ZachXBT’s Six-Figure Sting Targets Bybit Hack Launderers

What changed: an investigator's funded infiltration claim

According to a report by The Block, independent blockchain researcher ZachXBT stated that he personally covered the costs of infiltrating a group of alleged Chinese money launderers linked to the “Lazarus” group and the Bybit exchange hack. He has long been tracking stolen cryptocurrency through exchanges, mixers, and over-the-counter brokers, typically publishing clusters of wallets and transaction paths without directly naming his sources.

Reportedly, this claim is limited in scope. ZakXBT states that the money came out of his own pocket and was not provided by Bybit, a government agency, or as part of an official reward program. The statement does not specify exactly how the infiltration operation was carried out, what evidence was obtained, or whether any report was subsequently filed with law enforcement agencies. Nothing about the incident that prompted the statement indicates that Bybit has changed its security policy, fee structure, or verification procedure in connection with this specific statement.

Why is this information categorized under “China”?

The network he claims to have infiltrated is described as Chinese. This is relevant for the purposes of this site, as Bybit already considers mainland China to be a restricted market. These two facts coexist but do not actually overlap: a money-laundering network operating from or through China is an entirely different matter from Bybit’s own list of countries authorized to trade on the platform, which was compiled before this story emerged and has no connection to it.

What is the problem with interpreting this information as exchange news?

An investigator’s decision regarding the use of funds is not the same as a disclosure by the exchange. Bybit did not issue a parallel statement describing new control measures related to this specific announcement. If you’ve seen a headline suggesting that Bybit has tightened certain measures because of this, that does not reflect the essence of the event that prompted it. The fact is that ZackXBT allocated funds for his own investigation, period.

Conclusion: This article discusses the investigator's personal expenses, not an update to Bybit's policy.

Who this actually touches

Three groups have a good reason to read the article beyond just the headline, while a much larger group does not.

• Bybit account holders who transferred funds through intermediary wallets following the hack, as any address publicly flagged in ZachXBT’s analysis could affect how other platforms verify incoming transfers.
• Compliance and risk management departments at exchanges and over-the-counter trading platforms that review wallets linked to the Lazarus Group’s activities, as a new public discussion thread could alter the criteria for automatic flagging or manual review.
• Retail users residing in the country at the center of this lawsuit—mainland China—where Bybit already restricts new user registrations regardless of this situation.

Other Bybit users do not need to take any additional action today. The statement refers to a parallel investigation, not a data breach notification, a suspension of withdrawals, or a change to the registration rules.

Overview of Countries and Limits on Bybit

The list of countries subject to restrictions is noteworthy precisely because the individuals involved in this case—who are suspected of money laundering—are described as Chinese. According to Bybit’s own terms and conditions, mainland China is already excluded from the list, so using Bybit from an account registered in China did not comply with the exchange’s stated terms from the outset, regardless of what ZachXBT claims he was doing.

Conclusion: Users from China have never been permitted to use the Bybit service in accordance with its own terms and conditions, regardless of whether or not a specific statement to that effect exists.

What to actually do about it

Don't let the headline about alleged money launderers influence your perception of your own Bybit metrics. Here's what you should focus on instead (in the order listed).

1. Before making any assumptions, verify your actual rate tier. The base-level spot trading rates are 0.100% for “makers” and 0.100% for “takers”; your actual rate depends on your tier and accumulated trading volume, and this tier structure is unrelated to this article.
2. Before transferring a large amount, familiarize yourself with the withdrawal process. Bybit charges a fee as described at there is a charge of withdrawal fees depending on the cryptocurrencies you’re withdrawing., and your daily limit depends on your verification level and varies within the range specified on the page from 20K USDT daily (no KYC) to 4M USDT daily (Pro level).
3. If you use instant purchase or card top-up, budget for approximately approximately 1% on top of the market price. This fee is not related to money laundering allegations and has not changed as a result of them.
4. If you are in China, consider this restriction to be already in effect: Bybit lists this country in the “United States, Canada, the Chinese Mainland, Hong Kong, Singapore” section, so the exchange was inaccessible to accounts registered in China before this news broke and remains inaccessible afterward.
5. Treat any thread discussing wallet labeling—including this one—as a guide for independent verification, not as a confirmed list of blocked wallets. Researchers’ statements are not verified official data; before taking any action, verify the information against the exchange’s own compliance notices.
6. Please separate your two questions. If you’re truly concerned about whether it’s safe to hold funds on the Bybit exchange itself, the answer can be found in the fees, limits, and terms for different countries published by Bybit itself, as listed above, rather than in a single researcher’s decision regarding where to hold funds. If you’re concerned about how money laundering networks are tracked and prosecuted after they’re detected, that’s a different, more long-term issue with its own chain of evidence.
7. If you’re interested in exchange security and incident response in a broader sense—rather than this specific claim—compare how other platforms have handled situations involving a complete shutdown. BitMEX Suspends Trading While Allowing Withdrawals and BitMEX Shutdown: What Will Happen to Your Account cover the process of winding down the platform’s operations, which is a different category of event from a lawsuit funded by a single investigator. As for how money laundering cases are prosecuted against users after they are detected, a useful example for comparison is the article Brooklyn Resident Sentenced for Social Engineering Scheme Involving Coinbase.

None of these steps require immediate action. Nothing in the description of the triggering event indicates a suspension of operations, a violation, or a change to Bybit’s rules. This concerns a decision by one of the investigators regarding the expenditure of funds and the assertion of who it was directed against.

Conclusion: Before making any changes based on this statement, please review Bybit's pages on fees and limits, as there have been no changes to them.