Chinese Crime Syndicate Laundered Over $1 Billion Stolen by Lazarus Group, Reveals ZachXBT
According to pseudonymous blockchain investigator ZachXBT, a Chinese organized crime syndicate laundered over $1 billion stolen in various crypto exploits conducted by North Korea’s Lazarus Group. In February 2025, shortly after the Bybit hack, ZachXBT infiltrated the money laundering network posing as a client, exposing the extensive operations and leading to Tether freezing millions in associated assets.
Infiltrating the Laundering Network
ZachXBT explained that in February 2025 he posed as a paying client and invested $349,700 in stablecoins, accepting a 5% fee per order to build trust with a network operator known as 'Jimmy Green.' The investigation revealed that the syndicate’s operations spanned Hong Kong and mainland China. Info provided by the launderer led to identifying a cluster of over $12 million linked to the Bybit hack, resulting in Tether freezing $442,000 in associated USDT tokens.
How North Korea Moves Stolen Crypto
North Korean hackers utilize a multi-stage laundering process, including chain-hopping and token swapping through decentralized exchanges and bridges to mask transaction flows. Chinese intermediaries have become a vital link in this chain, assisting in converting stolen assets. Notably, in 2020, two Chinese nationals were charged with laundering over $100 million stolen by North Korean hackers from a crypto exchange in 2018.
Additionally, in 2023 the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two crypto traders from Hong Kong and China for aiding the DPRK in bypassing financial controls.
Chinese Actors Linked to Laundering Bitget and Other Hacks
ZachXBT also connected Chinese actors to laundering funds from the $387.5 million Bitget exploit in September 2025. These operators were reportedly soliciting support openly in public Discord servers and Telegram channels of the services they used. Moreover, one operator was involved in laundering funds from the $292 million Kelp DAO exploit in April, indicating an entrenched network of Chinese intermediaries working with stolen North Korean crypto assets.
Why it matters
This investigation offers rare and valuable insight into the intermediaries facilitating the laundering of crypto assets stolen by North Korean hackers. ZachXBT's findings highlight the significant role of Chinese criminal networks and intermediaries, corroborated by OFAC sanctions. Understanding these dynamics is crucial for grasping the scale and methods behind cybercrime financing, as well as for developing effective strategies to curb transnational money laundering and cybercriminal activities.
Prepared from the source material with AI-assisted editing and checked against the supplied facts.
Open original source ↗