Verify a decision

{"actor":"system:backfill","investigation_id":"d7c29ca5-98e5-400b-ae76-9af72f5f47b4","kind":"publish","page_slug":"chinese-crypto-laundering-syndicate-lazarus-linked-jimmy-green-network","published_at":"2026-10-07T12:04:08.322Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Chinese Crypto Laundering Syndicate (Lazarus-Linked, 'Jimmy Green' Network)","sections":[{"content":"Blockchain investigator ZachXBT disclosed on October 5, 2026, in a 12-part thread on X (formerly Twitter) that he had spent months embedded inside a Chinese organized crime network he alleges has processed more than $1 billion in stolen cryptocurrency for North Korea's Lazarus Group across multiple exploits spanning 2023 through 2026. The network is alleged to operate across Hong Kong and mainland China and to have serviced multiple major crypto thefts attributed to Lazarus Group, also known as TraderTraitor. ZachXBT stated he held the full account for over 18 months while the operation was live and shared findings with private-sector investigators and law-enforcement personnel assigned to relevant cases before public disclosure. These are allegations by ZachXBT; no court has adjudicated whether the syndicate laundered these specific funds or whether any individual named or implied in the investigation committed the alleged acts.","heading":"Overview and Alleged Scale of Operations","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"Chinese crime network laundered over $1B for Lazarus: ZachXBT — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"credibility":2,"name":"ZachXBT poses as money launderer to infiltrate Lazarus network — Protos","type":"news_article","url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/"}]},{"content":"According to ZachXBT's public disclosure, the undercover operation began in or around March 2025, shortly after the February 21, 2025 Bybit hack. ZachXBT states he funded a new Ethereum wallet with 349,700 USDC and posed as a paying client seeking money-laundering services, making multiple transactions and absorbing a 5% fee per order in order to build trust with a network operator using the alias 'Jimmy Green.' The total personal capital deployed was $349,700 in stablecoins. ZachXBT states he noticed an initial pattern involving more than 15 accounts in Telegram and Discord groups actively soliciting orders tied to stolen funds in the aftermath of the Bybit exploit, which prompted the undercover approach. The investigator states that Jimmy Green's receiving address was gas-funded by a wallet directly traceable to Bybit exploit funds and that the address appeared on Bybit's public exploit blacklist. ZachXBT states he funded his operation through grants from crypto foundations and donations. This account is ZachXBT's own characterization of events; it has not been independently verified by a court or regulatory body.","heading":"ZachXBT's Undercover Methodology","severity":"high","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"ZachXBT poses as money launderer to infiltrate Lazarus network — Protos","type":"news_article","url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/"},{"credibility":2,"name":"ZachXBT Went Undercover With $349,700 to Follow Stolen Bybit Crypto — Blockonomi","type":"news_article","url":"https://blockonomi.com/zachxbt-went-undercover-with-349700-to-follow-stolen-bybit-crypto"}]},{"content":"ZachXBT alleges that the syndicate routed stolen funds across multiple blockchain networks in a multi-step conversion chain: Bitcoin to Ethereum to Solana to Tron. Routing mechanisms cited in reports covering ZachXBT's disclosure include THORChain (a decentralized cross-chain swap protocol) and low-liquidity Uniswap liquidity pools using illiquid tokens as an obfuscation method. Jimmy Green allegedly shared three Solana addresses during the undercover operation, which ZachXBT states exposed a cluster of more than $12 million in Bybit-linked funds being swapped in real time. A connection to Huione Guarantee, a Cambodian-linked marketplace that was sanctioned by the U.S. Treasury's OFAC in 2025 for enabling an alleged $70 billion in crypto money laundering, is also noted in reporting on ZachXBT's disclosure. One member of the network was additionally alleged to have moved $3.9 million in Zcash to the Ironwood shielded pool as a privacy measure. These routing details are drawn from ZachXBT's own account and secondary reporting; no independent technical audit or court record has been published to corroborate the specific routing claims.","heading":"Alleged Laundering Infrastructure and Routing Techniques","severity":"critical","sources":[{"credibility":2,"name":"Chinese crime network laundered over $1B for Lazarus: ZachXBT — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"credibility":2,"name":"ZachXBT exposes the laundering network behind the Bybit and Bitget hacks — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/"},{"credibility":2,"name":"US Treasury Sanctions Huione Group for Enabling $70B in Crypto Money Laundering — KuCoin News","type":"regulatory","url":"https://www.kucoin.com/news/flash/us-treasury-sanctions-huione-group-for-enabling-70b-in-crypto-money-laundering"}]},{"content":"The February 21, 2025 hack of Bybit — attributed by the FBI to North Korea's Lazarus Group — resulted in approximately $1.5 billion in stolen cryptocurrency, making it the largest crypto exchange theft on record at the time. The FBI confirmed attribution to the DPRK-linked TraderTraitor group. ZachXBT states his undercover operation began in the weeks immediately following the Bybit hack and that his intelligence helped identify a $12 million-plus cluster of Bybit-linked funds. That intelligence was shared with investigators and contributed to Tether freezing approximately $442,000 in USDT associated with the identified wallet cluster. Bybit's own published exploit blacklist is cited as independently corroborating the connection between Jimmy Green's receiving address and the hack's proceeds. The