Blockchain investigator ZachXBT said he infiltrated a Chinese laundering syndicate by posing as a cryptocurrency client and funding repeated stablecoin trades.

In an Oct. 5 disclosure , he alleges the network laundered more than $1 billion across exploits for Lazarus Group.

He said he fronted 349,700 USDC to build a relationship with a contact using the alias Jimmy Green. According to his account, the repeated exchanges led to private conversations about moving funds stolen from Bybit in 2025.

He reported tracing a cluster involving more than $12 million in Bybit funds and a later 442,000 USDT freeze by Tether .

ZachXBT said the investigation began after the February 2025 Bybit exploit, when he noticed at least 15 accounts asking for help with orders he linked to stolen funds in public Telegram and Discord groups.

He contacted several of those accounts. One was Jimmy Green, the Telegram alias of the person with whom he subsequently exchanged funds.

On March 6, 2025, ZachXBT said he funded a new Ethereum address with 349,700 USDC in preparation for transactions with the contact. The arrangement involved sending his USDC on Ethereum in exchange for the contact's USDT on Tron. He then completed additional transactions to build trust.

As he built trust through repeat exchanges, ZachXBT said the contact began discussing movements of Bybit funds for North Korea before they occurred. The conversations also included details about operations in Hong Kong and mainland China.

From an on-chain analytics and liquidity distribution perspective, developments around "ZachXBT se infiltra em sindicato criptográfico de US$ 1 bilhão para expor o Grupo Lazarus" signal important shifts in network participation. Market participants observe that derivative funding metrics, exchange reserve telemetry, and smart contract protocol interactions reflect cautious accumulation alongside disciplined risk hedging across the sector.

Technical research analysts at CryptoAce VIP note that high-density order book clusters and volume-weighted average price (VWAP) benchmarks near recent consolidation floors will serve as pivotal indicators. Market observers are advised to cross-examine telemetry on verified block explorers before making capital allocations.

Editorial Fact-Check & Verification Note: This briefing was curated, corroborated, and synthesized by the CryptoAce VIP Editorial Desk. Readers following "ZachXBT se infiltra em sindicato criptográfico de US$ 1 bilhão para expor o Grupo Lazarus" are encouraged to review the full primary source coverage linked below for complete historical context, direct quotes, and official statements.