Chinese Crime Network Laundered $1 Billion for North Korea’s Lazarus Group
Chinese organized crime networks have been implicated in laundering over $1 billion in cryptocurrency stolen by North Korea’s Lazarus Group, according to blockchain investigator ZachXBT. In February 2025, ZachXBT infiltrated the money laundering operation by posing as a client, transferring $349,700 in stablecoins to gain the trust of a key operator named Jimmy Green. The investigator accepted a 5% loss on each transaction to maintain his cover. The network, operating across Hong Kong and mainland China, facilitated the movement of more than $12 million linked to the Bybit hack. Tether later froze $442,000 in USDT held in associated wallets.
The investigation sheds light on the intermediary networks North Korean hackers use to move stolen cryptocurrency. According to Chainalysis, hackers linked to North Korea had stolen at least $6.75 billion in digital assets by the end of 2025. North Korean hackers typically employ multi-stage schemes, transferring cryptocurrency across different blockchains, swapping through decentralized exchanges, and routing through bridges and other services. Chinese intermediaries have played a significant role in these schemes, with U.S. prosecutors charging two Chinese nationals in 2020 for laundering over $100 million stolen by North Korean hackers.
ZachXBT also linked Chinese participants to the laundering of funds following the $387.5 million Bitget hack in September 2025. Operators involved in these schemes were reportedly seeking technical support in public Discord servers and Telegram channels. One of the operators had previously been involved in laundering funds from the $292 million Kelp DAO hack in April 2025. The Lazarus Group, known for high-profile cyberattacks, has increasingly targeted the cryptocurrency industry, including exchanges, blockchain projects, and cross-chain bridges. U.S. authorities have repeatedly connected the group’s activities to North Korea’s efforts to circumvent international sanctions.