Chinese Crime Network Laundered Over $1B for Lazarus Group

ZachXBT, a pseudonymous blockchain investigator, says a Chinese organized‑crime syndicate moved over $1 billion of crypto stolen in several high‑profile hacks for North Korea’s Lazarus Group. The investigator infiltrated the laundering network in February 2025, posing as a paying client and depositing $349,700 in stablecoins, taking a 5 % loss on each order to gain the trust of an operator known as “Jimmy Green.”

Infiltration and Trust Building

The operation spanned Hong Kong and mainland China. By mimicking a legitimate customer, ZachXBT obtained internal details that later helped trace a cluster of more than $12 million linked to the $1.5 billion Bybit hack. Tether subsequently froze $442,000 of associated USDT.

Broader Laundering Landscape

North Korean hackers have stolen at least $6.75 billion in digital assets through 2025, according to Chainalysis. Chinese intermediaries have repeatedly surfaced as key conduits, with U.S. prosecutors charging two Chinese nationals in 2020 for laundering over $100 million from a 2018 exchange breach. In 2023, OFAC sanctioned two crypto traders—one in Hong Kong, one in China—for facilitating DPRK crypto conversions.

Additional Exploits Linked to the Network

ZachXBT also tied Chinese actors to the laundering of funds from the $387.5 million Bitget exploit (September 2023) and the $292 million Kelp DAO exploit (April 2024). Operators were reportedly seeking assistance on public Discord and Telegram channels.

Key facts

• Chinese crime syndicate laundered > $1 B for Lazarus Group.
• Investigator deposited $349,700 stablecoins, took 5 % loss to build trust.
• Traced $12 M of Bybit‑linked funds; Tether froze $442,000 USDT.
• North Korean hackers’ total thefts hit $6.75 B by 2025.
• Prior U.S. actions: 2020 charges ($100 M) and 2023 OFAC sanctions.