ZachXBT Accuses Chinese Network of Laundering $1B for North Korea's Lazarus Group

Blockchain investigator ZachXBT has accused a Chinese crime network of laundering over $1 billion in stolen cryptocurrency for North Korea's Lazarus Group, including funds from the February 2025 Bybit hack. ZachXBT claimed he infiltrated the network by posing as a client and fronting $349,700 in USDC to gain the trust of an operator named "Jimmy Green." The investigation traced more than $12 million in Bybit-linked funds and led to the freezing of 442,000 USDT by Tether.

ZachXBT detailed the operation in an October 5 thread on X, revealing that Green described a network spanning Hong Kong and mainland China. The investigator noted that Green discussed movements of stolen funds, including shifts to Solana (SOL), a day before they occurred. The operation involved multiple crypto assets, including Bitcoin (BTC), Ether (ETH), and Tron (TRX).

Authorities have not publicly confirmed the network's size or identified the operator. ZachXBT also linked Chinese actors to the $387.5 million Bitget exploit in September 2026 and the $292 million Kelp DAO exploit in April 2026. Meanwhile, Chainalysis reported a 43-fold increase in peer-to-peer stablecoin transfers in China between Q1 2024 and Q2 2026, despite Beijing's tightened restrictions on crypto trading.

The Bybit hack in February 2025 resulted in the loss of about $1.5 billion in Ether and related tokens, then labeled the largest single theft in crypto history. The FBI attributed the attack to North Korean actors tracked as TraderTraitor. Chainalysis estimated that North Korean hackers stole $2.02 billion in crypto during 2025, with the Bitget theft pushing their 2026 total above $1 billion.