The tweet was deleted by the author.
But we saved everything 🙂.
Chinese crime network launders over $1 billion for Lazarus Group
A Chinese organized crime group helped launder more than $1 billion in cryptocurrency stolen through multiple hacks linked to North Korea’s Lazarus Group, according to blockchain investigator ZachXBT.
According to him, in February 2025, just days after the Bybit hack, he infiltrated the money laundering network by posing as a client. To gain the trust of one of the operators, known as Jimmy Green, the investigator provided $349,700 in stablecoins and accepted a 5% loss on each transaction.
View post on X Loading...
ZachXBT said the network operated across Hong Kong and mainland China. Information obtained from the intermediary helped him identify a cluster of addresses through which more than $12 million linked to the Bybit hack had moved. Tether later froze $442,000 in USDT held in associated wallets.
The investigation provides insight into the intermediary networks North Korean hackers may use to move stolen cryptocurrency. According to Chainalysis, hackers linked to North Korea had stolen at least $6.75 billion in digital assets by the end of 2025.
How North Korea launders stolen cryptocurrency
North Korean hackers typically use multi-stage schemes designed to make the movement of funds harder to trace. Cryptocurrency is transferred across different blockchains, swapped through decentralized exchanges and routed through bridges and other services.
Chinese intermediaries may play an important role in such schemes. In 2020, U.S. prosecutors charged two Chinese nationals suspected of laundering more than $100 million stolen by North Korean hackers from a cryptocurrency exchange in 2018.
In 2023, the U.S. Treasury Department’s Office of Foreign Assets Control imposed sanctions on two crypto traders from Hong Kong and China. According to U.S. authorities, they helped North Korea convert stolen cryptocurrency and bypass financial restrictions.
Chinese intermediaries also linked to Bitget hack
ZachXBT also linked Chinese participants in similar schemes to the laundering of funds following the $387.5 million Bitget hack in September.
According to him, people allegedly helping North Korean hackers move the funds were openly seeking technical support in public Discord servers and Telegram channels run by the services they used.
The investigator also claimed that one of the operators had previously been involved in laundering funds from the $292 million Kelp DAO hack in April.
What Lazarus Group is known for
Lazarus Group is considered one of the best-known hacking groups linked to North Korea. It has been active since at least the early 2010s and gained widespread attention following attacks on major companies, banks and government organizations. Among its most high-profile cases were the 2014 Sony Pictures hack and its involvement in the global WannaCry ransomware campaign in 2017.
Lazarus Group later shifted more of its focus toward the cryptocurrency industry. The group has been linked to attacks on exchanges, blockchain projects and cross-chain bridges, including some of the largest crypto thefts in recent years. U.S. authorities have repeatedly connected Lazarus Group’s activities with North Korea’s efforts to obtain foreign currency while circumventing international sanctions.
Lazarus Group was also linked to the largest DeFi vulnerability of 2026.
This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Subscribe to TU news
Did you like the article?
Latest Bybit News
Top News
Top 5 companies for you
United States
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
Live News
