A Chinese organized crime network allegedly helped North Korea’s Lazarus Group move more than $1 billion in cryptocurrency stolen in various attacks, according to blockchain investigator ZachXBT.
ZachXBT said he got inside the network by posing as a customer in February 2025, just days after the Bybit hack. He said he put up $349,700 in stablecoins and accepted a 5% loss on every transaction. The idea was to gain the trust of an operator known as “Jimmy Green” and learn how the group handled stolen crypto.
1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.
Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain. https://t.co/jauRRt8875
— ZachXBT (@zachxbt) October 5, 2026
The operation, according to ZachXBT, involved people in both Hong Kong and mainland China. His dealings with the network helped him identify a group of wallets holding more than $12 million connected to the Bybit hack. Tether later froze about $442,000 worth of USDT linked to those funds.
ZachXBT said he did not simply watch the wallets from the outside. He actually dealt with the people involved and paid for their services. Taking a loss on the transactions was part of his attempt to build trust with the network.
The investigation offers a rare look at what happens after North Korean hackers steal cryptocurrency. Stealing the money is only one part of the job. The hackers then need to move it around, change it into other tokens and eventually find ways to turn it into usable money.
North Korean hacking groups have used several methods to make this process difficult to track. They can move funds between different blockchains, swap one cryptocurrency for another and use decentralized exchanges and bridges. These steps can create a complicated trail for investigators to follow.
Chinese intermediaries appear to have played a role in some of these operations in the past as well. In 2020, US prosecutors charged two Chinese nationals with allegedly laundering more than $100 million stolen by North Korean hackers from a cryptocurrency exchange in 2018.
The US government also took action against two crypto traders in 2023. The Treasury Department’s Office of Foreign Assets Control sanctioned one trader from Hong Kong and another from China for allegedly helping North Korea convert stolen cryptocurrency and get around financial restrictions.
ZachXBT has reported other links between Chinese actors and North Korean crypto thefts. In September, he said Chinese individuals were allegedly helping North Korean hackers move money stolen in the $387.5 million Bitget exploit.
He also said some of the people involved were openly looking for help in public Discord servers and Telegram channels connected to crypto services. One of the operators, according to his earlier investigation, had also been involved in moving funds from the $292 million Kelp DAO exploit.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment