Kim Jong-Un's Launderer Made A New Friend On Telegram: It Was Zachxbt

What Happened

The investigator says the intel helped freeze funds and attribute Bybit flows. He fronted $349,700 of his own money and took a 5% cut on every order, paid to the people he was investigating.

ZachXBT gets a lead in February 2025, days after the Bybit hack. He spotted 15 or more accounts in public Telegram and Discord groups seeking help with orders tied to stolen funds.

Later updates read like a weather report. Kim had called a halt because the coins sent back were too dirty and under investigation. Kim was testing Bitcoin because he feared USDT freezes. Of 50 BTC released, Jimmy’s team got 30.

ZachXBT says the boast matched laundering patterns he had already traced. It remains Jimmy’s claim, not a verified figure. The investigator has previously named a Chinese OTC trader for moving Lazarus funds.

The most useful thing Jimmy did was talk before acting. One morning, he announced that North Korea’s work would start tomorrow and Bitcoin would return to Solana. The next day, ZachXBT says, the funds moved to Solana.

He solved an older case by accident. Jimmy mentioned a team he knew had around $300,000 frozen in 2024. ZachXBT found it onchain, as 332,000 USDC from the Poloniex exploit.

Market Context

A separate brag about washing $3 million in fraud proceeds led to a hot wallet at Huione Guarantee. ZachXBT notes the Cambodian marketplace has since been sanctioned and its former chairman arrested.

Why It Matters

Between orders, Jimmy sent photos of two steaming pots of stew. The meat was wild rabbit and wild bird, shot with a gun. He asked whether ZachXBT could play Chinese mahjong.

Details

ZachXBT posed as a scammer to infiltrate a Chinese crew accused of laundering most of Bybit’s $1.5 billion for North Korea. His launderer repaid him with Kim Jong-un updates, dinner photos, and a mahjong invitation.

Where Do You Find North Korea’s Launderer? In THORChain’s Help Chat

One of them, using the alias Jimmy Green, had posted a stuck transaction in THORChain’s 10,845-member community chat. A THORSwap team member replied asking where he was swapping. The funds, ZachXBT says, were Bybit money that had moved through THORChain.

Jimmy’s Telegram bio was a job ad. Written in Chinese, it offered to process flagged BTC, ETH, SOL, and TRX through a mixing service. Nothing, it promised, would flow back. The account used a US phone number with a Virginia area code.

ZachXBT’s cover story was marked ETH from the privacy tool Railgun that needed to become clean USDT on Tron. Jimmy quoted 5%. One early order came back as exactly 23,750 USDT, a 5% haircut on $25,000.

How Many Times Can Kim Jong-un Come Up in One Chat?

Jimmy did not say “the client.” He said Kim Jong-un, by name, and treated him like a moody supplier.

At one point “the foreigners” ordered a ten-day break. Jimmy grumbled that the North Korean supply was suspended and his team needed more work.

ZachXBT, in character, asked whether Kim Jong-un had kept him busy that day. Jimmy replied that he was busy every day now.

He pitched his firm as professional coin laundering, isolation, and freezing prevention, and called it China’s largest. Then he told ZachXBT his team had laundered almost all of Bybit’s $1.5 billion in ETH.

Did the Launderer Really Call the Money’s Next Move?

On March 12, 2025, Jimmy sent a screenshot of himself bridging 1.192 BTC into ETH. ZachXBT matched the amount and timing to a THORChain order created minutes after the message.

Jimmy also handed over three Solana addresses. They exposed a cluster of $12 million or more in Bybit funds cycling through BTC, ETH, SOL, and Tron. Tether later froze 442,000 USDT linked to it.

Who Was Chasing Whom?

Other days brought his fat-reducing meal, a cup of American coffee, and complaints about the cold. ZachXBT says the small talk also covered family life and vacations at Disney.

One photo showed Jimmy’s phone displaying a wallet holding about 1.2 million USDT. The laptop behind it had Google Translate open, which explains the grammar.