What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ZachXBT says he posed as a crypto customer in 2025, exchanged stablecoins with a contact using the alias “Jimmy Green,” and traced transactions he linked to the February 2025 Bybit exploit. News outlets reporting his October 5, 2026 disclosure say he alleges the wider network laundered more than $1 billion across exploits linked to Lazarus Group. That total and the network’s alleged role are claims attributed to ZachXBT, not independently verified figures.
What ZachXBT says he uncovered
In his October 5, 2026 account, ZachXBT described an investigation into what he characterized as a Chinese organized crime syndicate laundering money for Lazarus Group across multiple crypto exploits. He said the network’s alleged laundering volume exceeded $1 billion. CryptoSlate and The Block reported the claim, but the figure is not an independently audited total. CryptoSlate and The Block relayed his account.
The investigation he described focused on a smaller, specific set of transactions he linked to the Bybit theft: a cluster involving more than $12 million, according to his tracing. That is distinct from both the alleged network-wide total and the amount Tether reportedly froze.
Recommended Free Tools
How he says he built contact and gathered information
He approached accounts seeking help with orders
CryptoSlate reported that ZachXBT began investigating after the February 2025 Bybit exploit, when he noticed at least 15 accounts in public Telegram and Discord groups seeking help with orders he associated with stolen funds. He contacted several of them, including a Telegram user operating under the alias “Jimmy Green.” The alias does not establish the person’s real identity.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
He funded an address and exchanged stablecoins
According to CryptoSlate and The Block, ZachXBT said he funded a new Ethereum address with 349,700 USDC on March 6, 2025. He then exchanged USDC on Ethereum for USDT on Tron with the contact and continued making transactions to build trust. He said he accepted a 5% loss per order; the reports do not quantify his overall net loss.
ZachXBT said the contact discussed moving Bybit-linked funds before some movements occurred. The Block reported that one receiving address provided by the contact was funded by a wallet ZachXBT said he could trace directly to Bybit exploit funds and that appeared on Bybit’s public blacklist. These details are part of his reported account and tracing, rather than an independent finding about every transaction or participant.
Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Cross-chain clues helped him identify a cluster
CryptoSlate reported that ZachXBT matched a screenshot of a cross-chain transfer to a THORChain order created within minutes. He said three Solana addresses provided by the contact helped him identify a cluster of more than $12 million that he linked to the Bybit exploit. His account described funds moving through Bitcoin, Ethereum, Solana, and Tron.
What was frozen—and what was not
CryptoSlate and The Block reported that Tether later froze 442,000 USDT linked to the cluster. This freeze is not the same as recovering the entire cluster: ZachXBT’s reported cluster exceeded $12 million, while the reported freeze was 442,000 USDT.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
The reports also describe a separate earlier conversation about a 2024 freeze. ZachXBT said a claim of roughly $300,000 matched an on-chain freeze of 332,000 USDC tied to the Poloniex exploit. That is a different episode and asset amount from the 442,000 USDT freeze associated with the Bybit-linked cluster.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the account relates to the FBI’s Bybit attribution
The FBI’s attribution provides official context for the Bybit theft, but it does not verify all of ZachXBT’s later claims about a laundering network. The Associated Press reported that on February 26, 2025, the FBI attributed the theft of approximately $1.5 billion in crypto from Bybit to North Korean-linked hackers. The FBI called the activity TraderTraitor and also referred to Lazarus Group; it said stolen assets were being converted and dispersed across thousands of addresses on multiple blockchains. The Associated Press reported the FBI announcement.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
That government statement concerns who the FBI said carried out the Bybit theft and how stolen assets were being dispersed. It does not independently establish ZachXBT’s alleged $1 billion-plus laundering total, identify who used the Jimmy Green alias, or prove that every transaction he discussed belonged to a single group. ZachXBT’s own short description, reproduced in ForkLog’s October 6, 2026 report, was: “Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.” ForkLog reproduced the statement from his X thread.
Quick Recap
Best Value
- All your digital assets in one place. You can manage thousands of crypto including Bitcoin, Ethereum, Solana, Tether and more.
- Defend your identity against hackers: secure your online accounts with passwordless, hardware backed, 2FA logins for all your favorite apps and websites.
- Connectivity: USB-C cable connection only. No Bluetooth.Compatible with the Ledger Wallet crypto app, both desktop (Windows, macOS, Linux) and mobile (Android only). Not compatible with iOS.
- Protect your digital assets with the industry's best security: keep your private keys offline in your private signer, battle-tested by the Donjon's white hat hackers, CC EAL 6+ certified Secure Element, constantly updated Ledger OS.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
What the figures do—and do not—show
| Figure | What it refers to | Evidence status |
|---|---|---|
| More than $1 billion | Alleged laundering volume across multiple exploits linked by ZachXBT to Lazarus Group | ZachXBT’s allegation, reported by CryptoSlate and The Block in October 2026; not independently audited |
| 349,700 USDC | Amount ZachXBT said he funded on March 6, 2025, for the operation | His reported account, covered by CryptoSlate and The Block |
| 5% per order | Loss rate he said he accepted while building trust | His reported account; total net loss not stated by CryptoSlate or The Block |
| More than $12 million | Bybit-linked transaction cluster he said he identified | His tracing claim, reported by CryptoSlate and The Block |
| 442,000 USDT | Funds Tether reportedly froze in connection with the cluster | Reported by CryptoSlate and The Block; not the full cluster amount |
| Approximately $1.5 billion | Value of the Bybit theft | FBI attribution reported by the Associated Press in February 2025 |
What remains unconfirmed
- The identity behind the alias Jimmy Green is not established in the reports.
- The more-than-$1-billion laundering figure remains ZachXBT’s allegation; the sources do not independently verify the full total.
- The FBI’s Bybit attribution corroborates the official account of that theft, not every link ZachXBT drew between the contact, transaction cluster, and alleged wider network.
- The reported 442,000 USDT freeze is a specific action involving funds linked to the cluster, not evidence that all of the more-than-$12-million cluster was frozen or recovered.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
