Chinese Crime Network Laundered $1B for North Korea’s Lazarus Group

Blockchain investigator ZachXBT has uncovered a Chinese crime network that laundered over $1 billion in stolen cryptocurrency for North Korea’s Lazarus Group. In an October 5 thread on X, ZachXBT revealed that he infiltrated the network in February 2025 by posing as a client. He transferred $349,700 in stablecoins and accepted a 5% loss on each transaction to gain the trust of an operator known as “Jimmy Green.”

The investigation traced the operations to Hong Kong and mainland China, identifying a cluster of more than $12 million in funds linked to the Bybit hack. Tether later froze $442,000 in associated USDt (USDT). North Korean hackers have stolen at least $6.75 billion in digital assets through 2025, according to Chainalysis.

ZachXBT also linked Chinese actors to the laundering of funds from the $387.5 million Bitget exploit in September. One of the operators had previously been involved in laundering funds from the $292 million Kelp DAO exploit in April. The investigation highlights the role of Chinese intermediaries in facilitating the conversion of stolen crypto for North Korea.

In 2020, US prosecutors charged two Chinese nationals with laundering over $100 million stolen by North Korean hackers from a cryptocurrency exchange. In 2023, the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two crypto traders for their role in helping the DPRK bypass financial controls.