On-chain investigator ZachXBT has published findings alleging that a Chinese crime network laundered over $1 billion for Lazarus Group. The North Korea-linked hacking organization has been tied to some of the largest cryptocurrency thefts in recent years.
According to the reporting, ZachXBT traced funds stolen in the Bybit hack through a web of wallets and intermediaries. That trail eventually led investigators to the alleged Chinese laundering network. The analysis suggests this group has served as a key conduit for moving stolen crypto into usable funds.
Lazarus Group has long been associated with North Korea's state-sponsored cyber operations. Security researchers and government agencies have previously linked the group to billions of dollars in stolen digital assets. Those funds are widely believed to support the country's weapons programs, according to prior assessments from international bodies.
ZachXBT has built a reputation for tracing illicit crypto flows using public blockchain data. The investigator has previously exposed laundering schemes, exchange hacks, and scam operations. This latest investigation adds to a growing body of work documenting how stolen funds move from initial theft to final cash-out.
The Bybit hack earlier this year was one of the largest crypto exchange breaches on record. Investigators and blockchain analytics firms worked to track the flow of stolen assets in the aftermath. ZachXBT's latest report builds on that earlier tracing work, connecting the stolen funds to a broader laundering infrastructure allegedly run by a criminal network based in China.
The scale of the alleged laundering, over $1 billion, underscores the sophistication of networks supporting state-linked hacking groups. Laundering operations of this size typically require coordination across multiple jurisdictions, exchanges, and payment rails. They often blend crypto conversion with traditional financial channels to obscure the origin of funds.
This case also illustrates the ongoing challenge facing exchanges and regulators. Stolen funds can move quickly across chains and jurisdictions before compliance teams can freeze them. Open-source investigators like ZachXBT have increasingly filled gaps left by slower institutional responses, publishing findings that draw attention to specific wallets and networks.
Market Impact
The report is unlikely to move crypto prices directly, but it reinforces concerns about exchange security and the persistence of state-linked hacking groups. Exchanges may face renewed pressure to strengthen withdrawal monitoring and work more closely with blockchain analytics firms following high-profile breaches like the Bybit hack.
Regulators and compliance teams are likely to scrutinize laundering networks named in such investigations. Increased attention could lead to targeted sanctions, exchange blacklisting of flagged wallets, or further cooperation between global law enforcement agencies tracking Lazarus Group activity.
The findings add to a growing record of Lazarus Group's reliance on organized laundering networks to convert stolen crypto into usable funds. As investigators continue tracing these flows, pressure is likely to build on exchanges and regulators to close the gaps that allow such large-scale laundering to persist.
Frequently Asked Questions
Who is ZachXBT?
ZachXBT is a pseudonymous blockchain investigator known for tracing stolen crypto funds and exposing laundering networks and scams using on-chain data.
What is Lazarus Group?
Lazarus Group is a North Korea-linked hacking organization tied to numerous major cryptocurrency thefts and cyberattacks over the past several years.
How does this relate to the Bybit hack?
ZachXBT reportedly traced funds stolen in the Bybit hack through a series of transactions that led to the alleged Chinese laundering network tied to Lazarus Group.
What happens to funds once they are laundered?
Laundered crypto funds are typically converted through exchanges, intermediaries, or other financial channels to obscure their origin before being used or cashed out.