ZachXBT infiltrated the group laundering Bybit’s stolen funds and traced more than $12 million through Solana and Tron

After the Bybit hack, onchain investigator ZachXBT found more than 15 accounts in public Telegram chats and Discord channels asking for help with transactions tied to stolen funds. He then embedded himself in the group’s workflow, and the result is the kind of detail PSPs and exchanges actually care about: which rails were used, which assets were frozen, and how quickly laundering teams move across chains.

1. In March 2025, ZachXBT sent 349,700 USDC to a fresh Ethereum address and began swapping it into USDT on Tron at the request of a contact using the alias Jimmy Green. During those conversations, Jimmy openly described how his team was moving funds stolen from Bybit and said the group had already laundered most of the $1.5 billion, mainly through companies in Hong Kong.
2. Jimmy later shared three Solana addresses that had processed more than $12 million in Bybit-linked funds. According to ZachXBT, the money moved through a chain of Bitcoin → Ethereum → Solana → Tron, which is a reminder that laundering operations do not stay loyal to one network for long once compliance teams start watching a single rail.
3. Tether later froze 442,000 USDT connected to those transactions. Screenshots shared by ZachXBT showed Jimmy claiming Tether would not freeze the USDT he received, and that he would reimburse losses if it did. That promise did not age well: ZachXBT said he lost 5% on each operation on average, and nobody compensated him.
4. ZachXBT said the same group also helped launder cryptocurrency tied to the $126 million Poloniex hack. That puts the operation in a broader pattern: the infrastructure used for one exchange breach was being reused for another, which is exactly why cross-case tracing matters for PSPs, exchanges, and compliance teams.
5. Separately, ZachXBT recently published the aliases of five people he suspects of laundering funds stolen in the recent $387.5 million Bitget hack. He said they are Chinese nationals working for North Korean hackers.

The practical takeaway for high-risk payment flows is straightforward: the laundering path here was not exotic, just fast and multi-chain, with activity moving from Ethereum to Solana to Tron and back into frozen stablecoins when Tether stepped in. For anyone handling crypto payouts, exchange liquidity, or merchant monitoring, this is the part that matters: the same actors can cycle stolen value across multiple networks before controls catch up.