North Korea Laundered $1.5 Billion from Bybit Hack Through Telegram and Discord

The February 2025 hack of the Bybit platform, attributed to the North Korea-linked group << TraderTraitor >>, remains one of the largest cryptocurrency heists ever recorded, with an estimated $1.5 billion in damages. Crypto investigator ZachXBT traced the stolen funds through public groups on Telegram and Discord, where more than 15 accounts sought help with transactions linked to the hack. Among them was a Telegram user known as << Jimmy Green >>, who ZachXBT engaged in a series of transactions to gain trust.

ZachXBT credited an Ethereum address with 349,700 USDC to facilitate transactions with Jimmy Green, who then sent stablecoins back via the Tron network. The investigator discovered that the address provided by Jimmy Green was funded by another address directly traceable to the Bybit hack. Over time, Jimmy Green revealed details about the laundering operations, including the movement of funds through various networks such as BTC → ETH → SOL → Tron.

Jimmy Green also disclosed that his team had laundered most of the $1.5 billion stolen from Bybit, matching patterns observed by ZachXBT. The investigation uncovered a cluster of over $12 million from the hack, with 442,000 USDT linked to this cluster later frozen by Tether. Additionally, ZachXBT identified a new laundering method using Uniswap liquidity pools associated with illiquid tokens.

All collected data was transmitted to law enforcement, contributing to the freezing of over $75 million in funds linked to incidents involving North Korea. ZachXBT's work highlights the sophisticated methods used by hackers to launder stolen cryptocurrency and the importance of ongoing investigations to combat such activities.