SKN | ZachXBT Exposes $1 Billion Crypto Laundering Network Linked to Lazarus Group

Key Takeaways

• Blockchain investigator ZachXBT says a Chinese organized-crime network laundered more than $1 billion in cryptocurrency stolen through exploits linked to North Korea’s Lazarus Group.
• The investigation traced more than $12 million in Bybit-linked funds, while Tether subsequently froze $442,000 in associated USDT.
• The findings highlight the growing importance of on-chain surveillance, stablecoin controls and cross-border enforcement as institutional crypto adoption expands.

Blockchain investigator ZachXBT says he infiltrated a Chinese money-laundering network that allegedly processed more than $1 billion in crypto stolen through multiple exploits for North Korea’s Lazarus Group. The disclosure arrives as the broader digital-asset market remains highly liquid, with total crypto capitalization near $2.93 trillion and daily trading volume approaching $90 billion, increasing the importance of effective controls against illicit flows.

A $350,000 Undercover Operation

ZachXBT said he began interacting with the network in February 2025, shortly after the $1.5 billion Bybit hack. Posing as a customer, he deployed approximately $349,700 in stablecoins and accepted a 5% loss on each transaction to establish credibility with an operator using the alias Jimmy Green.

The investigation reportedly identified more than $12 million in funds connected to the Bybit exploit. Tether later froze $442,000 in USDT associated with wallets identified through the intelligence, demonstrating how information gathered outside conventional law-enforcement channels can translate into direct asset controls.

Why the Laundering Pipeline Matters

The alleged network reportedly operated across Hong Kong and mainland China and handled funds from multiple crypto exploits. ZachXBT said the operator provided information about addresses and laundering methods, including movements across different chains and assets.

The scale is significant relative to the broader security problem. Chainalysis has estimated that North Korean hackers stole at least $6.75 billion in digital assets through 2025. The alleged $1 billion laundering network therefore represents a substantial portion of the illicit liquidity associated with the country’s crypto operations, although the $1 billion figure remains an investigative claim rather than a judicial finding.

Compliance Becomes a Market Infrastructure Issue

For institutional investors, the case reinforces that blockchain transparency does not automatically prevent illicit finance. Instead, identifying suspicious activity increasingly depends on combining public transaction data with wallet attribution, exchange intelligence and real-time monitoring.

Stablecoins are particularly important because they provide deep liquidity for moving value between platforms and networks. Bitcoin currently trades around $85,500 with a market capitalization of roughly $1.7 trillion, while total crypto market volume is close to $90 billion per day. At that scale, effective screening mechanisms can affect not only compliance costs but also the ability of legitimate institutions to interact with digital-asset markets.

Strategic Outlook for Crypto Security

ZachXBT’s investigation adds another layer to the industry’s understanding of how sophisticated laundering networks connect hackers, intermediaries and liquid crypto markets. The next stage will likely involve further wallet freezes, law-enforcement investigations and scrutiny of the intermediaries allegedly facilitating these transactions. For professional investors, the episode underscores that counterparty risk and transaction monitoring are becoming increasingly important components of institutional crypto market infrastructure.