ZachXBT invested nearly 350,000 USDC to track the stolen funds from Bybit, exposing the cryptocurrency black market and sanction dilemmas.

Written by: Andjela Radmilac

Translated by: Saoirse, Foresight News

In February 2025, North Korean hackers stole approximately $1.5 billion worth of cryptocurrency from Bybit. Although this hacking incident has received extensive coverage and analysis, little attention has been paid to the aftermath and the whereabouts of the stolen funds.

To move this massive amount of stolen money, the hackers had to rely on an entire network of individuals willing to handle the stolen assets. This web of relationships can be penetrated as long as enough funds are injected into it.

Using the pseudonym blockchain investigator ZachXBT, he took this approach. He offered 349,700 USDC, posing as a customer of a Chinese money laundering network, willing to accept a 5% loss on each transaction. Ultimately, he obtained key clues, tracking over $12 million associated with the Bybit theft; according to him, this information also assisted Tether in freezing 442,000 USDT.

His investigation uncovered a money laundering network. He assessed that this network laundered over $1 billion related to the North Korean Lazarus Group cryptocurrency theft, which also included funds obtained from the Bybit attack.

This investigation pointed to a large-scale illegal financial services black market that U.S. authorities have been cracking down on for the past two years.

In September of the same year, the U.S. Treasury imposed sanctions on Xinbi Guarantee. According to the U.S. side, starting in 2022, the trading platform processed over $24 billion in digital asset and fiat transactions through its own system, with North Korean hackers being one of the illegal entities utilizing the platform's services.

The Treasury also mentioned that after the Huione Group was sanctioned, criminals switched to using Xinbi Guarantee to continue their illegal activities. This indicates that merely shutting down a trading platform does not eradicate the underlying connections and criminal demand.

Incredibly, invading an exchange and stealing funds are only relatively simple aspects of the entire criminal chain. The real difficulty lies in converting the stolen cryptocurrency into fiat currency or other assets with actual purchasing power.

To cash out, hackers must rely on various payment services and grey networks, leaving investigators and regulatory agencies with a breakthrough opportunity to intervene.

The “undercover customer” who invested 349,700 USDC

On February 26, 2025, the FBI identified the Bybit heist as being carried out by North Korean hackers, with the operation code named TraderTraitor, and issued a warning: the stolen assets were being converted into Bitcoin and other cryptocurrencies, then dispersed into thousands of blockchain addresses.

Although the identity of the hackers was quickly established, finding the intermediary institutions handling the stolen funds required a substantial amount of investigative work.

ZachXBT stated that he discovered more than 15 accounts conducting transactions related to Bybit's stolen funds in public groups on Telegram and Discord. This indicates that at least some intermediaries publicly solicited business and facilitated trades during parts of the money laundering process.

He contacted several of those accounts and ultimately connected with a contact on Telegram with the nickname Jimmy Green, who claimed he could assist with cross-chain transfers of cryptocurrency.

ZachXBT said that on March 6, 2025, he transferred 349,700 USDC to a brand new Ethereum address, and through that contact, exchanged the USDC on the Ethereum chain for USDT on the Tron chain. To create a real customer identity, he accepted less favorable exchange conditions.

This 349,700 USDC was the principal for trading and not a net loss from the investigation; he was willing to accept a 5% loss on each transaction in exchange for intelligence that could not be obtained through general on-chain analysis.

Such transactions inherently carry risks: intermediaries may run off directly with the funds.

The intermediaries relied upon by the hackers could also be dishonest and abscond with the stolen funds. With no legally binding commercial assurances in place, reputation and personal relationships within the circle became key to maintaining this cooperation.

This indeed provided ZachXBT with an opportunity for infiltration: for service providers, customers willing to engage in repeated transactions hold higher value.

Due to this undercover relationship, the information he obtained was no longer limited to wallet addresses. The intermediaries would discuss funding transfer plans with him before executing transactions. ZachXBT could cross-reference private communications with transaction records preserved on the public chain.

