ZachXBT Infiltrates Chinese Syndicate Laundering Funds for Lazarus

Prominent pseudonymous blockchain investigator ZachXBT has revealed a high-stakes undercover operation targeting a Chinese organized crime syndicate that allegedly laundered more than $1 billion for North Korea's notorious Lazarus Group. According to details shared in an Oct. 5 social media post, the sleuth risked substantial personal funds to penetrate the criminal network shortly after the massive Bybit exploit.

To gain the confidence of the money laundering ring, ZachXBT posed as a paying customer. Operating under this alias in February 2025, just days after the $1.5 billion Bybit hack, he committed $349,700 in stablecoins to the effort. He accepted a 5 percent loss on each transaction to maintain his cover with a key operator identified as "Jimmy Green."

The investigation exposes the operational mechanics of illicit financial networks spanning Hong Kong and mainland China. Intelligence gathered during the undercover stint enabled ZachXBT to pinpoint a cluster of more than $12 million in funds directly linked to the Bybit breach. Subsequently, stablecoin issuer Tether froze $442,000 in associated USDT tokens based on these findings.

The Anatomy of North Korean Crypto Laundering

North Korean state-sponsored hackers routinely employ sophisticated, multi-stage laundering processes to obscure the origin of stolen digital funds. These techniques frequently involve "chain-hopping" and token swapping across decentralized exchanges, cross-chain bridges, and other intermediary services to sever the on-chain paper trail.

Historically, Chinese intermediaries have served as vital cogs in this illicit machinery. U.S. authorities have previously cracked down on similar networks, including a 2020 federal indictment of two Chinese nationals accused of laundering over $100 million from a 2018 exchange hack. The U.S. Department of the Treasury's Office of Foreign Assets Control also sanctioned two crypto traders in Hong Kong and mainland China in 2023 for helping the Democratic People's Republic of Korea bypass financial controls.

ZachXBT's investigations suggest these networks operate with a degree of brazenness. In late September, he reported that Chinese actors laundering funds from the $387.5 million Bitget exploit had openly solicited support within public Discord servers and Telegram channels. One of the individuals involved was also linked to the laundering of $292 million stolen in the April Kelp DAO exploit.

Why it matters

This undercover operation offers rare, granular insight into the underground economy facilitating state-sponsored cybercrime. Chainalysis data indicates that hackers linked to North Korea stole at least $6.75 billion in digital assets through 2025 alone, relying heavily on specialized third-party launderers to convert stolen crypto into usable fiat or clean tokens.

By infiltrating these syndicates directly, independent investigators are occasionally able to bypass the limitations of traditional cross-border law enforcement. However, the sheer scale of the funds involved—surpassing $1 billion for this single network—underscores the systemic challenge regulators and security professionals face in stemming the flow of illicit capital across global blockchain networks.

What to watch

Market participants and security analysts will monitor whether law enforcement agencies globally take formal action against the specific operators identified in ZachXBT's thread. Observers will also track how major stablecoin issuers and centralized platforms respond to newly uncovered wallet clusters tied to ongoing investigations into the Bybit, Bitget, and Kelp DAO exploits.