ZachXBT paid a Chinese laundering network 5% an order to trace $12M in stolen Bybit funds

Against the size of the theft, the recovered sums are small. More than $12 million traced out of roughly $1.5 billion stolen is about 0.8% ^[16]. The 442,000 USDT that Tether froze, by ZachXBT's account, is about 0.03% of the haul, or roughly three dollars in every ten thousand ^[17]. It is also about 3.7% of what he traced ^[18].

The cost side is the better puzzle. CryptoSlate treats the 349,700 USDC as capital committed to the trades, not a disclosed net loss ^[4]. The price of entry was the 5% he gave up on each completed order ^[1], plus the risk that the contact would disappear with the funds ^[9]. CryptoSlate did not report how many orders he ran. If the whole sum went through once, the fee was about $17,485 ^[15], and the frozen USDT is roughly 25 times that ^[20]. On that assumption one paying client bought a freeze for about four cents on the dollar, or rather, bought information that he says helped bring one about ^[7].

Naming the thieves was quick. The FBI attributed the theft to North Korean hackers, under the label TraderTraitor, on Feb. 26, 2025, and warned that the proceeds were being converted into Bitcoin and other coins and spread across thousands of addresses ^[2]. According to CryptoSlate, the client relationship gave him information that ordinary blockchain analysis could not provide ^[10].

The brokers may respond by vetting clients harder and giving up business to do it. Freezes may also stay rare, since each one needs an issuer willing to act ^[7]. The likeliest path, on Treasury's own evidence, is that the trade moves, as it did when criminals shifted from Huione to Xinbi after Huione was sanctioned ^[12]. Xinbi's more than $24 billion in processed volume since 2022, by Treasury's count ^[11], is about 16 times the Bybit theft ^[19].

We think the cash-out desk is the right place to look and a poor place to expect volume. CryptoSlate argues that converting stolen crypto into spendable money is the hard part of the crime, and that the payment services involved let investigators and regulators intervene ^[13]. The counter-thesis comes from the same Treasury record, in which a venue of that size was itself the replacement for a sanctioned one ^[12]. If 442,000 USDT stays the only freeze this line of work produces, the evidence supports a narrower claim: a broker can be watched from inside, while recovery stays near three dollars per ten thousand stolen ^[17].