{"investigation":{"slug":"bybit-bitget-laundering-syndicate-exposed-october-2026","entity_name":"Bybit-Bitget Laundering Syndicate Exposed (October 2026)","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"On October 5, 2026, pseudonymous blockchain investigator ZachXBT published a 12-part account describing an 18-month undercover operation in which he fronted 349,700 USDC to pose as a paying client of a Chinese organized-crime syndicate he alleges laundered over $1 billion in stolen cryptocurrency on behalf of North Korea's Lazarus Group, including proceeds of the February 2025 Bybit hack ($1.5 billion) and the September 2026 Bitget hack ($387.5 million). The operation, centered on a Telegram contact using the alias \"Jimmy Green,\" is alleged to have contributed to Tether's freezing of roughly 442,000 USDT and the exposure of a $12 million-plus on-chain fund cluster. This page covers the laundering syndicate and infiltration operation specifically; it does not restate the trust assessment of the separate AVOID.NET page on Lazarus Group itself.","sections":[{"content":"According to a 12-part account published by pseudonymous on-chain investigator ZachXBT on October 5, 2026, he spent roughly 18 months posing as a paying client inside a Chinese organized-crime network that he alleges laundered stolen cryptocurrency on behalf of North Korea's Lazarus Group. After the February 2025 Bybit hack, ZachXBT identified more than 15 accounts in public Telegram and Discord groups soliciting help moving the stolen funds, and he contacted several operatives, ultimately building trust with one using the alias \"Jimmy Green.\" On March 6, 2025, ZachXBT funded a fresh Ethereum wallet with 349,700 USDC and began a series of swaps -- exchanging USDC for USDT on Tron -- while accepting an alleged 5% loss per transaction to maintain his cover as a legitimate client. ZachXBT has stated that Jimmy Green described planned fund movements before they occurred and that, in one instance on March 12, 2025, Jimmy shared a screenshot of bridging funds that ZachXBT says he matched to a corresponding THORChain order within minutes. Jimmy allegedly told ZachXBT his team operated from Hong Kong and mainland China, processed stolen funds through 'different divisions of labor,' and claimed to have laundered the bulk of the stolen Bybit assets. These claims rest on ZachXBT's own account and have not been independently verified by a court or regulator; they are reported here as alleged.","heading":"The Undercover Operation","sources":[{"url":"https://x.com/zachxbt/status/2107081638073319437","name":"ZachXBT infiltration thread (X/Twitter, part 1)","type":"social_media","credibility":2},{"url":"https://x.com/zachxbt/status/2107081662765158780","name":"ZachXBT infiltration thread (X/Twitter, part 8 - Mar 12, 2025 bridging screenshot)","type":"social_media","credibility":2},{"url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers","name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","credibility":2},{"url":"https://www.tftc.io/zachxbt-lazarus-group-chinese-syndicate-bybit-infiltration","name":"ZachXBT Fronted $350K to Infiltrate Lazarus Group's Chinese Laundering Syndicate","type":"news_article","credibility":2},{"url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/","name":"ZachXBT poses as money launderer to infiltrate Lazarus network","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Reporting ties the syndicate to laundering proceeds from two of 2026's largest exchange hacks. The February 2025 Bybit hack, which the FBI attributed to North Korea's TraderTraitor/Lazarus Group activity, resulted in the theft of approximately $1.5 billion. The September 2026 Bitget hack resulted in the theft of approximately $387.5 million, and blockchain analytics firm Elliptic has stated that funds stolen from Bitget were linked to addresses previously used to launder proceeds from the 2025 Bybit theft, a pattern Elliptic described as characteristic of North Korean state-linked hacking operations reusing established laundering routes. Reporting also indicates that one alias, 'lolo,' appeared in connection with laundering efforts tied to both the Bitget hack and the April 2026 Kelp DAO exploit (~$292 million), suggesting overlapping infrastructure across multiple incidents rather than isolated, one-off laundering arrangements. These cross-incident links come from Elliptic's on-chain analysis as reported in secondary press coverage; AVOID.NET has not independently reviewed Elliptic's underlying data.","heading":"Linked to Both the Bybit and Bitget Hacks","sources":[{"url":"https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack","name":"North Korea Responsible for $1.5 Billion Bybit Hack (FBI PSA)","type":"regulatory","credibility":1},{"url":"https://cryptonews.net/news/security/33542855/","name":"ZachXBT infiltrates Chinese laundering crew tied to Bybit and Bitget thefts","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/","name":"ZachXBT exposes the laundering network behind the Bybit and Bitget hacks","type":"news_article","credibility":2},{"url":"https://fortune.com/2026/09/25/north-korea-bitget-387-million-crypto-attack/","name":"North Korea accused of plundering Bitget for $387 million in