A Chinese organized crime syndicate laundered more than $1 billion in stolen cryptocurrency for North Korea's Lazarus Group, according to blockchain investigator ZachXBT.
ZachXBT disclosed the findings in an October 5 post on X, describing how he posed as a paying client to infiltrate the network in February 2025, shortly after the Bybit hack. He deposited $349,700 in stablecoins and accepted a 5% loss on each transaction to build credibility with a network operator known as "Jimmy Green."
The investigation revealed operations spanning Hong Kong and mainland China. Information from the launderer helped ZachXBT identify more than $12 million in Bybit-related funds, leading to Tether freezing $442,000 in USDT.
Historical Pattern of Chinese Intermediaries
Chinese intermediaries have long served as key facilitators in North Korean cryptocurrency laundering. In 2020, U.S. prosecutors charged two Chinese nationals with laundering over $100 million stolen by North Korean hackers from a cryptocurrency exchange in 2018. In 2023, the U.S. Treasury Department's Office of Foreign Assets Control sanctioned two crypto traders—one from Hong Kong and one from China—for assisting the Democratic People's Republic of Korea in converting stolen cryptocurrency and circumventing financial controls.
Multi-Stage Laundering Methods
North Korean hackers employ sophisticated laundering techniques involving chain-hopping and token swapping through decentralized exchanges and bridges to obscure fund movements. According to Chainalysis, hackers linked to North Korea have stolen at least $6.75 billion in digital assets through 2025.
Bitget Exploit Connection
ZachXBT also linked Chinese actors to the laundering of funds from the $387.5 million Bitget exploit in September. On September 28, he reported that Chinese actors allegedly laundering funds for North Korean hackers had been openly recruiting support in public Discord servers and Telegram channels. ZachXBT identified one operator as also involved in laundering funds from the $292 million Kelp DAO exploit in April.
