Blockchain investigator ZachXBT says he infiltrated a Chinese crime network that laundered more than $1 billion in stolen cryptocurrency for North Korea's Lazarus Group, according to a disclosure posted on X. The operation moved funds across China and Hong Kong sourced from multiple cryptocurrency exchange exploits.
ZachXBT posed as a paying client in February 2025 to gain access to the network's operations. His investigation traced more than $12 million in funds linked to the Bybit exchange hack through the laundering pipeline. Tether froze $442,000 in USDT connected to the identified activity after receiving intelligence from ZachXBT's work.
The Lazarus Group has been attributed by law enforcement and blockchain firms to North Korea's government and has conducted some of the largest cryptocurrency thefts in the industry. Chainalysis, a blockchain analysis firm, estimates North Korean hackers have stolen at least $6.75 billion cumulatively through 2025, making state-sponsored theft a persistent threat to exchange security.
Crypto laundering networks typically operate by breaking large sums into smaller amounts, routing them through multiple wallets and exchanges, and converting them into fiat currency or privacy-focused tokens. Chinese networks have emerged as critical nodes in this infrastructure because of China's large unregulated peer-to-peer cryptocurrency markets and its role as a global financial hub.
ZachXBT's investigation into a single network accounted for roughly 15 percent of Chainalysis's total estimate for all North Korean theft through 2025. The Bybit hack, disclosed in December 2024, was one of several major exchange breaches attributed to North Korean actors in recent years.
ZachXBT's method of posing as a client to gain operational visibility is uncommon in the typically anonymous world of blockchain investigation. Most tracing relies on analyzing public transaction records and wallet clustering rather than direct infiltration. Tether's willingness to freeze funds based on his intel indicates the stablecoin issuer maintains active monitoring channels with independent researchers.
The identification of a single network handling over $1 billion for a state-sponsored actor means North Korean actors may retain access to substantially more stolen capital than publicly accounted for if this network represents one major operation among several in China.
