According to CoinMeta, ZachXBT disguised itself as a customer to infiltrate a criminal gang suspected of laundering money for Lazarus Group, and assisted in freezing funds related to the Bybit attack in 2025. In February 2025, after Bybit suffered an attack worth $1.5 billion, ZachXBT discovered that multiple social media accounts were seeking to deal with the stolen funds. ZachXBT contacted a user named Telegram using the alias Jimmy Green and established trust, transferring $3.497 million to an Ethereum address on March 6, 2025, for the purpose of conducting exchange transactions between USDC and Tron on the USDT chain.