The cryptographic world has been rocked by the shocking disclosure that the esteemed cyber investigator, ZachXBT, may be the mastermind behind the notorious Lazarus Group. This revelation comes in the wake of the Lazarus Group’s unprecedented hack on Bybit, which resulted in a staggering loss of $1.5B in February. The news has sent shockwaves through the industry as it grapples with the possibility that its most revered whitehat could have been operating under the aegis of North Korea.
ZachXBT, a pseudonymous blockchain investigator, has earned wide accolades for his relentless pursuit of scams and hacks. Utilizing his profound expertise in onchain analysis, Zach has been instrumental in tracing wallet movements, tracking illicit transactions, and unmasking malevolent actors. His knack for unravelling intricate scams such as rug pulls and P&Ds, backed by blockchain data, court documents, and social media activity, has made him a beacon of hope in the web3 landscape.
On February 21, ZachXBT made his return to social media after an almost three-week absence with a post stating: “Have turned off my DMs for the next few weeks as people do not respect my time and lack basic financial literacy or common sense. This means there’s currently no way to contact me so do not get scammed.” Shortly after, he announced that he was “monitoring suspicious outflows from Bybit of $1.46B+” and would update as more information became available.
Initially, industry figures applauded ZachXBT for his swift identification of the exploit and his prompt action to alert exchanges to mitigate the flow of purloined funds. However, it wasn’t long before eyebrows were raised regarding the timing of Zach’s return to social media, which coincided with the biggest hack in crypto history.
As whispers started suggesting that ZachXBT may be the puppeteer behind the Lazarus Group, an onchain analytics firm released a damning dossier linking the crypto sleuth to every major onchain hack in history, including the $600M Ronin bridge exploit. When questioned on their failure to detect the connections between the industry’s perceived Sherlock and its Moriarty adversary sooner, ChainCis, the analytics firm, confessed: “Up until now we just repeated Zach’s research and passed it off as our own.” Only upon probing ZachXBT’s onchain activity did ChainCis unearth evidence that suggested he could be the criminal mastermind orchestrating the Lazarus Group’s activities.
As the scrutiny on ZachXBT intensified, one user suggested, “There’s actually evidence that his crimes go back further than DeFi.” An intrigued follower asked, “How much further?” to which the original poster cryptically responded, “You ever hear of Jack the Ripper?”
ChainCis CEO David Fisher reflected on the situation, “We assumed that Zach was a good guy because he said he was a good guy. There’s an old Bitcoin saying that goes ‘Don’t trust, verify’ but we trusted Zach when we should have verified. And we can now verify that the B in ZachXBT stands for Best Korea.”
