ZachXBT Traces $12M in Bybit Exploit Funds

On-chain investigator ZachXBT says posing as a prospective client gave him access to a money-laundering network that helped him trace more than $12 million in funds connected to the Bybit exploit, adding a rare social-engineering dimension to what has otherwise been a purely technical blockchain-tracing effort.

How the Client Ruse Helped Move the Investigation Forward

ZachXBT said the tactic involved presenting himself as a legitimate client to gain entry to channels used to launder the stolen assets. By operating inside those networks rather than observing them from the outside, he was able to follow fund flows that would otherwise have been harder to attribute. Per CryptoSlate reporting, the investigator had previously used similar infiltration methods to expose connections to the Lazarus Group, the North Korean state-linked hacking collective. For related coverage, see OKX and ICE File to Trade 63 Tokenized NYSE Stocks.

The approach is notable because most blockchain forensics relies on passive wallet-graph analysis. Direct engagement with the operators of a laundering network is a higher-risk method and one that few independent investigators attempt. ZachXBT’s past work exposing token fraud, including cases where LAB token fell 97% after he linked selling to team-funded wallets, has established his track record for unconventional investigative approaches. For related coverage, see Metaplanet Sold 10,000 Bitcoin to Show Reserves Could Top Debt.

What the More-Than-$12 Million Figure Represents

ZachXBT’s claim is that more than $12 million in exploit-linked funds have been traced through the method. Tracing means the funds have been identified and mapped on-chain, not that they have been frozen, seized, or returned. The distinction matters: tracing establishes a provenance trail that law enforcement or exchanges can act on, but it does not itself constitute recovery. For related coverage, see Aave Raises GHO Borrow APR to 4.5% as Pools Deplete.

The Bybit exploit, which the FBI attributed to North Korean cyber actors, involved approximately $1.5 billion in stolen cryptocurrency. The $12 million figure represents a fraction of that total, though any traceable amount that can be documented and linked to specific wallets strengthens the evidentiary record. Bybit has maintained a public bounty program for information leading to the recovery of the stolen ETH from its cold wallet.

ZachXBT’s findings, if independently confirmed, could feed into that bounty framework or into broader law enforcement efforts already underway. His prior claim that on-chain evidence moved markets illustrates how quickly his published findings can affect connected assets and actors.

Why Independent Verification Still Matters

ZachXBT operates as an independent investigator, not an official authority. His findings carry significant weight in the crypto security community but are not law enforcement conclusions. Claims made through this channel should be treated as leads requiring independent confirmation, particularly where specific wallet addresses or laundering routes are named.

The Bybit case remains active. Exchanges, analytics firms, and regulators are all monitoring fund movements tied to the February exploit. Any confirmed tracing of $12 million in exploit proceeds would represent a meaningful data point in an investigation that spans multiple chains and jurisdictions, but published figures from a single investigator merit corroboration before being treated as settled.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.