October 06, 2026

ZachXBT went undercover as a client of a broker laundering money for Lazarus. Step by step

Investigator ZachXBT published how he infiltrated a Chinese crime syndicate that laundered $1B+ for North Korea's Lazarus Group across several exploits. The biggest one: Bybit, $1.5B, February 2025. Screenshots are from his thread.

• Where he looked

Right after the Bybit hack he saw 15+ accounts in public Telegram and Discord groups asking for help with "orders" tied to the stolen funds. The launderers were out in the open.

• The broker

One of them was "Jimmy Green" on Telegram. Profile bio: "clean flagged BTC, ETH, SOL, TRX, break the links, no backflow". In the chat: "professional coin laundering, isolation and freezing prevention", "China's largest".

• Getting in

On Mar 6, 2025 ZachXBT funded a new address with 349.7K USDC. He swapped USDC on Ethereum for the broker's USDT on TRON, losing 5% on every order, to build trust.

• First evidence

The broker's address got its gas from an address that traces straight to the Bybit hack and was already on the public Bybit exploit blacklist. The "clean" broker paid fees with the hackers' money.

• What the broker said
• "I am washing Bitcoins from North Korea today. Kim Jong-un only released 50 Bitcoins";
• "almost all the 1.5 billion was laundered by our team";
• "the USDT I give you is clean, won't freeze";
• "we can monitor the health of the address, we'll tell you one day in advance, we have cooperation with TEDA".

Once he said funds would move to Solana the next day, and they did.

• Onchain proof
• On Mar 12 the broker shared a screenshot of a bridge transfer; ZachXBT matched it on THORChain by amount and timing;
• three Solana addresses exposed a $12M+ cluster moving BTC → ETH → Solana → TRON in real time;
• funds were parked in Uniswap pools with illiquid tokens, a new laundering method;
• Tether froze 442K USDT from the cluster.
• Loose ends

The broker bragged that a team he knew had "about $300K frozen" in 2024. Onchain it was a 332K USDC freeze, funds from the Poloniex exploit. Another $3M "cleaning" job for a different client led to a hot wallet of Huione Guarantee, which has since been sanctioned.

Bottom line: "no freezes" never held. ZachXBT shared everything with law enforcement. Since 2022 he has helped freeze $75M+ in DPRK-related cases.

What it means for you

• "Cleaning" doesn't erase history: the blockchain keeps the path, and one gas payment exposed the link to Bybit.
• Chain-hopping doesn't help. The money moved across 4 networks and bridges, so a check has to cover every network and the address's links, not just the address itself.
• If you get paid in USDT after a "cleaning" like this, it's your wallet or exchange deposit that can get frozen. Before you accept a large transfer, check the sender's address.

The broker's addresses from the investigation, the Bybit exploiter and the 51 FBI-listed addresses from this hack are already in our database: a check shows high risk.

Check an address → amlconsensus.com/en · @amlconsensus_bot

Source: ZachXBT on X, 05.10.2026. The broker's phone number and ID are hidden by us.