A blockchain investigator infiltrated a group that was laundering stolen funds from the Bybit exchange.

After the Bybit hack, on‑chain investigator ZachXBT noticed more than 15 accounts in public Telegram chats and Discord channels seeking help with transactions related to the stolen funds. He contacted several of the chats and channels, including a stranger using the pseudonym Jimmy Green. In March 2025, ZachXBT transferred 349,700 USDC to a fresh address on the Ethereum network and began exchanging them for USDT on the Tron network at Jimmy’s request. At the same time, the crypto detective’s interlocutor openly described how his team was transferring funds stolen from Bybit and claimed that the group had already laundered most of the $1.5 billion, mainly through companies in Hong Kong.

In March 2025, ZachXBT transferred 349,700 USDC to a fresh address on the Ethereum network and began exchanging them for USDT on the Tron network at Jimmy’s request. At the same time, the crypto detective’s interlocutor openly described how his team was transferring funds stolen from Bybit and claimed that the group had already laundered most of the $1.5 billion, mainly through companies in Hong Kong.

According to ZachXBT, Jimmy shared three Solana addresses through which more than $12 million stolen from Bybit were transferred. The funds moved along the “Bitcoin — Ethereum — Solana — Tron” chain. Later, Tether froze 442,000 USDT related to these transactions. Moreover, as the screenshots show, Jimmy assured that Tether would not freeze the USDT transferred to him, and if this happened, he would compensate for the losses. On average, ZachXBT lost 5% on each transaction, and no one compensated him for anything. A crypto researcher found out that Jimmy’s group also helped to launder cryptocurrency linked to the $126 million hack of the Poloniex exchange. A few days ago, ZachXBT published the pseudonyms of five people whom he suspects of laundering funds stolen during the recent hack of the Bitget exchange, amounting to $387.5 million. ZachXBT claims that these are residents of China working for hackers from North Korea.