Bybit theft exposes network used to launder stolen crypto

The theft of about US$ 1.5 billion from Bybit in February 2025 opened a new front of attention on the fate of the funds. The FBI attributed the attack to North Korean hackers, while on-chain investigator ZachXBT described how he tracked part of the money by infiltrating a crypto laundering network FBI.

Instead of focusing only on the breach, the case began to highlight the next stage: converting stolen assets into usable resources. According to ZachXBT’s account in his investigation, this process depends on intermediaries willing to receive, exchange and redistribute values linked to the crime.

The investigator said he began to trace the trail after seeing more than 15 accounts in public Telegram and Discord groups seeking help with transactions associated with Bybit’s funds. From there, he said he established contact with a Telegram user identified as Jimmy Green.

On March 6, 2025, according to his account, ZachXBT funded a new Ethereum address with 349,700 USDC and began swapping it for USDT on Tron through that contact. He said he accepted losses of 5% per transaction to appear to be a trustworthy client.

That connection, according to ZachXBT, brought information that went beyond public wallets. In one of the episodes described, the intermediary allegedly had previously commented on a move to Solana, which could later be compared with visible records on the blockchains.