year's biggest crypto attack","type":"news_article","credibility":1}],"severity":"critical"},{"content":"ZachXBT states that intelligence gathered during the undercover operation -- including wallet addresses and transaction details provided by 'Jimmy Green' -- helped identify a cluster of more than $12 million in Bybit exploit proceeds moving across Bitcoin, Ethereum, Solana and Tron, and contributed to Tether freezing approximately 442,000 USDT associated with that cluster, reportedly located in a Uniswap V2 liquidity pool. ZachXBT has separately claimed that his work, including this operation, has contributed to more than $75 million in freezes tied to North Korea-linked incidents since 2022. He has also stated he shared information connecting the syndicate to Huione Guarantee, a Cambodia-based online marketplace that U.S. and other authorities have previously sanctioned over money laundering and scam-related activity, after 'Jimmy Green' allegedly described laundering $3 million for a separate client. These figures and outcomes originate from ZachXBT's own disclosures and have not been confirmed by Tether, law enforcement, or a regulator in a public statement reviewed for this page; they should be treated as alleged pending independent confirmation.","heading":"Tether Freeze and Reported Outcomes","sources":[{"url":"https://www.cryptotimes.io/2026/10/05/zachxbt-posed-as-a-client-to-map-a-syndicate-laundering-bybit-hack-funds/","name":"ZachXBT Posed as a Client to Map a Syndicate Laundering Bybit Hack Funds","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group/","name":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group","type":"news_article","credibility":2},{"url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/","name":"ZachXBT poses as money launderer to infiltrate Lazarus network","type":"news_article","credibility":2},{"url":"https://www.hokanews.com/2026/10/zachxbt-details-infiltration-of-chinese.html","name":"ZachXBT Details Infiltration of Chinese Crime Syndicate Linked to $1B+ DPRK Laundering","type":"news_article","credibility":2}],"severity":"high"},{"content":"Coverage of the disclosure characterizes the laundering network as active infrastructure at the time of publication rather than a closed historical case. ZachXBT, who has worked as an incident-response advisor for the venture firm Paradigm since shortly after the Bybit hack, has stated that findings from the operation were shared with private-sector investigators and law enforcement, and has indicated he is withholding additional findings from related, ongoing investigations. No criminal charges, indictments, or arrests connected specifically to 'Jimmy Green' or this syndicate had been publicly reported as of this page's publication. The identities behind the 'Jimmy Green' alias and the full scope of the syndicate's operations and membership remain unconfirmed by any named law-enforcement agency in sourcing reviewed for this page.","heading":"Active Infrastructure and Law Enforcement Referral","sources":[{"url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/","name":"ZachXBT poses as money launderer to infiltrate Lazarus network","type":"news_article","credibility":2},{"url":"https://www.tftc.io/zachxbt-lazarus-group-chinese-syndicate-bybit-infiltration","name":"ZachXBT Fronted $350K to Infiltrate Lazarus Group's Chinese Laundering Syndicate","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2025-02-21","event":"Bybit hack occurs; approximately $1.5 billion in virtual assets stolen, later attributed by the FBI to North Korea's TraderTraitor/Lazarus Group.","source":"FBI Cyber Alert","source_url":"https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack","date_evidence":"North Korea was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange Bybit on or about February 21, 2025."},{"date":"2025-03-06","event":"ZachXBT funds an Ethereum wallet with 349,700 USDC and begins transacting with the Telegram contact 'Jimmy Green' to build trust as a purported client.","source":"TFTC","source_url":"https://www.tftc.io/zachxbt-lazarus-group-chinese-syndicate-bybit-infiltration","date_evidence":"On March 6, 2025, ZachXBT funded a fresh Ethereum wallet (address: 0x073256b50d66a7eb005f2a504d0a4fb6ea62a276) with 349,700 USDC and began transacting with a Telegram operator"},{"date":"2025-03-12","event":"'Jimmy Green' allegedly shares a screenshot of bridging funds that ZachXBT says he matched to a THORChain order created minutes later.","source":"ZachXBT (X/Twitter thread)","source_url":"https://x.com/zachxbt/status/2107081662765158780","date_evidence":"8/ In one instance on Mar 12, 2025, Jimmy shared a screenshot of himself bridging funds, which I matched up via amounts and timing on the THORChain explorer to an order created within minutes of his message."},{"date":"2026-04","event":"Kelp DAO suffers an exploit of approximately $292 million; an alias ('lolo') later reported as involved in Bitget-related laundering is also linked to this incident.