Crypto Sleuth Posed as a Customer, Traced $12M in Major Exchange Hack!
On-chain investigator ZachXBT said an investigation in which he posed as a customer helped him trace more than $12 million in funds linked to the Bybit hack and contributed to the freezing of some of them.
According to a statement reported by The Block, after the $1.5 billion Bybit hack in February 2025, ZachXBT began investigating more than 15 accounts on Telegram and Discord seeking help with transactions involving stolen funds. The investigator said this led him to a China-based criminal network that he alleges laundered more than $1 billion from various Lazarus Group attacks.
He put about $350,000 at risk
ZachXBT said he transferred 349,700 USDC to a new wallet on Ethereum to pose as a customer and conducted multiple transactions with a person using the alias “Jimmy Green.” This was the initial funding he used in the investigation; the investigator said he lost about 5 percent on each transaction.
ZachXBT said he continued gathering information despite the risk that Jimmy might disappear with the money, comparing addresses and transaction details shared in their conversations with on-chain activity.
According to the investigator, in March 2025, transaction fees for a recipient address provided to him were paid from another wallet with a directly traceable connection to funds from the Bybit hack. The recipient address was also on a blacklist published by Bybit.
Three shared addresses revealed a cluster of funds
ZachXBT said three Solana addresses sent by Jimmy helped identify a cluster of more than $12 million in Bybit-linked funds moved among Bitcoin, Ethereum, Solana, and Tron. Tether then froze 442,000 USDT linked to this cluster.
The investigator also said Jimmy told him a day before the transactions that Bybit funds would be moved to Solana, and that he observed movement in that direction the next day. He added that Jimmy’s claims that his team had laundered most of the stolen $1.5 billion were consistent with the activity he observed.
Findings were previously shared with law enforcement
Although the investigation’s details are only now being made public, the fund-tracing and freezing took place earlier. ZachXBT said he shared his findings with law enforcement as soon as he obtained them but could not disclose them to the public earlier because of the investigation’s sensitive nature.
The investigator also said he had helped freeze a total of $75 million in funds across various North Korea-linked incidents since 2022.