ZachXBT Bought His Way Into Kim Jong-un's Laundry Room

A Friend in Low Places

The most useful North Korea intelligence the crypto industry has produced this year didn't come from a subpoena. It came from a group chat.

ZachXBT, the pseudonymous on-chain investigator, spent months posing as a scammer to work his way into a Chinese crew accused of laundering most of the $1.5 billion stolen from Bybit on Feb. 21, 2025. That hack, attributed to North Korea's Lazarus Group, is still the largest single theft in crypto history. And the money didn't walk away by itself. It needed intermediaries.

So he became one.

From a compliance standpoint, the mechanics are what matter here. He fronted $349,700 of his own capital. He took a 5% cut on every order, paid to the very people he was investigating. The key detail is that this wasn't a sting run with federal backing or a warrant behind it. It was one person, one wallet, and one Telegram handle, buying credibility inside the exact market he was trying to map.

His reward, apparently, was a launderer's version of friendship. Kim Jong-un updates. Dinner photos. An invitation to play mahjong.

What the Intel Actually Bought

ZachXBT says the operation helped freeze funds and attribute the Bybit flows. That's the deliverable, and it's not a small one. Attribution is the hard part. It's usually where investigations stall out entirely.

Reading between the lines, the value isn't a single arrest. It's a map. Knowing which intermediary touches which chain, in what order, at what volume, gives exchanges and analytics firms something concrete to screen against. It gives OFAC something to name. That's how enforcement actually works in this space, designation by designation, wallet by wallet.

Freezing is real. So is the money still moving.

The Part That Should Make You Uncomfortable

Now steelman the other side, because there's one, and it's not trivial.

Private citizens don't have subpoena power, chain of custody, or any obligation to preserve evidence cleanly. A defense attorney will ask how that $349,700 was spent and who authorized the 5% cut. Was it investigative expense, or was it participation? Who's the responsible party when a private citizen buys his way inside a sanctioned laundering network and then hands the receipts to law enforcement?

That question doesn't have a clean answer yet.

There's also the personal risk, which is enormous and mostly uncompensated. ZachXBT has no badge, no immunity, and no pension. He has a public reputation, a target on his back, and whoever runs North Korea's cash-out operation now knows his avatar if not his face.

The Verdict

I'd still take the trade. The alternative is waiting on agencies that move in months and jurisdictions that won't cooperate, while $1.5 billion launders itself into usable assets. Imperfect intel beats no intel when the counterparty is a state.

But this can't stay a solo act forever. The precedent here's important. If private investigators are going to function as de facto enforcement, someone needs a framework for what they can spend, what they can promise sources, and how their findings survive a courtroom. That's the gap. Not the courage. The paper trail.

What to watch next: any OFAC designations tied to this crew, whether Bybit recovers anything meaningful, and whether prosecutors treat ZachXBT as a witness or as a loose end. The mahjong invitation, notably, would make fascinating exhibit A.