thedefiant.ioarticleZachXBT Posed as a Client to Infiltrate Chinese Syndicate Laundering Bybit Hack Funds
Crypto investigator ZachXBT describes posing undercover as a client to infiltrate a Chinese OTC laundering syndicate handling stolen Bybit hack funds linked to North Korea (DPRK). He fronted 349,700 USDC, paid a 5% fee per order, and had the broker tell him in advance where the stolen funds would move next, surfacing operational detail on how DPRK-linked actors cash out stolen crypto through OTC desks.
TL;DR ZachXBT went undercover as a client inside a Chinese OTC network laundering DPRK's stolen Bybit funds, fronting $349,700 USDC to document the cash-out tradecraft.
Techniques named here
- Posing as a client / undercover infiltration
- Money laundering via broker
Threat actors named here
- North Korea
- Chinese syndicate
- DPRK
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup