ZachXBT says Chinese network laundered $1B for Lazarus

Key points

• ZachXBT says a Chinese network laundered over $1B for Lazarus
• He posed as a client, funding an address with $349,700
• Over $12M in Bybit hack funds identified; Tether froze 442,000 USDT
• No arrests or official confirmation reported

Blockchain investigator ZachXBT said on Tuesday that a Chinese organized crime network laundered more than $1 billion in stolen cryptocurrency for North Korea’s Lazarus Group, including proceeds from the $1.5 billion Bybit hack. He said he infiltrated the operation by posing as a paying customer, according to Cointelegraph.

How the investigator got inside the network

ZachXBT said he approached the network shortly after the Bybit theft in early 2025 and funded an address with $349,700 in stablecoins. The Block reported the amount as 349,700 USDC on Ethereum and placed the funding in March 2025, while Cointelegraph cited February 2025, days after the hack.

He accepted a loss of about 5% per transaction to build credibility with an operator using the pseudonym “Jimmy Green,” according to both outlets. The Block reported that the suspect supplied a receiving address for swaps from USDC to USDT on Tron, and that ZachXBT had no guarantee the funds would not simply disappear.

The Block also reported that a bridge screenshot the suspect shared on March 12, 2025, matched a THORChain order. ZachXBT said the suspect predicted a movement of funds to Solana one day before it happened.

What the trail turned up

• Over $12 million in funds tied to the Bybit exploit was identified across multiple blockchains.
• Tether froze 442,000 USDT linked to the cluster.
• About $3 million in fraud proceeds was traced to Huione Guarantee, which The Block described as sanctioned.
• The suspect was connected to 332,000 USDC from the Poloniex exploit, per The Block.

Cointelegraph reported that the network operated from Hong Kong and mainland China. It also said ZachXBT linked Chinese actors to laundering of funds from the $387.5 million Bitget exploit in September 2026 and the $292 million Kelp DAO exploit in April 2026. Those two attributions were reported only by Cointelegraph among the sources reviewed.

ZachXBT told The Block he shared his findings with law enforcement and delayed publication because the investigation was sensitive. He also claimed to have helped facilitate $75 million in frozen funds tied to North Korean incidents since 2022.

Why Chinese launderers matter to North Korean hacking

North Korean hackers must convert stolen tokens into cash, and intermediaries in Asia have long played that role. Cointelegraph noted that in 2020 U.S. prosecutors charged two Chinese nationals with laundering more than $100 million stolen by North Korean hackers. In 2023, the U.S. Treasury’s Office of Foreign Assets Control sanctioned two crypto traders, one in Hong Kong and one in mainland China, for helping convert stolen crypto and evade financial controls.

Cointelegraph, citing Chainalysis, said North Korea stole at least $6.75 billion in crypto through 2025.

What remains unconfirmed

The findings come from ZachXBT’s own investigation, and the reports do not describe any official confirmation from U.S. or other authorities. Neither outlet reported arrests or charges tied to the network. The Bybit hack was widely attributed to Lazarus in 2025, but the specific laundering claims here have not been independently verified.