ZachXBT posed as a scammer to infiltrate a Chinese crew accused of laundering most of Bybit’s $1.5 billion for North Korea. His launderer repaid him with Kim Jong-un updates, dinner photos, and a mahjong invitation.
The investigator says the intel helped freeze funds and attribute Bybit flows. He fronted $349,700 of his own money and took a 5% cut on every order, paid to the people he was investigating.
Where Do You Find North Korea’s Launderer? In THORChain’s Help Chat
ZachXBT gets a lead in February 2025, days after the Bybit hack. He spotted 15 or more accounts in public Telegram and Discord groups seeking help with orders tied to stolen funds.
One of them, using the alias Jimmy Green, had posted a stuck transaction in THORChain’s 10,845-member community chat. A THORSwap team member replied asking where he was swapping. The funds, ZachXBT says, were Bybit money that had moved through THORChain.
Jimmy’s Telegram bio was a job ad. Written in Chinese, it offered to process flagged BTC, ETH, SOL, and TRX through a mixing service. Nothing, it promised, would flow back. The account used a US phone number with a Virginia area code.
ZachXBT’s cover story was marked ETH from the privacy tool Railgun that needed to become clean USDT on Tron. Jimmy quoted 5%. One early order came back as exactly 23,750 USDT, a 5% haircut on $25,000.
How Many Times Can Kim Jong-un Come Up in One Chat?
Jimmy did not say “the client.” He said Kim Jong-un, by name, and treated him like a moody supplier.
Later updates read like a weather report. Kim had called a halt because the coins sent back were too dirty and under investigation. Kim was testing Bitcoin because he feared USDT freezes. Of 50 BTC released, Jimmy’s team got 30.
At one point “the foreigners” ordered a ten-day break. Jimmy grumbled that the North Korean supply was suspended and his team needed more work.
ZachXBT, in character, asked whether Kim Jong-un had kept him busy that day. Jimmy replied that he was busy every day now.
He pitched his firm as professional coin laundering, isolation, and freezing prevention, and called it China’s largest. Then he told ZachXBT his team had laundered almost all of Bybit’s $1.5 billion in ETH.
ZachXBT says the boast matched laundering patterns he had already traced. It remains Jimmy’s claim, not a verified figure. The investigator has previously named a Chinese OTC trader for moving Lazarus funds.
Did the Launderer Really Call the Money’s Next Move?
The most useful thing Jimmy did was talk before acting. One morning, he announced that North Korea’s work would start tomorrow and Bitcoin would return to Solana. The next day, ZachXBT says, the funds moved to Solana.
On March 12, 2025, Jimmy sent a screenshot of himself bridging 1.192 BTC into ETH. ZachXBT matched the amount and timing to a THORChain order created minutes after the message.
Jimmy also handed over three Solana addresses. They exposed a cluster of $12 million or more in Bybit funds cycling through BTC, ETH, SOL, and Tron. Tether later froze 442,000 USDT linked to it.
He solved an older case by accident. Jimmy mentioned a team he knew had around $300,000 frozen in 2024. ZachXBT found it onchain, as 332,000 USDC from the Poloniex exploit.
A separate brag about washing $3 million in fraud proceeds led to a hot wallet at Huione Guarantee. ZachXBT notes the Cambodian marketplace has since been sanctioned and its former chairman arrested.
Who Was Chasing Whom?
Between orders, Jimmy sent photos of two steaming pots of stew. The meat was wild rabbit and wild bird, shot with a gun. He asked whether ZachXBT could play Chinese mahjong.
Other days brought his fat-reducing meal, a cup of American coffee, and complaints about the cold. ZachXBT says the small talk also covered family life and vacations at Disney.
One photo showed Jimmy’s phone displaying a wallet holding about 1.2 million USDT. The laptop behind it had Google Translate open, which explains the grammar.
Jimmy was clear about where his team stood. “We are honest businessmen,” he said, moments after sending through another batch of USDT.
The pause before it, he explained, was because his team had suspected ZachXBT of fooling them. Integrity, he said, came first.
Meanwhile, the detective played hard to get. Jimmy messaged good morning past midnight, hello an hour later, and a lone question mark before dawn. ZachXBT scolded him.
Jimmy apologized and said his team had $1 million ready to start at any time.
ZachXBT says he handed everything to private investigators and law enforcement, which is why the thread arrived 19 months late. He puts his DPRK-related freezes since 2022 at $75 million or more, against billions stolen.
The same support-ticket pattern resurfaced last month. Launderers moving funds from the $387 million Bitget hack openly asked for help in public groups. North Korea’s contractors, it turns out, still need customer service.
The post Kim Jong-un's Launderer Made a New Friend on Telegram: It Was ZachXBT appeared first on BeInCrypto.