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/"},{"date":"2026-09-24","event":"Bitget hack occurs; approximately $387.5 million drained from exchange wallets, with North Korea later named as the likely perpetrator.","source":"Fortune / incident reporting","source_url":"https://fortune.com/2026/09/25/north-korea-bitget-387-million-crypto-attack/","date_evidence":"At approximately 18:31 UTC on September 24, 2026, unauthorized transfers involving certain assets were made across multiple blockchains from a portion of Bitget's hot and warm wallet infrastructure."},{"date":"2026-10-05","event":"ZachXBT publishes a 12-part public account of his undercover operation, alleging the syndicate laundered over $1 billion for Lazarus Group across the Bybit and Bitget hacks, and disclosing the resulting Tether freeze of roughly 442,000 USDT.","source":"TFTC / multiple outlets","source_url":"https://www.tftc.io/zachxbt-lazarus-group-chinese-syndicate-bybit-infiltration","date_evidence":"ZachXBT, the pseudonymous on-chain investigator and Paradigm Incident Response Advisor, published a 12-part thread on October 5, 2026, detailing how he spent months embedded as a paying customer inside a Chinese organized crime network"}],"sources_used":[{"url":"https://x.com/zachxbt/status/2107081638073319437","name":"ZachXBT infiltration thread (X/Twitter, part 1)","type":"social_media","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://x.com/zachxbt/status/2107081662765158780","name":"ZachXBT infiltration thread (X/Twitter, part 8)","type":"social_media","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack","name":"North Korea Responsible for $1.5 Billion Bybit Hack (FBI PSA)","type":"regulatory","archive_url":"http://web.archive.org/web/20260809232040/https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack","credibility":1,"archive_timestamp":"2026-08-09T23:20:40+00:00"},{"url":"https://fortune.com/2026/09/25/north-korea-bitget-387-million-crypto-attack/","name":"North Korea accused of plundering Bitget for $387 million in year's biggest crypto attack","type":"news_article","archive_url":"http://web.archive.org/web/20260930040929/https://fortune.com/2026/09/25/north-korea-bitget-387-million-crypto-attack/","credibility":1,"archive_timestamp":"2026-09-30T04:09:29+00:00"},{"url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers","name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","archive_url":"https://web.archive.org/web/20261006112833/https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers","credibility":2,"archive_timestamp":"2026-10-06T11:28:33+00:00"},{"url":"https://www.tftc.io/zachxbt-lazarus-group-chinese-syndicate-bybit-infiltration","name":"ZachXBT Fronted $350K to Infiltrate Lazarus Group's Chinese Laundering Syndicate","type":"news_article","archive_url":"https://web.archive.org/web/20261006062814/https://www.tftc.io/zachxbt-lazarus-group-chinese-syndicate-bybit-infiltration","credibility":2,"archive_timestamp":"2026-10-06T06:28:14+00:00"},{"url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/","name":"ZachXBT poses as money launderer to infiltrate Lazarus network","type":"news_article","archive_url":"http://web.archive.org/web/20261006205734/https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/","credibility":2,"archive_timestamp":"2026-10-06T20:57:34+00:00"},{"url":"https://www.cryptotimes.io/2026/10/05/zachxbt-posed-as-a-client-to-map-a-syndicate-laundering-bybit-hack-funds/","name":"ZachXBT Posed as a Client to Map a Syndicate Laundering Bybit Hack Funds","type":"news_article","archive_url":"http://web.archive.org/web/20261005192022/https://www.cryptotimes.io/2026/10/05/zachxbt-posed-as-a-client-to-map-a-syndicate-laundering-bybit-hack-funds/","credibility":2,"archive_timestamp":"2026-10-05T19:20:22+00:00"},{"url":"https://cryptoslate.com/zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group/","name":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group","type":"news_article","archive_url":"https://web.archive.org/web/20261006062425/https://cryptoslate.com/zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group/","credibility":2,"archive_timestamp":"2026-10-06T06:24:25+00:00"},{"url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/","name":"ZachXBT exposes the laundering network behind the Bybit and Bitget hacks","type":"news_article","archive_url":"https://web.archive.org/web/20261006062613/https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/","credibility":2,"archive_timestamp":"2026-10-06T06:26:13+00:00"},{"url":"https://www.hokanews.com/2026/10/zachxbt-details-infiltration-of-chinese.html","name":"ZachXBT Details Infiltration of Chinese Crime Syndicate Linked to $1B+ DPRK Laundering","type":"news_article","archive_url":"https://web.archive.org/web/20261006062634/https://www.hokanews.com/2026/10/zachxbt-details-infiltration-of-chinese.html","credibility":2,"archive_timestamp":"2026-10-06T06:26:34+00:00"},{"url":"https://cryptonews.net/news/security/33542855/","name":"ZachXBT infiltrates Chinese laundering crew tied to Bybit and Bitget thefts","type":"news_article","archive_url":"https://web.archive.org/web/20261006062438/https://cryptonews.net/news/security/33542855/","credibility":2,"archive_timestamp":"2026-10-06T06:24:38+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-06T00:12:53.719257+00:00","updated_at":"2026-10-06T21:14:56.776915+00:00"},"source_quality":{"total":12,"tier1":1,"tier2":1,"tier3":2,"unrated":8},"follower_count":null}