ZachXBT tracks $12 million in Bybit breach

On-line investigator ZachXBT: Pretending to be a potential customer, he successfully tracked more than US$12 million in stolen funds by Bybit.

Well-known on-line investigator ZachXBT said that by disguising himself as a potential customer, he was able to infiltrate a money laundering network and use it to trace more than US$12 million in funds related to the hacking of Bybit's platform. This action introduced a rare social engineering dimension as a blockchain traceability work that originally relied purely on technical analysis.

How the "customer" disguising strategy drives the progress of the investigation

ZachXBT revealed that the core of the strategy is to use the identity of a legitimate customer as a cover to gain access to internal communication channels used to launder stolen assets. By operating within the money laundering network rather than just observing from the outside, he was able to more clearly track the flow of funds that was often difficult to attribute from an external perspective.

According to relevant reports, ZachXBT had previously used a similar infiltration method to expose its connection with the North Korean state-backed hacking group "Lazarus Group." What is remarkable about this approach is that most blockchain forensics work relies mainly on passive wallet map analysis. Directly interacting with operators of the money laundering network is a high-risk method and a path only tried by a few independent investigators.

ZachXBT's past work includes exposing token fraud, such as a case in which LAB token prices plunged 97% after linking the sell-off to a team-funded wallet. These experiences established his reputation for using unconventional investigative methods.

Interpretation of the meaning of data exceeding US$12 million

ZachXBT claims that through the above methods, more than US$12 million in attack-related funds have been traced. It needs to be clear that "tracking" means that these funds have been identified and mapped on the chain, but this does not mean that the funds have been frozen, confiscated or returned. This distinction is crucial: tracing establishes a source trajectory that law enforcement agencies or exchanges can take action, but it does not in itself constitute asset recovery.

The Bybit attack attributed by the FBI to North Korean cyber actors involved approximately $1.5 billion in stolen cryptocurrency. The $12 million figure is only a small fraction of the total, but any amount that is traceable, recordable and linked to a specific wallet address strengthens the chain of evidence. Currently, Bybit has maintained a public reward program for providing clues to help recover stolen ETH in its cold wallet.

If ZachXBT's findings are independently confirmed, they may be included in the reward framework or assist with ongoing broader law enforcement efforts. His previous assertion that "on-chain evidence affects markets" suggests that the findings he publishes can have a rapid impact on relevant assets and participants.

Why independent verification is still crucial

ZachXBT is an independent investigator, not an official authority. His findings carry considerable weight in the cryptographic security community, but are not equivalent to the conclusions of law enforcement agencies. Claims made through such channels should be regarded as clues that require independent confirmation, especially when specific wallet addresses or money laundering routes are involved.

Bybit's case is still ongoing. Major exchanges, data analytics firms and regulators are keeping a close eye on the money movement associated with the February attacks. Any confirmatory trace of the $12 million involved will be an important data point in an investigation that spans multiple chains and jurisdictions. However, figures issued by a single investigator still need to be corroborated by multiple sources before they can be regarded as established facts.