North Korea's Lazarus Moved Stolen $1B Through Chinese Launderers, ZachXBT Alleges

Blockchain investigator ZachXBT said a Chinese crime network laundered more than $1 billion in stolen crypto for North Korea's Lazarus Group, including funds from the 2025 Bybit hack.

Key Points:

ZachXBT said he posed as a paying client and fronted $349,700 to win the trust of an operator inside the alleged network.

He said the tracing flagged more than $12 million in Bybit-linked funds and led to a freeze of 442,000 USDT.

Authorities have not publicly confirmed the network's size or identified the operator.

ZachXBT Bybit Probe

The pseudonymous investigator detailed the operation in an Oct. 5 thread on X, saying it began shortly after the February 2025 theft. He had spotted more than 15 accounts in public Telegram and Discord groups seeking help with orders tied to stolen funds. Posing as a client, he funded a new address with 349,700 USDC (USDC) and lost about 5% per order trading with a vendor called "Jimmy Green."

Green described an operation spanning Hong Kong and mainland China and discussed Bybit fund movements, including a shift to Solana (SOL), a day before they happened, according to the thread. He also claimed his team laundered most of the $1.5 billion.

Three addresses Green shared exposed a cluster of more than $12 million in Bybit funds swapped across Bitcoin (BTC), Ether (ETH), Solana and Tron (TRX), ZachXBT said. Tether (USDT) later froze 442,000 of its tokens tied to that cluster, he added. He said he alerted law enforcement immediately but delayed publication because the case was sensitive.

Also Read: Binance AI Agent Builds Strategies From Plain Words, Charges 19.99 USDC To Trade

Lazarus Group Laundering Claims

Authorities have not publicly confirmed his account. Public releases from the FBI, the U.S. Treasury and Tether do not identify the operator or verify that one network handled more than $1 billion for the North Korean hackers.

ZachXBT has also tied Chinese actors to the $387.5 million Bitget exploit of Sept. 24. On Sept. 28, he flagged five aliases that sought support in public Discord and Telegram channels run by services they used to move the money. One of them also handled funds from the $292 million Kelp DAO exploit in April, he said.

Separately, Chainalysis reported Oct. 5 that wallets sending peer-to-peer stablecoin transfers in China grew 43-fold between the first quarter of 2024 and the second quarter of 2026. The firm counted $104.1 billion across 18.1 million self-custodied transfers from July 2025 through June 2026, even as Beijing tightened restrictions on crypto trading and stablecoins.

Bybit Hack Background

Bybit lost about $1.5 billion in Ether and related tokens on Feb. 21, 2025, in what was then called the largest single theft in crypto history. The FBI attributed the attack to North Korean actors it tracks as TraderTraitor. Chainalysis has estimated that North Korean hackers stole $2.02 billion in crypto during 2025 and said the Bitget theft pushed their 2026 total above $1 billion.

Alexey Bondarev

Alexey Bondarev is Head of Content at Yellow.com. He specializes in in-depth Research and Learn pieces, with a focus on analytical reporting, industry context, and the bigger forces shaping crypto, from the AI era and security technologies to fintech innovation. He believes that everything digital will imminently overcome everything analogue and is working hard to make that come true.