Chinese crime network laundered over $1B for Lazarus: ZachXBT

A pseudonymous blockchain investigator known as ZachXBT said he infiltrated a Chinese organized crime syndicate that laundered more than $1 billion in cryptocurrency stolen by North Koreas Lazarus Group. In an Oct. 5 thread on X, ZachXBT described posing as a paying customer days after the Bybit breach in 2025, using $349,700 in stablecoins and accepting a 5% loss on orders to gain the confidence of a network operator identified as "Jimmy Green."

According to ZachXBT, the syndicates operations covered both Hong Kong and mainland China. Information he obtained from the alleged launderer pointed to a cluster of over $12 million connected to the Bybit theft; Tether later froze about $442,000 in USDt tied to those addresses. The account provides a rare, on-the-ground view of intermediaries who convert and move DPRK-linked stolen funds.

The report aligns with known laundering techniques attributed to North Korean-linked actors, who commonly employ multi-stage processes such as chain-hopping, token swaps, decentralized exchanges and cross-chain bridges to obfuscate fund flows. ZachXBT also linked Chinese actors to laundering activity following other significant breaches: he reported connections to the $387.5 million Bitget exploit in September and said one operator had been involved in laundering proceeds from a $292 million exploit of Kelp DAO in April.

This account follows a broader history of alleged Chinese intermediaries assisting DPRK-related thefts: U.S. prosecutors charged two Chinese nationals in 2020 over laundering more than $100 million stolen by North Korean hackers in 2018, and the U.S. Treasurys OFAC sanctioned two crypto traders in 2023 for helping the DPRK convert stolen crypto and evade financial controls. Chainalysis data cited in the source places total DPRK-linked crypto thefts at least $6.75 billion through 2025.