Blockchain investigator ZachXBT claims a Chinese organized crime syndicate laundered over $1 billion in stolen cryptocurrency for the North Korean Lazarus Group. ZachXBT infiltrated the network in February 2025 by posing as a client, interacting with an operator identified as Jimmy Green.
To gain trust, the investigator spent $349,700 in stablecoins, accepting a 5% loss on transactions. The operation, based in Hong Kong and mainland China, helped trace funds from the $1.5 billion Bybit hack. Tether subsequently froze $442,000 in associated USDT tokens.
According to Chainalysis, hackers linked to North Korea have stolen at least $6.75 billion in digital assets through 2025. These groups frequently use multi-stage laundering, including chain-hopping and token swapping across decentralized exchanges and bridges.
ZachXBT also connected Chinese actors to the laundering of proceeds from the $387.5 million Bitget exploit in September and the $292 million Kelp DAO hack in April. The investigator noted that these intermediaries often solicit business via public Telegram and Discord channels.