On one occasion, the intermediary discussed transferring funds to the Solana chain before the transaction took place. Other exchange records and wallet association clues are believed to have helped him track a large batch of assets related to the Bybit theft.

This was a key turning point in the investigation: on-chain data can only record transactional behavior but cannot ascertain the identities and true motivations of those behind the transactions. The private communication records between trading parties are the core evidence for locking down the fund controllers and clarifying the use of funds.

Although ZachXBT's investigative conclusions do not completely align with the FBI's official records, it remains one of the most significant investigative actions in recent years. It proves that tasks that cannot be accomplished solely through blockchain data can be evidenced through interpersonal relationships and commercial interactions; similar methods are also expected to be applied in investigations of other cryptocurrency theft cases.

Tracing $12 million ≠ successfully recovering $12 million

ZachXBT said that by connecting with Jimmy Green, he pinpointed a cluster of Bybit-related funds distributed across multiple public chains, totaling over $12 million.

He also revealed that afterwards, Tether froze 442,000 USDT related to the North Korean hacking case. This indicates that when stolen funds remain in tokens like USDT and USDC, which are controlled by issuers, the quick identification of stolen assets is crucial for recovering losses.

It is necessary to distinguish between two sets of data: tracing $12 million does not mean all of that money has been frozen; freezing 442,000 USDT does not equate to those tokens being seized and returned to Bybit.

The number 442,000 USDT, as well as the link between this freeze and the current investigation, are derived from ZachXBT's personal statements; Tether has also disclosed larger-scale freezing operations targeting the Bybit theft case.

There exists a significant gap between discovering stolen cryptocurrency, finding the intermediaries involved, and obtaining legal or technical control over the stolen funds.

The public chain itself cannot prevent assets from being re-transferred. Once the funds flow through a service platform unwilling to cooperate with the investigation, or outside the jurisdiction, the situation becomes even more complicated.

Centralized stablecoins provide regulators with points of intervention: issuers have management permissions and can restrict transfers to specific addresses. Native Bitcoin does not have a freezing mechanism provided by the issuer; however, once authorities obtain legal authorization, they can still seize Bitcoin held by custodial institutions or control the corresponding private keys.

This means that investigations not only require precise tracing, but that the identified fund balances must also fall under the jurisdiction of institutions capable of technical capabilities and law enforcement authority.

During Bybit's asset recovery efforts, court injunctions combined with cooperation from financial intermediaries can limit asset flows long after the theft has occurred, but there is no guarantee of a full recovery.

The problem is that stolen cryptocurrency will continuously be split and circulate between different wallets, public chains, custodians, and counterparties. Each time funds pass through a new platform, the recovery party often has to re-gather evidence and initiate a new round of legal proceedings.

This is why investigators can see the flow of funds but are powerless to stop the next transfer or retrieve the stolen money.

A $4 billion cryptocurrency money laundering operation

Utilizing outside intermediaries to launder stolen money is not unique to the Bybit theft case. U.S. law enforcement records show that authorities have long been tracking various grey operations—such types of operations specifically convert stolen cryptocurrency into assets that criminals can practically use.

In March 2020, the U.S. Department of Justice charged two Chinese nationals, Tian Yinyin and Li Jiadong, with laundering over $100 million in cryptocurrency, mainly sourced from exchange hacks.

These charges indicate that even without personally carrying out the hacking, intermediaries still play a core role in the entire criminal chain.

The Treasury's sanctions announcement also disclosed that Tian Yinyin had exchanged nearly $1.4 million worth of Bitcoin for Apple iTunes gift cards. This indicates that the end of the money laundering chain may not necessarily involve complex multinational financial services, but ordinary retail prepaid cards can also be utilized.

A similar cash-out demand operates at a larger scale on trading platforms that facilitate negotiations for criminals with settlement, exchange, and payment service providers.

In May 2025, the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) identified the Cambodia-based Huione Group as a key money laundering financial institution. Investigations found that from August 2021 to January 2025, the group laundered illegal proceeds amounting to at least $4 billion.

