Blockchain investigator ZachXBT claims he infiltrated a Chinese money-laundering network by posing as a customer. The information he gathered reportedly helped trace funds connected to the massive $1.5 billion Bybit hack.
Chinese Crime Network Linked to Lazarus Group
A Chinese organized crime network allegedly laundered more than $1 billion in cryptocurrency stolen through multiple exploits for North Korea’s Lazarus Group, according to ZachXBT.
In an Oct. 5 post on X, the pseudonymous blockchain investigator said he infiltrated the laundering operation in February 2025. His investigation began only days after the Bybit hack.
To gain the group’s trust, ZachXBT reportedly presented himself as a paying customer. He deposited $349,700 in stablecoins and accepted a 5% loss on each transaction while dealing with an operator known as “Jimmy Green.”
Bybit Funds Traced Through the Network
According to ZachXBT, the laundering operation had connections across Hong Kong and mainland China.
Information obtained from one of the alleged money launderers helped ZachXBT identify a cluster containing more than $12 million linked to the Bybit exploit.
Tether later froze approximately $442,000 worth of associated USDt (USDT).
The investigation provides a rare look at the intermediaries allegedly helping North Korean hackers move stolen cryptocurrency through the financial system.
According to Chainalysis, hackers linked to North Korea had stolen at least $6.75 billion in digital assets through 2025.
How North Korean Hackers Launder Stolen Crypto
North Korean hacking groups have reportedly used complex, multi-stage methods to hide the movement of stolen cryptocurrency.
One common strategy involves transferring assets between different blockchains. Hackers may also swap tokens through decentralized exchanges, cross-chain bridges and other crypto services.
These transactions make it harder for investigators to follow the original flow of the stolen funds.
Chinese intermediaries have previously appeared in investigations involving North Korean crypto operations.
In 2020, US prosecutors charged two Chinese nationals accused of laundering more than $100 million stolen by North Korean hackers from a cryptocurrency exchange in 2018.
US Authorities Have Previously Targeted Crypto Intermediaries
The United States has also imposed sanctions on individuals accused of helping North Korea convert stolen digital assets.
In 2023, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two cryptocurrency traders — one based in Hong Kong and another in China.
US authorities said the individuals helped the Democratic People’s Republic of Korea convert stolen cryptocurrency and evade financial restrictions.
Chinese Actors Also Linked to Bitget Funds
ZachXBT has separately connected Chinese actors to the laundering of funds associated with the $387.5 million Bitget exploit in September.
In a Sept. 28 post on X, ZachXBT claimed that Chinese actors allegedly laundering funds for North Korean hackers were openly asking for assistance in public Discord servers and Telegram channels linked to services they were using.
He also said that one of the operators had previously participated in laundering funds connected to the $292 million Kelp DAO exploit in April.
The claims further highlight the increasingly complex networks allegedly being used to move cryptocurrency stolen in major hacks while attempting to conceal its origin.
