ZachXBT

He told WIRED that early crypto investment losses prompted self-taught blockchain analysis; he began amateur investigations in 2021.⁠[3]

Jeffrey Huang, known as Machi Big Brother, said he was withdrawing his defamation lawsuit against ZachXBT after important amendments to the article concerned. ZachXBT said he had added context from Huang and made his own edits, and that they had reached a resolution. Neither statement announced a court ruling on the underlying allegations.⁠[4][5]

Arkham featured ZachXBT’s Lazarus GroupLazarus GroupLazarus Group is a name used by cybersecurity researchers and governments for North Korean state-sponsored cyber operations involving espionage, destructive attacks and financial theft. Definitions and subgroup boundaries vary between sources. The U.S. Treasury attributes the group to North Korea’s Reconnaissance General Bureau and sanctioned it in 2019.Open the full entry investigation, published that April, and his custom address grouping. The announcement said the view included seven additional addresses holding 891.13 BTC, then valued at about $63.23 million. This was a contemporaneous balance valuation, not an amount recovered or returned to victims.⁠[6]

In a WIRED interview, ZachXBT described tracing approximately $243 million in bitcoin stolen from one victim, combining transaction records with external leads and sharing findings with law enforcement.⁠[3]

Arkham announced that ZachXBT submitted evidence at 19:09 UTC linking the Bybit attack to Lazarus Group, including pre-attack test transactions, connected wallets, forensic graphs and timing analysis. Arkham said the submission had been shared with Bybit to assist its investigation.⁠[2]

The FBI attributed the theft of approximately $1.5 billion in virtual assets from Bybit around February 21 to North Korea and called the specific activity TraderTraitor. This was a separate public law-enforcement attribution from Arkham’s earlier assessment of ZachXBT’s submission.⁠[7]

ZachXBT and Paradigm co-founder Matt Huang separately announced the advisory appointment. ZachXBT described his remit as incident response for portfolio companies while continuing public investigations. Huang likewise said his existing focus would remain unchanged.⁠[1]

When launching Beacon Network, TRM Labs named ZachXBT among the security researchers providing ongoing monitoring and threat tracking. The network connects law enforcement, trading platforms and stablecoin issuers, using address labels and alerts to help participants promptly review suspicious funds.⁠[8]

TRM Labs analyzed ZachXBT’s investigation of wallet activity attributed to “John” or “Lick,” describing how live wallet displays and transactions supported tracing. About $24.9 million was traced from a U.S. government-controlled wallet holding seized Bitfinex assets. The article explicitly treated identity and responsibility claims as unadjudicated allegations at that time.⁠[9]

TRM Labs, which said it was supporting the investigation, reported the following day that John Daghita had been arrested in Saint Martin in a joint French Gendarmerie and FBI operation. It connected the development to ZachXBT’s earlier wallet attribution and stated that the investigation remained ongoing. Arrest is distinct from conviction.⁠[10]

The U.S. Department of Justice announced that Malone Lam, a defendant connected to the bitcoin theft ZachXBT had traced, pleaded guilty to participating in a RICO conspiracy. The release described more than $245 million in criminal activity and a December 8 status hearing; it did not announce a final sentence.⁠[11][3]

In a 12-post investigation, ZachXBT said he posed as a customer of a Chinese organized-crime network that allegedly laundered over $1 billion from multiple Lazarus Group attacks. He said he prepared 349,700 USDC on March 6, 2025, then used repeated transactions and comparisons with messages to trace stolen Bybit funds. These were claims in his published investigation.⁠[12]

He said addresses supplied by the contact exposed a Bybit-linked fund cluster exceeding $12 million, with 442,000 USDT later frozen by Tether. He also reported helping facilitate over $75 million in freezes tied to North Korean incidents since 2022. The cluster size, individual freeze and cumulative facilitated freezes describe different measures; none by itself establishes funds returned to victims.⁠[12]

Paradigm: Official website: https://www.paradigm.xyz/ (opens in a new window).⁠[13]

ZachXBT: Official account: https://x.com/zachxbt (opens in a new window).⁠[14]

Investigations by ZachXBT: Official account: https://t.me/investigations (opens in a new window).⁠[15]