FinCEN confirmed that at least $37 million in cryptocurrency came from North Korean cyber thefts, while the remaining stolen funds originated from various investment scams and online frauds.

The $4 billion is the total amount involved in all the aforementioned criminal activities; the $37 million is the lowest estimate that the agency verified, which is related to North Korean stolen funds.

FinCEN's assessment report pointed out that the group's anti-money laundering and customer identification verification mechanisms have severe loopholes. The absence of identity verification allowed the group's subordinate institutions to indirectly receive proceeds from North Korean hacking attacks.

The significance of this investigation extends beyond a single transaction. If an intermediary can continuously provide payment channels, it becomes a shared criminal infrastructure for various criminal gangs, with no need for different crime organizations to establish their own channels for cashing out stolen funds.

Large amounts of funds converging on such platforms make them targets for sanctions, asset seizures, banking cooperation disruptions, and other law enforcement actions.

The Huione Group's trading platform handled massive transactions and illegal operations. Even after Telegram banned some channels of this network, the platform's operators still attempted to maintain their business operations.

However, the overall trading volume of the platform and the illegal proceeds verified by FinCEN do not match in terms of statistical criteria; thus, not all funds passing through the platform can be directly categorized as confirmed criminal proceeds.

Criminal platforms can be shut down, but criminal clients still exist

The dilemma is that even if the infrastructure of illegal trading platforms is destroyed, the criminal demand that drives such businesses will not disappear as long as criminals can still contact alternative service providers.

In June 2026, the U.S. Department of Justice announced the seizure of cloud server backends used by Huione Group subsidiaries. It was reported that these servers were utilized to transfer the proceeds of fraud, cybercrime, and other illegal activities.

This action was undertaken following earlier restrictions imposed by the U.S. on the group, targeting the technological infrastructure supporting illicit fund transfers and asset concealment.

However, destroying the infrastructure does not automatically sever the connection between criminal clients and the intermediaries taking their orders.

On September 9, the Treasury's sanctions announcement clearly revealed this limitation: authorities sanctioned Xinbi Guarantee. This is an illegal trading market, responsible for connecting criminal organizations with merchants that can provide financial services, technology, and other resources.

The Treasury stated that from around 2022, Xinbi handled digital asset and fiat transactions totaling over $24 billion, mainly targeting the Southeast Asian market.

This significant volume made the platform a key target for law enforcement actions aimed at combating financial infrastructure for criminal organizations.

The Treasury also mentioned that after FinCEN cracked down on Huione, cybercriminals shifted their operations to Xinbi to sustain their activities. This new platform offered almost identical services to the same group of clients.

Regulatory agencies sketch a commoditized grey ecosystem: when original channels become unreliable due to law enforcement crackdowns, participants will instead seek the next service provider.

During the crackdown on Huione, Telegram removed thousands of channels related to Huione Guarantee, and associated merchants flocked to other alternative trading platforms.

For this reason, the effectiveness of crackdowns cannot be measured solely by the number of shut-down websites, accounts, and servers. As long as criminal clients continue to have a demand for illegal financial services, they will find ways to reach service providers still in operation and reconstruct their funding channels.

Of course, crackdowns will still elevate the costs of crime, such as assets being frozen, settlements failing, and familiar counterparties disappearing. But as long as criminal behavior remains profitable, the economic motivation to transfer stolen funds will persist.

The dilemma faced by law enforcement agencies lies in continuously raising the criminal costs across the entire alternative service provider network, thereby reducing their operational stability.

Tether's freeze operation forces cryptocurrency money laundering networks to switch to other payment tools

The law enforcement actions against Xinbi Guarantee indicate that financial restrictions can disrupt criminal activities, but they will also push criminal gangs to change their payment channels.

Tether initiated a series of freeze operations, freezing a total of over $45 million in USDT across at least 22 Xinbi-related wallets.

Subsequently, the trading platform informed users that it would switch to using USDD. This stablecoin, unlike USDT, does not have address freezing authority vested in the issuer.

This is a critical shift: when the involved funds remain under the issuer's control, the token freezing feature is highly valuable to investigators; criminal clients looking to evade regulation will tend to favor assets with different control mechanisms.

This matter illustrates that when one aspect of the payment system faces restrictions, transactions will flow to other channels. Investigators must track not only the direction of the assets but also the service providers offering the channels.

In the September crackdown, authorities also targeted Xinbi's related infrastructure, seizing over $52 million in cryptocurrency. Simultaneously, asset withdrawal speeds increased, and competing trading platforms reportedly began to restrict the onboarding of money laundering merchants.

The aforementioned case and the 442,000 USDT freeze related to the North Korean hackers mentioned by ZachXBT are two separate incidents. Public reports cannot confirm whether the two involve the same addresses, individuals, or funds.

However, both cases validate one point: criminal gangs heavily rely on financial intermediaries. Even after the original theft has been completed, intermediary services still leave windows for regulatory intervention.

If the token issuer has the ability to freeze assets, the risk becomes concentrated in the fund balances within identifiable addresses. If a platform serves multiple criminal gangs, its vulnerabilities include infrastructure, merchant connections, and settlement arrangements.

Both paths can increase the costs and risks associated with the transfer and utilization of stolen funds.

Intermediaries coordinating transactions are harder to replace

The reason ZachXBT's investigation was able to achieve breakthroughs lies in proving that establishing customer relationships through paid undercover work can unearth information about personnel responsible for arranging transactions.

Long-term intermediaries handling stolen cryptocurrency accumulate reputations within the circle, filter fixed trading partners, and ascertain which services can complete transactions without withholding stolen funds.

This kind of interpersonal relationship makes criminal operations more effective over time, especially when clients need to make large transfers, want to avoid exposing their identities, and are concerned about their counterparties absconding with the funds.

However, once an established service provider is taken down, these cooperative relationships are challenging to quickly rebuild. Alternative service providers often charge higher fees, refuse suspicious funds, or lack business stability.

This dependency also presents new intelligence sources for investigations. Service providers may reveal future transaction plans, other participants, and the payment infrastructure needed to complete orders.

Investigators still need to combine on-chain records with other evidence to verify intelligence. An address receiving theft-related funds does not imply that the recipient is aware of or subjectively involved in the crime.

But cross-referencing private chat records with subsequent blockchain fund flows can reduce uncertainty, something that purely tracing transaction flows cannot achieve.

More law enforcement cases indicate that to undermine the allure of illegal financial services, it cannot be just regular shutdowns of websites. The customer base and profit motives that drive such businesses will outlast the existence of website servers.

However, seizing assets, cutting off financial channels, prosecuting service providers, and identifying settlement controllers can change the cost-benefit calculus of criminal behavior. Different service providers, however, will have varying thresholds for the risks they can bear.

This also explains why the total amount of stolen cryptocurrency does not equate to funds successfully cashed out and available for spending; nor can it be directly determined that these funds were used for specific military or national expenditures.

The original stolen amount, the amount circulating through intermediary addresses, the amount successfully exchanged for actual purchasing power, and the amount ultimately recovered by law enforcement are four sets of independently defined statistics that must be evidenced separately.

For North Korean hackers, even if the intrusion is successful, relying on money laundering services entails subsequent risks. Obtaining stolen assets does not mean someone is willing to accept, exchange, and ultimately consume them.

ZachXBT's undercover operation demonstrates that this cash-out demand can turn customer relationships into investigative breakthroughs. U.S. actions against Huione and Xinbi similarly prove that even if criminal clients keep changing their bases, grey service providers themselves can still become targets of law enforcement actions.

The core vulnerability of criminal behavior lies in the fact that stealing cryptocurrency and actually using cryptocurrency are completely separate matters. The latter still relies on commercial collaborations, with all participants having assets, reputations, and economic interests to protect.

North Korean hackers, in order to turn stolen money into spendable funds, must re-enter a network of relationships where trust needs to be established; and the intermediaries providing the services also bear the risk of capital loss.