Blockchain investigator ZachXBT alleges that a Chinese organized crime network laundered more than $1 billion in cryptocurrency stolen through multiple attacks linked to North Korea's Lazarus Group. The investigator, a pseudonymous researcher known for tracking stolen funds on-chain, detailed the probe on Oct. 5, saying he posed as a customer to gain access to the operation.

The claims add new detail to the movement of funds stolen in the $1.5 billion Bybit hack. Bloomberg reported at the time that the February 2025 attack drained almost $1.5 billion from the exchange, making it the largest crypto theft recorded to that point.

Inside the laundering operation

ZachXBT said he contacted an operator using the alias “Jimmy Green” after identifying more than 15 accounts offering to process funds tied to the Bybit theft. He then committed roughly $349,700 in stablecoins to transactions with the group, accepting losses of about 5% on each order to establish credibility and observe how the network handled illicit funds.

According to ZachXBT, the operation involved contacts in Hong Kong and mainland China. The operator allegedly provided wallet addresses and details of planned transfers, which ZachXBT then cross-referenced against public blockchain transactions. That process allowed him to identify a cluster containing more than $12 million in funds connected to the Bybit exploit.

Tracing funds across networks

The information also helped lead to the freezing of $442,000 in USDT associated with the Bybit-linked cluster, ZachXBT said. The investigation illustrates how blockchain records can complement intelligence gathered through direct interaction with suspected laundering intermediaries.

The investigator also stated that the network handled funds from other major crypto exploits. He cautioned, however, that the claim of more than $1 billion laundered remains his own assessment and has not been independently established as a confirmed total by law enforcement.

The case underscores the continuing role of intermediaries in moving North Korean-linked cryptocurrency. Lazarus has repeatedly used complex transaction routes, token swaps, and cross-chain transfers to make stolen assets harder to trace. The group is subject to United States sanctions, and United Nations investigators have repeatedly linked large-scale cryptocurrency thefts to North Korean state-linked actors. For the crypto industry, the investigation highlights both the scale of the laundering challenge and the growing importance of on intelligence in identifying stolen funds and supporting asset freezes.