Chinese Crime Syndicate Laundered $1B in Stolen North Korean Crypto

A Chinese organized crime group has been linked to laundering over $1 billion in cryptocurrency stolen by North Korea’s Lazarus Group. The group, operating primarily in Hong Kong and mainland China, was involved in cleaning funds from several high-profile hacks, including the Bybit hack, Bitget hack, and Kelp DAO hack.

On-chain investigator ZachXBT revealed that the group laundered more than $1 billion in crypto assets stolen in multiple Lazarus-linked hacks. ZachXBT approached the group posing as a customer after the Bybit hack in February 2023, gaining the trust of a member identified as Jimmy Green by depositing $349,700 in stablecoins and accepting a 5% loss on each transaction.

Tether froze $442,000 in USDT tied to the Bybit hack, while digital assets stolen by hackers linked to North Korea had reached at least $6.75 billion by 2025. North Korean hacking groups are known to use complex laundering methods, moving assets across multiple blockchains and swapping tokens through decentralized exchanges (DEXs) and bridges.

Previous allegations have surfaced about Chinese intermediary groups laundering crypto for North Korea. In 2020, U.S. prosecutors charged two Chinese nationals with laundering over $100 million from a 2018 cryptocurrency exchange hack. The U.S. Treasury Department’s Office of Foreign Assets Control also sanctioned two crypto traders in Hong Kong and China in 2023 for converting stolen North Korean crypto into cash.

ZachXBT also linked the group to laundering funds from the $387.5 million Bitget hack and the $292 million Kelp DAO hack. Some members sought support for laundering activity through public Discord and Telegram channels tied to the services they were using.