new" - this is the very first time the detective has taken such action. Before, he'd always just analyzed.
He's so damn brilliant.

[greysonz]

ZachXBT took a huge risk, or perhaps didn't think things through. If the Chinese syndicate had been interested in the origin of those 350,000, they would have gone to his official wallet, lol.


https://x.com/AMLBotHQ/status/2107168553782899038

[BABY SHOES]

This thread will fit in the service discussion... Because it doesn't talk about bitcoin.

--------------------------------
Behind ZachXBT sacrificing $350,000 USDC for his intelligence mission with a loss of 5%, I believe he is getting paid more than that especially with such a long mission to many years.
Even I've heard, he will work as long as there is compensation for him, this is indeed not an ordinary job, but heavy and risky.

[Darker45]

I'm wondering if ZachXBT would eventually find out the Chinese criminal syndicate isn't strictly a criminal syndicate because it's part of the Chinese government. Would we be surprised if ZachXBT eventually finds out the Lazarus Group is actually comprised of North Koreans and Chinese?

If these highly capable hackers are sponsored by China, trained in China, operating from China, why would their proceeds have to be laundered by a criminal syndicate?

[LuckyCrypto777]

ZachXBT took a huge risk, or perhaps didn't think things through. If the Chinese syndicate had been interested in the origin of those 350,000, they would have gone to his official wallet, lol.


https://x.com/AMLBotHQ/status/2107168553782899038

It's surprising, of course, that he made such a mistake himself, being an on-chain analyst, but perhaps he was worried, since this was the first time he had carried out such an implementation operation.

[Somegory]

All I know is that ZachXBT is not appreciated enough, but it's good that someone brings this news to the forum, if he really do use this large amount of money then he is getting paid from someone or somewhere.

If I have the power or let's say. I have a crypto exchange that I am running I would go after ZachXBT as my fighting force for my crypto exchange security team, ZachXBT knows how and where to strike.

It's just a shame that people who claimed to be good people ended up cheating even ZachXBT himself, I saw the tweet on X where I said he can't help individuals who got hacked or stolen from again because after the deals and rescue they will break their own part of the deal.

[FinneysTrueVision]

ZachXBT took a huge risk, or perhaps didn't think things through. If the Chinese syndicate had been interested in the origin of those 350,000, they would have gone to his official wallet, lol.


https://x.com/AMLBotHQ/status/2107168553782899038

He did use an intermediary address to send those funds, but still it was trivial to trace them back to him. Not just the Chinese launderers, anybody who was observing the blockchain could have seen that ZachXBT was transacting with an address linked to the Bybit hack. He could have gotten exposed and hindered his investigation.

The amount of funds that has been frozen in connection to the hack is a very small percentage of the overall sum. This will have almost no impact whatsoever in recovering the exchange's losses. It is still fascinating, nonetheless, to see how these criminals operate.

[Munshi Prem Chand]

...

But to be clear, the "huge risk" part was talking about Zach engaging with scammers, pretending to be a buyer etc. I do not think tracing where the funding came from was necessarily considered as a risk in same category (real world risk vs on chain funding risk).

As shown above the 350k in question went via deBridge into their wallet (instead of just directly on the same chain). Its true that you can figure out "where did this money come from", but you would have to know to trace the deBridge transaction across chains. Basic glance in an EVM block explorer would not reveal zachxbt.eth. Most likely the syndicate doesnt have that level of technical proficiency to be able to easily trace it (its unlikely an OTC guy doing manual transactions is going to be looking at cross bridge transactions). Even if they did figure out that the funding came from zachxbt.eth, so what, zachxbt.eth is his well known ENS. They do not learn anything new, dont find out where he lives etc. In summary, not great OPSEC to use main wallet to fund the transactions, but by far riskiest part was Zach talking to these guys IRL and pretending to be a buyer.

[PVequalNRT]

All I know is that ZachXBT is not appreciated enough, but it's good that someone brings this news to the forum, if he really do use this large amount of money then he is getting paid from someone or somewhere.

He get funded through some private crypto companies. He is helping some exchanges do do private investigations. There are other reports he was given donations that is why he is able to do the things he is doing for crypto. Not everyone will appreciate him though.

If I have the power or let's say. I have a crypto exchange that I am running I would go after ZachXBT as my fighting force for my crypto exchange security team, ZachXBT knows how and where to strike.

It's just a shame that people who claimed to be good people ended up cheating even ZachXBT himself, I saw the tweet on X where I said he can't help individuals who got hacked or stolen from again because after the deals and rescue they will break their own part of the deal.

One thing about this investigation is that it can give a lead but it does not gives you a detail about who is behind the stolen. This peesn he caught doesn't show or give out his detail, he just gave him some hint which can be false as well. Who knows if the guy scammed him further with the details he gave him and try to win Zach to extort him further only to lead no where.

[rbynxx]

All I know is that ZachXBT is not appreciated enough, but it's good that someone brings this news to the forum, if he really do use this large amount of money then he is getting paid from someone or somewhere.

If I have the power or let's say. I have a crypto exchange that I am running I would go after ZachXBT as my fighting force for my crypto exchange security team, ZachXBT knows how and where to strike.

It's just a shame that people who claimed to be good people ended up cheating even ZachXBT himself, I saw the tweet on X where I said he can't help individuals who got hacked or stolen from again because after the deals and rescue they will break their own part of the deal.

Yep but I have doubts and ain't believing what is being posted online. Moreover, we know Zach do this afawk it and for me this was one of the most infiltration he probably done. I wonder what Jimmy Green is doing right now reading all this. lol

I don't think he's alone though, that's not possible unless he's some kind of weirdo. I think he has a team he can rely on.

[oll]

ZachXBT infiltrating a Chinese criminal syndicate that was laundering crypto for Lazarus Group.
He posed as a client and began making trades with one of the network's participants. ZachXBT used his own $349,000 and lost 5% on each transaction to gain the gangsters trust.
While engaged in conversation, the criminal then disclosed information about the movement of $1.5 billion in stolen funds from Bybit.

Thanks to this spy operation, 440,000 USDT was frozen. Maybe they could have given it to the detective as compensation? Just kidding.
Of course, this is the hack victims money, and if I understand correctly, Tether should have returned it to them.

I ask myself another question: did Zach do the right thing by immediately publicly revealing all the details of his operation? Maybe he should have played this spy game a few more times and dug up more information about these assholes? Based on this, he could have prepared a blow that would have been even more painful than those 440,000 USDT.

[5W-KILO]

Lazarus Group is HUGE,  I wish that ZachXBT doesn't say anything about it online because Lazarus Group is an organisation more than just hackers, they can be life threatening too.

Coming out in the public to say you are the one hunting for Lazarus group is not so wise I believe, he can be targeted for doing this in the future, I hope he is ready for anything.

There is also a possibility that ZachXBT isn't working alone too, unless is he some genuine weird nerd, he must have his own reasons. For coming to the public with the news, the guy is just too smarty as well.