The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Blockchain investigator ZachXBT alleges that a Chinese organized-crime network laundered more than $1 billion stolen in multiple cryptocurrency exploits for North Korea’s Lazarus Group. The October 6, 2026 reports describe an undercover operation in which he posed as a client and say information from an operator helped identify funds linked to the Bybit hack. The total and the network’s alleged role have not been independently established in the reporting.
What ZachXBT alleges
Cointelegraph and The Block reported on October 6, 2026, that ZachXBT accused a Chinese network of laundering more than $1 billion in cryptocurrency stolen across multiple exploits for Lazarus, a North Korean hacking group. The reports describe the figure and the network’s connection to Lazarus as claims by ZachXBT, not findings established by a court or independently verified in the articles. (Cointelegraph; The Block)
As an Amazon Associate I earn from qualifying purchases.
The distinction matters: an investigator’s tracing and interpretation can point to a suspected laundering route, but it is not the same as a judicial finding about who controlled a wallet, the full amount involved, or the ultimate beneficiaries.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow the reported Bybit investigation worked
Cointelegraph reported that ZachXBT said he posed as a paying client in February 2025, shortly after the Bybit hack, and transacted in stablecoins with an operator using the name “Jimmy Green.” He reportedly put up $349,700 and accepted a loss of about 5% per order to build trust. (Cointelegraph)
#1 Best Overall
The Block reported more specifically that ZachXBT said he funded a new Ethereum address with 349,700 USDC. The operator supplied an address to exchange USDC for USDT on the Tron network, and ZachXBT said he traced the funding wallet to Bybit exploit funds. These details are attributed to ZachXBT; the report does not provide a complete forensic dataset for readers to independently reproduce the tracing. (The Block)
According to The Block, information shared by the operator helped ZachXBT identify a cluster of more than $12 million in funds linked to the Bybit exploit. The funds had moved across multiple assets and networks. The report says Tether later froze 442,000 USDT connected to that cluster. (The Block)
What the dollar figures mean
| Figure | What it refers to | Attribution and status |
|---|---|---|
| More than $1 billion | Alleged laundering across multiple crypto exploits for Lazarus | ZachXBT’s claim, reported by Cointelegraph and The Block on October 6, 2026; not independently adjudicated in those reports. |
| $349,700 / 349,700 USDC | Funds ZachXBT said he used to pose as a client and fund a new Ethereum address | Reported by Cointelegraph and The Block, respectively; amounts describe the reported undercover transactions. |
| About 5% per order | Loss ZachXBT reportedly accepted to build trust with the operator | Cointelegraph’s account of ZachXBT’s claim. |
| More than $12 million | Bybit-linked fund cluster ZachXBT said he identified | Reported by The Block; a cluster identified is not the same as money frozen. |
| 442,000 USDT | Funds reportedly frozen by Tether in connection with the cluster | Reported by The Block; a freeze is distinct from the cluster’s total value. |
| $75 million | Funds ZachXBT said he helped facilitate freezing in North Korea-related incidents since 2022 | Reported by The Block as his cumulative claim as of October 2026, separate from the Bybit cluster and freeze. |
The Block also reported ZachXBT’s statement that he had helped facilitate freezes totaling $75 million in North Korea-related incidents since 2022. That broader cumulative figure should not be added to or confused with either the Bybit-linked cluster or the 442,000 USDT freeze. (The Block)
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Was the $1 billion claim confirmed?
No. The contemporary articles report ZachXBT’s allegation and selected details of his account; they do not establish the alleged network’s identity, size, total laundering volume, or complete relationship to Lazarus as independently adjudicated facts. The X thread linked by the reports could not be accessed for review, and the reporting does not reproduce the full underlying transaction evidence.
Rank #3
That does not mean the allegation is disproved. It means readers should distinguish what is being claimed from what the reports document as an outcome: ZachXBT described an undercover interaction and a Bybit-linked cluster, while The Block reported a smaller Tether freeze connected to that cluster.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How earlier U.S. cases provide context
There is historical precedent for U.S. authorities describing Chinese intermediaries in North Korea-related cryptocurrency laundering cases, but those cases do not establish that the same people or entities are involved in ZachXBT’s allegation.
Rank #4
DOJ case announced in 2020
In March 2020, the U.S. Department of Justice announced charges against two Chinese nationals over alleged laundering of more than $100 million in cryptocurrency stolen by North Korean actors. DOJ emphasized that the charges were allegations and that defendants were presumed innocent until proven guilty. (U.S. Department of Justice)
Treasury sanctions announced in 2023
In April 2023, the U.S. Treasury Department said it sanctioned PRC-based OTC trader Wu Huihui and Hong Kong-based trader Cheng Hung Man for support to North Korean malicious cyber activity. Treasury described their alleged role as converting stolen cryptocurrency to fiat currency and routing payments. This is a separate enforcement action, not confirmation of the network ZachXBT describes. (U.S. Treasury Department)
“The DPRK’s use of illicit facilitation networks to access the international financial system and generate revenue using virtual currency for the regime’s unlawful weapons of mass destruction(WMD) and ballistic missile programs directly threatens international security,”
— Brian E. Nelson, Under Secretary of the Treasury for Terrorism and Financial Intelligence, April 24, 2023. (U.S. Treasury Department)
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
