ZachXBT Exposes Chinese Criminal Operation That Processed $1B+ for North Korean Lazarus Hackers
Blockchain investigator ZachXBT successfully penetrated a Chinese money laundering operation that processed over $1 billion for North Korean cybercriminals, leading to the tracking of assets from the Bybit security breach.
According to blockchain investigator ZachXBT, a Chinese organized criminal enterprise processed over $1 billion in cryptocurrency stolen across numerous exploits on behalf of North Korea's Lazarus Group.
Through an Oct. 5 series of posts on X, the pseudonymous blockchain sleuth ZachXBT revealed that he assumed the identity of a paid customer to penetrate the money laundering operation in February 2025, mere days following the Bybit security breach. He committed $349,700 in stablecoins and accepted a 5% loss on every transaction to establish credibility with a network operator identified as "Jimmy Green."
According to ZachXBT, the criminal activities extended across Hong Kong and mainland China, and intelligence provided by the money launderer enabled him to pinpoint a cluster exceeding $12 million in funds connected to Bybit, with Tether subsequently freezing $442,000 in related USDt (USDT).
The investigative work provides uncommon visibility into the purported middlemen processing North Korea's stolen cryptocurrency. Cybercriminals associated with the nation have stolen a minimum of $6.75 billion in digital currencies through 2025, based on data from Chainalysis.
How North Korea moves stolen crypto
Cybercriminals from North Korea are recognized for employing a multi-phase laundering methodology. A common technique includes chain-hopping and token swapping via decentralized exchanges, bridges and additional services to mask the movement of assets.
Intermediaries based in China have become a critical component in that operation. In 2020, US prosecutors brought charges against two Chinese nationals for laundering over $100 million stolen by North Korean cybercriminals from a cryptocurrency exchange in 2018.
In 2023, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) imposed sanctions on two cryptocurrency traders, one based in Hong Kong and the other in China, for their participation in assisting the DPRK convert stolen cryptocurrency and circumvent financial regulations.
Chinese actors allegedly laundering Bitget funds
ZachXBT has additionally connected Chinese operatives to the laundering of assets from the $387.5 million Bitget exploit in September.
In a post to X on Sept. 28, ZachXBT stated that Chinese operatives allegedly laundering assets on behalf of the North Korean cybercriminals had been publicly seeking assistance in public Discord servers and Telegram channels operated by services they utilized. ZachXBT indicated that one of the operators had also participated in laundering assets from the $292 million Kelp DAO exploit in April.