Skip to content

Back to the catalog

Chinese network laundered $1B+ for North Korea's Lazarus Group — ZachXBT
247wallst.comarticle

Chinese network laundered $1B+ for North Korea's Lazarus Group — ZachXBT

Blockchain investigator ZachXBT published a 12-part thread detailing how he spent months posing as a client of a Chinese money-laundering network to prove it laundered over $1 billion for North Korea's Lazarus Group, including a large share of the ~$1.5 billion Bybit hack (FBI codename TraderTraitor). He cross-referenced the operators' private messages with on-chain data — including a wallet receiving fees from Bybit-hack-linked addresses and THORChain bridge transfer timing/amounts matching what operators disclosed — turning chat screenshots into verifiable blockchain evidence. The laundering network converted BTC into ETH, Solana and Tron, used THORChain for cross-chain hops, and parked funds in low-volume Uniswap pools; the investigation led Tether to freeze 442,000 USDT, part of over $75 million ZachXBT claims to have gotten frozen from North Korea-linked hacks since 2022.

TL;DR ZachXBT went undercover for months to expose a Chinese network that laundered $1B+ of Lazarus Group's stolen crypto, including Bybit hack funds, via THORChain and Uniswap.
Open original ↗

Technologies named here

Techniques named here

  • Cross-chain conversion and bridging
  • Low-volume token pool parking
  • Undercover client infiltration
  • On-chain forensic correlation

Threat actors named here

Related in Threat Intel