Chinese Crime Network Laundered Over $1 Billion for Lazarus Group, ZachXBT Says

Blockchain investigator ZachXBT says a Chinese organized crime syndicate laundered more than $1 billion stolen in several crypto exploits for North Korea’s Lazarus Group. In an Oct. 5 thread on X, he explained that he posed as a paying client in February 2025, just days after the $1.5 billion Bybit hack.

He put up $349,700 in stablecoins and accepted a 5% loss on each order to earn the trust of an operator known as “Jimmy Green.” The network worked across Hong Kong and mainland China. Information from the launderer helped ZachXBT spot a cluster of more than $12 million in Bybit-linked funds, and Tether later froze $442,000 in related USDT.

How North Korea Launders Stolen Crypto

North Korean hackers use a multi-stage process, including chain-hopping and token swaps across decentralized exchanges and bridges. Chainalysis says hackers tied to the country stole at least $6.75 billion in digital assets through 2025. Chinese intermediaries are a key link. In 2020, US prosecutors charged two Chinese nationals over laundering more than $100 million from a 2018 exchange hack. In 2023, OFAC sanctioned two traders, one in Hong Kong and one in China, for helping convert stolen funds.

Chinese Actors Linked to Bitget Exploit Laundering

ZachXBT also tied Chinese actors to laundering funds from the $387.5 million Bitget exploit in September. In a Sept. 28 post, he said they were openly asking for support in public Discord servers and Telegram channels run by the services they used. One operator was also involved in laundering money from the $292 million Kelp DAO exploit in April.