On October 5, 2026, pseudonymous on-chain investigator ZachXBT disclosed via X thread that he fronted $349,700 in USDC to penetrate an alleged North Korea-linked laundering operation, resulting in Tether freezing 442,000 USDT tied to a wallet cluster he valued above $12 million and connected to the February 2025 Bybit exchange hack.

The disclosure traces a months-long undercover effort that began on March 6, 2025, roughly one to two weeks after Bybit lost approximately $1.5 billion to intruders. ZachXBT's point of contact within the syndicate operated under the alias "Jimmy Green."

How did the undercover operation unfold?

ZachXBT structured the $349,700 USDC transfer as a trust-building payment to Jimmy Green, per the thread. The contact returned the favor with Solana addresses that let ZachXBT follow funds as they hopped between blockchains.

From that intelligence, the investigator identified a cluster of wallets holding more than $12 million in assets he connected to the Bybit theft. Tether then froze 442,000 USDT against the identified addresses at the issuer level.

The syndicate's footprint reportedly stretches across Hong Kong and mainland China. The research findings allege the network handled most of the $1.5 billion Bybit haul on behalf of Lazarus Group.

What does the operation reveal about Lazarus exposure?

The Bybit breach gave Lazarus-affiliated actors the largest single headline figure they have touched at once. That scale forced reliance on outside brokers to liquidate stolen assets, creating the pressure point ZachXBT exploited.

ZachXBT has reportedly assisted in freezing more than $75 million tied to North Korean incidents since 2022, according to the thread. Each freeze removes working capital from the laundering side, even when principal hackers remain out of reach.

Why does the Tether freeze matter for stablecoins?

Tether intervened at the issuer level, a control point that purely decentralized chains cannot replicate. Stablecoins have become an operational choke point precisely because their issuers can freeze balances against identified wallets.

The 442,000 USDT freeze represents a small slice of a $1.5 billion theft. Its signal value sits elsewhere: laundering operations now face an additional cost on any path that routes through Tether, raising the operational bar compared with pure Bitcoin flows or non-stablecoin rails.

What are the limits of an investigator-led model?

ZachXBT deployed personal capital and assumed personal safety risk to reach a contact that institutional compliance teams typically cannot touch. The approach has produced measurable freezes but depends on individuals willing to operate outside the boundaries most firms accept.

His role remains investigative rather than custodial. Exchanges, Tether, and, where applicable, law enforcement remain the entities that convert intelligence into frozen balances or formal seizures.

What comes next for the wallet cluster?

ZachXBT's thread points to roughly $12 million in additional wallet exposure that has not yet been frozen. The next enforcement window opens when those identifications reach Tether, law enforcement, or cooperating exchanges and convert into freezes in the quarters ahead.