Chinese Syndicate Allegedly Laundered Over $1B for Lazarus Group
Vexoda Newsroom
Blockchain investigator ZachXBT claims a Chinese organized crime network laundered more than $1 billion in stolen cryptocurrency for North Korea's Lazarus Group, detailing infiltration methods and fun
A significant revelation from blockchain investigator ZachXBT alleges that a sophisticated Chinese crime syndicate has been instrumental in laundering over $1 billion in stolen digital assets for North Korea's notorious Lazarus Group. ZachXBT detailed how he infiltrated this money laundering network by posing as a customer, a strategy that reportedly allowed him to gain crucial insights into the illicit operations. This infiltration occurred in February 2025, shortly after a major hack, and involved the investigator depositing a substantial sum in stablecoins to build trust with a key operator known as "Jimmy Green."
The investigation pinpointed the scope of these laundering activities as spanning across Hong Kong and mainland China, highlighting a complex cross-border criminal enterprise. Information gathered during the infiltration helped ZachXBT trace a significant portion of funds linked to the $1.5 billion Bybit hack, leading to the subsequent freezing of over $442,000 in Tether (USDT) by the stablecoin issuer. This detailed tracing provides rare transparency into the alleged intermediaries facilitating North Korea's cryptocurrency theft and subsequent financial activities.
North Korea's Lazarus Group has a well-documented history of crypto-related illicit activities, with estimates suggesting they have stolen upwards of $6.75 billion in digital assets through 2025 alone. These sophisticated hacking groups often employ multi-stage laundering techniques, including rapid "chain-hopping" and "token swapping" across decentralized exchanges and cross-chain bridges. The goal of these complex maneuvers is to obscure the origin and flow of illicit funds, making them exceedingly difficult to track and recover by law enforcement agencies.
The role of Chinese intermediaries in this process has become increasingly prominent. Previous indictments and sanctions by U.S. authorities have targeted Chinese nationals for their involvement in laundering hundreds of millions of dollars stolen by North Korean hackers. In 2023, the U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned individuals from Hong Kong and China for allegedly facilitating North Korea's conversion of stolen crypto and helping them evade international financial sanctions.
ZachXBT's latest findings also connect Chinese actors to the laundering of funds from other major exploits, including the $387.5 million Bitget hack in September 2025. It is alleged that individuals involved in these operations were openly soliciting support for their laundering activities in public online forums and chat groups. Furthermore, one of these operators is reportedly linked to the laundering of funds from the $292 million Kelp DAO exploit that occurred earlier in April 2025, underscoring the persistent involvement of these actors in various high-profile hacks.
The market reaction to such revelations is typically indirect, as direct links between specific laundering operations and immediate price movements are hard to establish. However, repeated instances of large-scale crypto theft and sophisticated laundering by state-sponsored or organized crime groups can erode confidence in the overall security and regulatory oversight of the digital asset space. Traders should remain vigilant, monitoring news regarding regulatory crackdowns on illicit finance in crypto, international cooperation against cybercrime, and the ongoing effectiveness of tracing tools used by investigators.
Source: Cointelegraph. Summarized and rewritten by the Vexoda Newsroom. This is market news, not financial advice.