How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group
2026-10-05 • Zach XBT •
ZachXBT infiltrated a Chinese laundering network by transacting with an operator using the alias Jimmy Green after the $1.5 billion Bybit exploit attributed to the DPRK-linked TraderTraitor cluster. Addresses and messages supplied by the operator exposed a cluster handling more than $12 million in Bybit proceeds across Bitcoin, Ethereum, Solana, and Tron, leading to a 442,000 USDT freeze by Tether. The operator claimed his team had laundered most of the stolen Bybit funds and discussed DPRK-related transfers before some movements occurred. The investigation also connected the network to proceeds from the Bitget, Kelp DAO, and Poloniex exploits.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| WALLET | 0x652d7f9edaaa8891be2de74ea568d… | 2026-10-05 | 2026-10-05 |
| WALLET | 8S6T5gL2w5z4M9TCehMgQjxVm3Q6R7W… | 2026-10-05 | 2026-10-05 |
| WALLET | EvZJGsDymrSUQyF23HLKEgUpjfd9XN1… | 2026-10-05 | 2026-10-05 |
| WALLET | 9gSwa2Mew9P21Wxs8nFgDujTurKZx1n… | 2026-10-05 | 2026-10-05 |
| WALLET | TMGjdFeBf9T6kGB9ZmLzeaAPYWBokuy… | 2026-10-05 | 2026-10-05 |
| WALLET | TS5hY6mm6UsCLNdVDWnsRA69LuAwfdn… | 2026-10-05 | 2026-10-05 |
| WALLET | 0x1893ef01e700b1359280e11736d1b… | 2026-10-05 | 2026-10-05 |
| WALLET | TPwXAPwYaDCm7GrzNFiMmNnofrxEVUR… | 2026-10-05 | 2026-10-05 |
| WALLET | 0xbaa551da0ae0c93025d9a983a6802… | 2026-10-05 | 2026-10-05 |