On-chain investigator ZachXBT says he personally funded a $349,700 undercover operation targeting alleged Chinese money launderers he linked to both the Lazarus Group and the Bybit hack, marking one of the most expensive self-funded crypto-crime investigations disclosed publicly.
On-chain investigator ZachXBT says he personally funded a $349,700 undercover operation targeting alleged Chinese money launderers he linked to both the Lazarus Group and the Bybit hack, marking one of the most expensive self-funded crypto-crime investigations disclosed publicly.
ZachXBT Says He Funded a $349,700 Undercover Effort
ZachXBT, the pseudonymous blockchain investigator known for tracing high-profile crypto thefts, disclosed that he bankrolled the operation himself. The stated cost of $349,700 places the effort well above the threshold of typical independent research, signaling a sustained, resource-intensive undercover engagement rather than passive on-chain analysis. For related coverage, see Bitcoin ETFs Add $240M; 2026 Inflows Hit $1.2B.
The investigator characterized the work as an undercover effort, meaning funds were deployed operationally, not merely spent on tooling or data access. ZachXBT has not, as of this writing, disclosed the specific methods used or the identities of individuals targeted, and his claim has not been independently verified. For related coverage, see Metaplanet Sold 10,000 BTC, Bought Back 11,000 in Q3.
Who the Effort Allegedly Targeted and the Links Named
ZachXBT alleges the targets were a network of Chinese launderers operating as intermediaries for stolen funds. He says the group is connected to the Lazarus Group, the North Korean state-sponsored hacking collective that ZachXBT has previously investigated in connection with over $1 billion in laundering activity. He also links the alleged launderers to the Bybit hack, one of the largest exchange compromises in recent memory. For related coverage, see Glassnode: 73.6% of Bitcoin Supply Is in Profit as ETF Holders Gain.
The Lazarus connection is significant because the FBI’s Internet Crime Complaint Center warned in a February 2025 public service announcement that North Korean cyber actors were aggressively targeting cryptocurrency firms and individuals. The alleged use of Chinese intermediaries to layer stolen funds aligns with laundering patterns described in that advisory. For related coverage, see Spot Bitcoin ETFs Post $241M Inflows in Third Week.
It is important to note that ZachXBT’s allegations are unconfirmed by law enforcement. The individuals described as launderers have not been publicly charged or identified in court documents made available at the time of publication. His findings represent a single investigator’s disclosure, not a prosecutorial record.
Why the Funding Disclosure Matters for Crypto Crime Reporting
The disclosure of a six-figure personal expenditure on an undercover effort is unusual in the context of independent crypto investigation. Most blockchain analysts operate through open-source on-chain tracing, which carries near-zero direct cost. A $349,700 outlay suggests ZachXBT’s operation involved active infiltration, potentially including the purchase of test transactions or the use of assets to establish credibility with alleged launderers.
The alleged connection to the Bybit hack raises the stakes further. Bybit lost hundreds of millions of dollars in a breach attributed by multiple investigators to Lazarus. If the launderers ZachXBT targeted were genuinely serving as an off-ramp for those funds, disrupting the network would represent a meaningful, if unofficial, counterintelligence effort against state-sponsored theft.
Bitcoin’s transparent ledger is precisely the tool that makes such investigations viable. Every satoshi moved through a Lazarus-linked wallet leaves an immutable trace on the blockchain, and the difficulty of fully obfuscating large flows through Chinese over-the-counter desks is what allows investigators like ZachXBT to follow the money across jurisdictions where formal law enforcement cooperation is slow or absent.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
