Audit log

Every state-changing event for Lazarus Group Chinese Money Laundering Syndicate: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-11 12:10:18Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 455,646,389

   sig

   3dRPHfevodqe…qVUbmPmWcopyexplorer ↗

   hash

   BS2KYQ2tULQJ…txnpau7scopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (14112 B) ▸

   {"actor":"system:backfill","investigation_id":"7204217e-068f-4dfe-bf53-8a6d2260f620","kind":"publish","page_slug":"lazarus-group-chinese-money-laundering-syndicate","published_at":"2026-10-11T12:10:18.113Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Lazarus Group Chinese Money Laundering Syndicate","sections":[{"content":"On October 5, 2026, pseudonymous blockchain investigator ZachXBT published a multi-part thread on X stating that he had infiltrated an alleged Chinese organized crime network that laundered more than $1 billion in cryptocurrency across multiple thefts attributed to North Korea's Lazarus Group, including a large portion of the $1.5 billion stolen from Bybit in February 2025. ZachXBT said the operation began after he noticed more than 15 accounts in public Telegram and Discord groups soliciting help processing orders tied to the stolen Bybit funds. These figures are ZachXBT's own assessment; they have not been independently confirmed by law enforcement or by Bybit, and coverage of the claim describes it consistently as his allegation rather than an established fact. The February 2025 Bybit theft itself was attributed to a North Korea-linked group the FBI calls 'TraderTraitor' in a public service alert.","heading":"Core allegation: a laundering network for Lazarus Group","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"},{"credibility":1,"name":"FBI PSA: North Korean cyber actors responsible for theft of approximately $1.5 billion in virtual assets from Bybit (I-022625-PSA)","type":"regulatory","url":"https://ic3.gov/PSA/2025/PSA250226"}]},{"content":"ZachXBT says he posed as a paying client to a vendor operating under the alias 'Jimmy Green,' who allegedly converted USDC to USDT for clients seeking to move stolen funds. On March 6, 2025, ZachXBT funded a new Ethereum address with 349,700 USDC and began transacting with Jimmy, accepting an alleged 5% loss on each order to build trust. ZachXBT said the receiving address Jimmy supplied had been gas-funded by a wallet directly traceable to Bybit exploit funds and that it appeared on a public exchange blacklist. He said Jimmy discussed moving Bybit funds for North Korea in advance of transfers occurring, including correctly predicting a move of funds to Solana that occurred the following day, and described laundering operations spanning Hong Kong and mainland China. On March 10, 2025, Jimmy allegedly said his team had 'prepared $1 million' and was ready to work; on March 12, 2025, ZachXBT matched a cross-chain bridging screenshot Jimmy sent to a corresponding THORChain order. ZachXBT has stated Jimmy claimed his team laundered 'most' of the $1.5 billion stolen from Bybit — a claim that remains unverified and attributed solely to the alleged operator's own statements to an undercover source.","heading":"Undercover methodology: the 'Jimmy Green' contact","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"}]},{"content":"ZachXBT says three Solana addresses supplied by 'Jimmy' helped him identify a cluster of more than $12 million in Bybit-exploit funds moving across Bitcoin, Ethereum, Solana, and Tron. Tether subsequently froze 442,000 USDT linked to that cluster. ZachXBT also said Jimmy's claim of roughly $300,000 frozen from his operation in 2024 corresponded to an on-chain freeze of 332,000 USDC tied to the November 2023 Poloniex hack, which researchers have separately linked to Lazarus Group. The $12 million figure represents funds ZachXBT says he traced, not funds confirmed seized or recovered; only the 442,000 USDT figure is attributed to a confirmed third-party (Tether) freeze action. No arrests, indictments, or sanctions related specifically to this network or to 'Jimmy Green' have been publicly reported as of this writing.","heading":"Traced funds and freezes","severity":"high","sources":[{"credibility":2,"name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"},{"credibility":2,"name":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group","type":"news_article","url":"https://cryptoslate.com/zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group/"}]},{"content":"ZachXBT says 'Jimmy' separately claimed to have laundered $3 million in fraud proceeds for another client, and that ZachXBT traced those funds to a hot wallet used by Huione Guarantee, a Telegram-based marketplace that U.S. authorities (FinCEN) have alleged was used to launder billions of dollars in fraud and scam proceeds tied to a Cambodian conglomerate. Telegram banned the Huione Guarantee marketplace in May 2025. This alleged connection between the network ZachXBT describes and Huione Guarantee has not been independently confirmed beyond ZachXBT's own tracing.","heading":"Alleged link to Huione Guarantee","severity":"high","sources":[{"credibility":2,"name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"}]},{"content":"ZachXBT says he shared his findings with trusted private-sector investigators and with law enforcement personnel assigned to cases involving North Korean (DPRK) cryptocurrency theft, and that he delayed public disclosure of the operation due to its sensitivity. No law enforcement agency has publicly confirmed, corroborated, or commented on the specific network, operator alias, or $1 billion figure described by ZachXBT. He has stated that, since 2022, he has helped facilitate the freezing of more than $75 million in funds related to DPRK-linked incidents, a cumulative figure that is also self-reported and not independently audited in available reporting.","heading":"Law enforcement engagement and disclosure timing","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"ZachXBT