Blockchain investigator ZachXBT published findings on October 5 alleging that a laundering network handled more than $1 billion stolen in cryptocurrency exploits for North Korea’s Lazarus Group. Reporting the following day connected the investigation to funds from the $1.5 billion Bybit hack. The account describes an effort to identify intermediaries moving stolen assets, adding information about the movement of funds after an exchange exploit rather than a new attack on Bybit.

ZachXBT said he posed as a paying customer to infiltrate the network shortly after the February 2025 hack. He reported committing $349,700 in stablecoins and accepting a 5% loss on each order to establish trust with an operator using the name Jimmy Green. Information obtained through those interactions helped identify a cluster containing more than $12 million in Bybit-linked funds, according to the investigator’s account of the operation.

The findings also describe Tether freezing approximately $442,000 in associated USDT. A freeze and a completed recovery are different events: restricting a token’s movement can preserve assets, while returning funds requires further operational or legal steps. The report illustrates how blockchain tracing can be supplemented by information gathered from people handling transactions. Identifying an address alone does not necessarily establish who controls it or explain how funds entered a laundering service.

The allegations come from a private investigation and do not constitute an announced conviction of the named operator or a final court finding about the network. Their enforcement relevance lies in the transaction links and identifying information that may assist asset tracing. For Bybit and affected industry participants, the development provides another account of how stolen funds were routed, with independently confirmed freezes, recoveries and official actions offering the clearest measures of subsequent progress.