ZachXBT Exposes Chinese Crime Ring Laundering $1B+ for Lazarus Group

Blockchain investigator ZachXBT has revealed a complex web of crypto laundering linked to North Korea’s Lazarus Group. In an Oct. 5 thread on X, ZachXBT detailed how a Chinese organized crime syndicate laundered over $1 billion stolen in multiple crypto exploits. The investigation highlights the role of intermediaries in facilitating the movement of stolen funds through exchanges and other on-chain routes.

ZachXBT claimed to have infiltrated part of the laundering operation in February 2025, just days after the Bybit hack. By posing as a paying client, he interacted with an intermediary named “Jimmy Green” and provided $349,700 in stablecoins, accepting a 5% loss on each order to build credibility. This undercover approach helped him identify a cluster of more than $12 million tied to Bybit-linked funds. Tether later froze $442,000 in associated USDT.

The broader pattern aligns with previous US and Treasury actions targeting Chinese facilitators for converting stolen crypto. ZachXBT’s findings suggest that intermediaries in financial hubs like Hong Kong and mainland China play a critical role in breaking attribution and converting illicit proceeds into harder-to-trace assets. His thread also references other alleged laundering activities, including the $292 million Kelp DAO exploit and the $387.5 million Bitget exploit.

For investors and compliance teams, the implications are clear: tracing the hack transaction alone may be insufficient. Mapping the intermediary and conversion layers is equally important. The next signal to monitor is whether enforcement and compliance tools continue to respond to identifiable clusters of stolen funds, such as the reported Tether freeze tied to the Bybit-related activity.