Posed As Client To Map Chinese Money Laundering Network","type":"news_article","url":"https://www.crowdfundinsider.com/2026/10/316065-zachxbt-posed-as-client-to-map-chinese-money-laundering-network-that-allegedly-laundered-1b-for-north-koreas-lazarus-group/"}]},{"content":"Every significant claim about this network — its existence, its $1 billion-plus laundering volume, the identity and conduct of 'Jimmy Green,' and the specific involvement of contacts in Hong Kong and mainland China — originates from ZachXBT's own account of an undercover operation he conducted and self-funded, rather than from law enforcement, court filings, or on-chain evidence independently published by a third party. Multiple crypto-news outlets (The Block, Decrypt, CryptoSlate, Crowdfund Insider, 247wallst) reported his claims consistently but frame them explicitly as allegations, and note the $1 billion and $1.5 billion figures used across different outlets are inconsistent, and that no government agency has confirmed the network's size or the operator's identity. ZachXBT himself acknowledged uncertainty in the operation, stating there was no guarantee his contact would not disappear with funds. Readers should treat the network's scale and structure as unverified pending independent confirmation.","heading":"Verification status and limits of the evidence","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group","type":"news_article","url":"https://cryptoslate.com/zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group/"},{"credibility":2,"name":"A Chinese Network Laundered More Than $1 Billion for North Korea's Lazarus Group, Says ZachXBT","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/06/a-chinese-network-laundered-more-than-1-billion-for-north-koreas-lazarus-group-says-zachxbt/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"},{"credibility":2,"name":"ZachXBT infiltrates $1B crypto syndicate to expose Lazarus Group","type":"news_article","url":"https://cryptoslate.com/zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group/"},{"credibility":2,"name":"ZachXBT Posed As Client To Map Chinese Money Laundering Network","type":"news_article","url":"https://www.crowdfundinsider.com/2026/10/316065-zachxbt-posed-as-client-to-map-chinese-money-laundering-network-that-allegedly-laundered-1b-for-north-koreas-lazarus-group/"},{"credibility":2,"name":"A Chinese Network Laundered More Than $1 Billion for North Korea's Lazarus Group, Says ZachXBT","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/06/a-chinese-network-laundered-more-than-1-billion-for-north-koreas-lazarus-group-says-zachxbt/"},{"credibility":1,"name":"FBI PSA: North Korean cyber actors responsible for theft of approximately $1.5 billion in virtual assets from Bybit (I-022625-PSA)","type":"regulatory","url":"https://ic3.gov/PSA/2025/PSA250226"}],"summary":"An alleged Chinese organized-crime network, described by on-chain investigator ZachXBT as having laundered more than $1 billion in cryptocurrency stolen by North Korea's Lazarus Group — including a large share of the $1.5 billion February 2025 Bybit hack — through contacts in Hong Kong and mainland China. The network's existence, scale, and key operator alias ('Jimmy Green') rest almost entirely on ZachXBT's own account of a months-long undercover operation disclosed publicly on October 5, 2026; no law enforcement agency has independently confirmed the network's size, identity, or structure, though his data reportedly contributed to a Tether freeze of $442,000 USDT and a cluster of more than $12 million in traced Bybit-linked funds.","timeline":[{"date":"2025-02","event":"Bybit suffers a theft of approximately $1.5 billion in virtual assets, later attributed by the FBI to a North Korea-linked actor it calls 'TraderTraitor.'","source":"FBI/IC3 Public Service Announcement I-022625-PSA","source_url":"https://ic3.gov/PSA/2025/PSA250226"},{"date":"2025-03-06","date_evidence":"On March 6, 2025, ZachXBT funded the address with 349.7K USDC.","event":"ZachXBT funds a new Ethereum address with 349,700 USDC to begin transacting with an alleged laundering operator using the alias 'Jimmy Green.'","source":"Decrypt","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"},{"date":"2025-03","date_evidence":"On March 10, Jimmy said the team had \"prepared $1 million\" and was ready to work.","date_original":"2025-03-10","event":"Alleged operator 'Jimmy Green' tells ZachXBT his team has prepared $1 million and is ready to process further orders.","source":"Decrypt","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"},{"date":"2025-03","date_evidence":"On March 12, ZachXBT matched a bridging screenshot Jimmy sent to an order using the Thorchain explorer.","date_original":"2025-03-12","event":"ZachXBT matches a cross-chain bridging screenshot sent by 'Jimmy Green' to a corresponding THORChain order, corroborating the operator's access to the funds.","source":"Decrypt","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"},{"date":"2025-05","date_evidence":"Telegram banned the Huione Guarantee marketplace in May 2025.","event":"Telegram bans the Huione Guarantee marketplace, which ZachXBT later alleges received funds traced through the same network.","source":"Decrypt","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers?amp=1"},{"date":"2026-10-05","date_evidence":"ZachXBT published a 12-part thread on X on October 5, 2026","event":"ZachXBT publicly discloses the infiltration operation and his findings in a thread on X.","source":"CryptoSlate","source_url":"https://cryptoslate.com/zachxbt-infiltrates-1b-crypto-syndicate-to-expose-lazarus-group/"},{"date":"2026-10","date_original":"2026-10-06","event":"Crypto news outlets including The Block, Decrypt, and CryptoSlate report on ZachXBT's disclosure and the alleged $1 billion-plus Chinese laundering network tied to Lazarus Group.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision af99fdfd-b7c2-476c-bdda-a9f267183130copy