ZachXBT Says Chinese Network Laundered More Than $1 Billion for Lazarus
Blockchain investigator ZachXBT says a Chinese organized crime network laundered more than $1 billion in cryptocurrency stolen through multiple attacks linked to North Korea’s Lazarus Group. He detailed the investigation on Oct. 5, saying he posed as a customer to gain access to the operation.
The claims add new detail to the movement of funds stolen in the $1.5 billion Bybit hack. Bloomberg reported at the time that the February 2025 attack drained almost $1.5 billion from the exchange, making it the largest crypto theft then recorded.
Inside the laundering operation
ZachXBT said he contacted an operator using the alias “Jimmy Green” after finding more than 15 accounts offering to process funds linked to the Bybit theft.
He then committed about $349,700 in stablecoins to transactions with the group. He accepted losses of roughly 5% on each order to establish credibility and observe how the network handled illicit funds.
According to ZachXBT, the operation involved contacts in Hong Kong and mainland China. The operator allegedly provided wallet addresses and information about planned transfers. ZachXBT then compared those claims with public blockchain transactions.
That process allowed him to identify a cluster containing more than $12 million in funds linked to the Bybit exploit.
Tracing funds across crypto networks
ZachXBT said the information also helped lead to the freezing of $442,000 in USDT associated with the Bybit-linked cluster. The investigation illustrates how blockchain records can complement intelligence gathered through direct interaction with suspected laundering intermediaries.
The investigator also said the network handled funds from other major crypto exploits. However, the claim that the group laundered more than $1 billion remains ZachXBT’s assessment and has not been independently established as a confirmed total by law enforcement.
The case highlights the continuing role of intermediaries in moving North Korean-linked cryptocurrency. Lazarus has repeatedly used complex transaction routes, token swaps and cross-chain transfers to make stolen assets harder to trace.
For the crypto industry, the investigation underscores both the scale of the laundering challenge and the growing importance of on-chain intelligence in identifying stolen funds and supporting asset freezes.
