ZachXBT infiltration leads to 442,399 USDT freeze tied to Bybit hack
CIE News ·
Investigator ZachXBT reported going undercover with $349,700 in USDC to track illicit Bybit hack funds, prompting a 442,399 USDT freeze tied to a Lazarus Group syndicate.
On-chain researcher ZachXBT reported an undercover operation that contributed to freezing assets connected to the February 2025 Bybit exchange breach, The Defiant reported on October 5, 2026. ZachXBT said he fronted $349,700 in USD Coin (USDC) to pose as a client and interact with an operator using the Telegram handle Jimmy Green, enabling him to track over $12 million across Bitcoin (BTC), Ethereum (ETH), Solana (SOL), TRON (TRX), and THORChain.
According to en.cryptonomist.ch, the investigated syndicate laundered crypto proceeds for North Korea's Lazarus Group and was tied to handling more than $1 billion in illicit funds. Following the findings, Tether froze 442,399 Tether (USDT) tied to a Uniswap V2 liquidity pool linked to the laundering operation.