Blockchain investigator @ZachXBT has exposed a Chinese organized crime syndicate he says laundered more than $1 billion in stolen cryptocurrency on behalf of North Korea's Lazarus Group. The
Blockchain investigator @ZachXBT has exposed a Chinese organized crime syndicate he says laundered more than $1 billion in stolen cryptocurrency on behalf of North Korea's Lazarus Group. The findings, published in a detailed thread on October 5, drew on months of undercover work and helped trigger asset freezes tied to one of the industry's largest ever hacks.
The operation began in early March 2025, shortly after the February Bybit breach. ZachXBT posed as a paying client to infiltrate the money laundering network, putting up $349,700 in stablecoins and accepting a 5% loss on each order to build trust with one of the network's operators, known as "Jimmy Green."After the Bybit hack, he found more than 15 accounts in public Telegram and Discord groups seeking help processing transactions involving stolen funds.
According to ZachXBT, the money-laundering network operated mainly in Hong Kong and mainland China. By tracing information obtained from its members, he identified more than $12 million in fund flows linked to the Bybit hack, and Tether later froze $442,000 of related $USDT.The intelligence gathered during the undercover operation was provided to private-sector investigators and law enforcement agencies involved in the case.
The group was involved in laundering funds from the Bybit hack, Bitget hack, and Kelp DAO hack.Since 2022, ZachXBT claims to have helped facilitate the freezing of more than $75 million linked to North Korea-related crypto incidents.
The FBI previously attributed the February 2025 Bybit theft, worth about $1.5 billion, to North Korea and referred to the activity as TraderTraitor. That breach alone reshaped the industry's annual loss figures. North Korean hackers stole $2.02 billion in cryptocurrency in 2025, a 51% year-over-year increase, pushing their all-time total to $6.75 billion despite fewer attacks.
The DPRK shows clear preferences for Chinese-language money laundering services, bridge services, and mixing protocols, with a 45-day laundering cycle following major thefts. ZachXBT's investigation puts a human face on that infrastructure, showing how criminal intermediaries operating across China and Hong Kong serve as a critical link in moving state-sponsored proceeds out of reach.
Allegations that Chinese intermediary groups were involved in laundering crypto for North Korea have surfaced before. U.S. prosecutors charged two Chinese nationals in 2020 with laundering more than $100 million from funds North Korean hackers stole from a cryptocurrency exchange in 2018.
Sources:CryptoSlate: ZachXBT infiltrates $1B crypto syndicate to expose Lazarus GroupChainalysis: North Korea Drives Record $2 Billion Crypto Theft YearNBC News: North Korea stole billions in crypto in 2025, new research says
