Chinese Syndicate Laundered $1B in Stolen Crypto for North Korea
Blockchain investigator ZachXBT has uncovered a sophisticated money laundering operation run by a Chinese organized crime syndicate. According to his findings, the network laundered over $1 billion in stolen cryptocurrency for North Korea’s Lazarus Group. ZachXBT, who posed as a client in February 2025, infiltrated the operation just days after the Bybit hack. He transferred $349,700 in stablecoins, taking a 5% loss on each transaction to gain the trust of a key operator known as “Jimmy Green.”
The investigation revealed that the laundering activities spanned Hong Kong and mainland China. ZachXBT identified a cluster of more than $12 million in Bybit-linked funds, with Tether later freezing $442,000 in associated USDt (USDT). This case provides rare insight into the intermediaries facilitating North Korea’s crypto thefts, which have reached at least $6.75 billion through 2025, according to Chainalysis.
North Korean hackers are known to use complex laundering methods, including chain-hopping and token swapping through decentralized exchanges and bridges. Chinese intermediaries play a crucial role in this process. In 2020, U.S. prosecutors charged two Chinese nationals for laundering over $100 million stolen by North Korean hackers from a cryptocurrency exchange in 2018. Additionally, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two crypto traders in 2023 for aiding the DPRK in converting stolen crypto.
ZachXBT has also linked Chinese actors to the laundering of funds from the $387.5 million Bitget exploit in September 2025. He noted that these actors were openly seeking support in public Discord and Telegram channels. One operator was previously involved in laundering funds from the $292 million Kelp DAO exploit in April 2025.