Zachary Wolk, a blockchain investigator popularly known as ZachXBT, working as an Incident Response Advisor at Paradigm crypto firm, has detailed how he posed as a client to infiltrate a Chinese organized crime syndicate that has moved more than $1 billion tied to multiple blockchain exploits.
On October 5, ZachXBT deconstructed his undercover operation that helped disrupt a sophisticated laundering network that is connected with the Lazarus Group, a cybercrime group operating on behalf of the North Korean government.
In a bid to gain trust with this syndicate, the crypto investigator risked $349,700 of his own capital across 15 identified suspicious accounts. Specifically, he initiated test transactions, paid standard 5% fees, and traced illicit flows across major blockchains.
One member of this criminal group, using the pseudonym Jimmy Green, reassured ZachXBT that the laundered funds were clear of freezing. Furthermore, this on-chain sleuth noted that this criminal organization handled most of the $1.5 billion from the February 2025 Bybit exploit and $387 million tied to the September 2026 Bitget incident.
Crypto investigator helps counter on-chain crime
As trust grew, Jimmy started sharing details about the operation. He talked about moving Bybit funds ahead of time, mentioned activities in Hong Kong and mainland China, and sent screenshots of bridges that ZachXBT quickly matched on explorers like THORChain (RUNE).
Jimmy also provided Solana (SOL) addresses tied to a cluster that moved more than $12 million of the stolen Bybit funds across Bitcoin (BTC), Ethereum (ETH), and Tron (TRX).
As a result, ZachXBT’s tracking helped Tether later freeze $442,000 from the stolen funds. Overall, this on-chain investigator has helped freeze more than $75 million linked to North Korean hacks since 2022.
However, he is calling for financial assistance to fund his investigations, which could further counter on-chain crime.
Featured image via Shutterstock
