Chinese Crypto Laundering Syndicate (Lazarus-Linked, 'Jimmy Green' Network)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3tQmXs…zajDSummary
A Chinese organized crime syndicate operating across Hong Kong and mainland China has allegedly laundered over $1 billion in stolen cryptocurrency on behalf of North Korea's Lazarus Group, according to blockchain investigator ZachXBT, who disclosed on October 5, 2026 that he spent months undercover posing as a client to map the network's operations. The investigation produced actionable intelligence shared with law enforcement and led to Tether freezing $442,000 in associated USDT linked to Bybit hack proceeds. As of the disclosure date, no criminal charges have been publicly announced against any identified members of the network.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(12 events)
1 November 2023
Poloniex exchange hack occurs; 332,000 USDC later traced to the same Chinese laundering network per ZachXBT's 2026 disclosure.
CoinTelegraph / ZachXBT disclosure1 January 2024
OFAC sanctions two crypto traders — one based in Hong Kong and one in mainland China — for allegedly laundering DPRK-stolen assets, providing regulatory context for the network's operating environment.
CoinTelegraph / ZachXBT disclosure1 March 2024
Prior freeze of approximately $300,000 verified during ZachXBT's later investigation, connected to the same network.
Cryptopolitan21 February 2025
Bybit exchange hacked; approximately $1.5 billion in cryptocurrency stolen via a Safe{Wallet} supply-chain attack. FBI later confirms attribution to North Korea's Lazarus Group (TraderTraitor).
The Hacker News / Picus Security1 March 2025
ZachXBT begins undercover operation, funding a new Ethereum address with 349,700 USDC and engaging network operator 'Jimmy Green' as a paying client to map the laundering infrastructure.
The Block1 March 2025
Jimmy Green shares three Solana addresses that expose a cluster of $12 million-plus in Bybit-linked funds being swapped in real time across Bitcoin, Ethereum, Solana, and Tron.
The Block1 March 2025
Tether freezes approximately $442,000 in USDT associated with the wallet cluster identified by ZachXBT's undercover operation.
Protos1 October 2025
U.S. Treasury OFAC sanctions Huione Group (Cambodian-linked marketplace connected to the laundering network) for allegedly enabling $70 billion in crypto money laundering.
KuCoin News / Treasury records1 April 2026
Kelp DAO hack results in approximately $292 million in losses. A network operator using the alias 'lolo' is later alleged by ZachXBT to have handled proceeds from this exploit.
ZachXBT disclosure via Cryptopolitan1 September 2026
Bitget exchange hacked; approximately $387.5 million stolen. ZachXBT subsequently alleges the same Chinese syndicate was engaged to launder the proceeds, with Elliptic identifying reuse of established routing patterns.
Cryptopolitan5 October 2026
ZachXBT publishes a 12-part thread on X disclosing the full scope of his undercover investigation into the Chinese laundering syndicate, having previously shared findings with law enforcement.
The Block / CoinTelegraph / Protos6 October 2026
Major crypto press (CoinTelegraph, The Block, Protos, Cryptopolitan, 24/7 Wall St.) publish coverage of ZachXBT's disclosure. No criminal charges announced as of this date.
Multiple outletsDecision Log
- slot 454217673 · hash B22xKJukUAHEbh1NNoQeMxjcetsEtBTqp8a9scEkGr6U
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 8 of 12 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/7/2026, 12:03:56 PM
last updated: 10/7/2026, 12:08:03 PM
avoid.net — verified advice for a post-truth world