Crypto investigator ZachXBT reported infiltrating a Chinese syndicate and tracing over $1 billion tied to Lazarus Group hacks.

Operational approach

After the Bybit security incident, ZachXBT contacted a middleman on Telegram and began swapping funds through that intermediary to build trust.

He allocated $349,700 of his own capital and accepted roughly 5% losses per exchange to maintain credibility and gather intelligence.

Key findings

Messages and screenshots from the intermediary revealed planned destinations for stolen assets, enabling linkage of addresses to a wallet cluster of more than $12 million from the Bybit breach.

Subsequently, Tether froze 442,000 USDT associated with those addresses, reducing the mobility of some funds.

Follow-up and disclosure

ZachXBT provided the compiled transaction data and communications to law enforcement and technical analysts working on the case for further action.

The investigator attributes the broader tracking to persistent on-chain analysis combined with direct interaction inside the syndicate’s exchange network.