Chinese crime network laundered over $1B for Lazarus: ZachXBT

ZachXBT says he infiltrated the network by posing as a customer, gaining information that helped trace funds from the $1.5 billion Bybit hack. A Chinese organized crime syndicate laundered more than $1 billion stolen in multiple crypto exploits for North Korea’s Lazarus Group, according to blockchain investigator ZachXBT. In an Oct. 5 thread on X, pseudonymous blockchain investigator ZachXBT >said he posed as a paying client to infiltrate the money laundering network in February 2025, just days after the Bybit hack. He put up $349,700 in stablecoins and took a 5% loss on each order to build trust with one of the network’s operators, known as “Jimmy Green.” ZachXBT said the operations spanned Hong Kong and mainland China, and information supplied by the launderer helped him identify a cluster of more than $12 million in Bybit-linked funds, with Tether later freezing $442,000 in associated USDt (USDT). The investigation offers rare insight into the alleged intermediaries handling North Korea’s stolen crypto. Hackers linked to the country have stolen at least $6.75 billion in digital assets through 2025, >according to Chainalysis. North Korean hackers are known to use a multi-stage laundering process. One method involves chain-hopping and token swapping through decentralized exchanges, bridges and other services to obscure the flow of funds. Related: SlowMist traces Bitget hack activity to Aug. 31 zero-day exploit Chinese intermediaries have emerged as an important link in that process. In 2020, US prosecutors >charged two Chinese nationals with laundering more than $100 million stolen by North Korean hackers from a cryptocurrency exchange in 2018. Source: >ZachXBT In 2023, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) >sanctioned two crypto traders, one from Hong Kong and the other from China, for their role in helping the DPRK convert stolen crypto and bypass financial controls. ZachXBT has also >linked Chinese actors to the laundering of funds from t