Bybit hack itself is an established fact confirmed by the exchange, the FBI, and multiple Tier 1 and Tier 2 sources; the specific link between the Chinese syndicate and those proceeds is ZachXBT's allegation, corroborated in part by the Tether freeze.","heading":"Connection to the Bybit Hack (February 2025)","severity":"critical","sources":[{"credibility":2,"name":"FBI Confirms North Korean Lazarus Group Behind $1.5 Billion Bybit Crypto Heist — Picus Security","type":"news_article","url":"https://www.picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist"},{"credibility":2,"name":"Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html"},{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"}]},{"content":"ZachXBT's disclosure also alleges the network was involved in laundering proceeds from exploits beyond Bybit. According to reporting on ZachXBT's account, these include: the 2023 Poloniex exchange hack, with 332,000 USDC that had been frozen in 2024 traced to the same network; the September 2026 Bitget hack (approximately $387.5 million); and the April 2026 Kelp DAO exploit (approximately $292 million), with the latter two allegedly handled in part by a network operator using the alias 'lolo.' Blockchain analytics firm Elliptic is reported to have identified reuse of laundering routes between the Bybit and Bitget hacks, which it described as consistent with North Korean hacker patterns. These are allegations arising from ZachXBT's investigation and Elliptic's on-chain analysis; no charges or regulatory findings specific to these alleged launderings have been publicly announced.","heading":"Alleged Involvement in Additional Exploits","severity":"high","sources":[{"credibility":2,"name":"ZachXBT exposes the laundering network behind the Bybit and Bitget hacks — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/"},{"credibility":2,"name":"Chinese crime network laundered over $1B for Lazarus: ZachXBT — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"credibility":2,"name":"ZachXBT: $349,700 Sting Traced Bybit Hack Funds to Lazarus-linked Network — BitcoinWorld","type":"news_article","url":"https://bitcoinworld.co.in/zachxbt-349700-sting-traced-bybit-hack-funds-to-lazarus-linked-network/"}]},{"content":"A concrete enforcement outcome resulting from ZachXBT's operation is the freezing of approximately $442,000 in USDT by Tether, tied to the wallet cluster ZachXBT identified during his undercover transactions with Jimmy Green. ZachXBT states he proactively shared his findings with law-enforcement officers assigned to the Bybit case and with private-sector investigators before publishing his account. As of October 7, 2026, no criminal charges or regulatory enforcement actions against specific individuals in the network have been publicly announced. ZachXBT's broader body of work is cited in secondary sources as having contributed to freezing over $75 million in North Korea-linked crypto incidents since 2022.","heading":"Tether Freeze and Law Enforcement Cooperation","severity":"high","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"ZachXBT poses as money launderer to infiltrate Lazarus network — Protos","type":"news_article","url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/"},{"credibility":2,"name":"A Chinese Network Laundered More Than $1 Billion for North Korea's Lazarus Group, Says ZachXBT — 24/7 Wall St.","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/06/a-chinese-network-laundered-more-than-1-billion-for-north-koreas-lazarus-group-says-zachxbt/"}]},{"content":"The alleged network operates within a documented broader pattern of Chinese-national involvement in North Korean crypto laundering. In 2020, U.S. prosecutors charged two Chinese nationals with laundering more than $100 million stolen by North Korean state-sponsored hackers. In 2023, OFAC sanctioned two crypto traders — one based in Hong Kong and one in mainland China — for allegedly converting DPRK-stolen digital assets and bypassing U.S. financial controls. Chainalysis has estimated that North Korean-linked hackers stole at least $6.75 billion through 2025. These prior actions are established regulatory and prosecutorial records; they do not constitute evidence that the specific individuals described in ZachXBT's 2026 investigation were involved in those earlier cases.","heading":"Historical Regulatory and Law Enforcement Context","severity":"high","sources":[{"credibility":2,"name":"Chinese crime network laundered over $1B for Lazarus: ZachXBT — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"credibility":2,"name":"US Treasury Sanctions Huione Group for Enabling $70B in Crypto Money Laundering — KuCoin News","type":"regulatory","url":"https://www.kucoin.com/news/flash/us-treasury-sanctions-huione-group-for-enabling-70b-in-crypto-money-laundering"}]},{"content":"The primary source for all findings on this page is ZachXBT's own public disclosure via X on October 5, 2026. ZachXBT is a pseudonymous blockchain investigator with a credible track record of on-chain analysis, but his disclosures are not court filings, regulatory determinations, or independently audited reports. Secondary coverage is drawn from crypto news outlets (CoinTelegraph, The Block, Protos, Cryptopolitan) that are themselves relying on ZachXBT's thread. No Tier 1 source — court filing, DOJ press release, OFAC designation, or major general-interest news outlet — had independently corroborated the full scope of the $1 billion figure or the specific network structure as of the investigation date. The Tether freeze and FBI Bybit attribution are the strongest independently verifiable data points. Confidence is rated 0.78 to reflect the strength of ZachXBT's established methodology and the concrete Tether freeze outcome, discounted by the absence of independent regulatory findings specific to this network.","heading":"Source and Confidence Limitations","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"Chinese crime network laundered over $1B for Lazarus: ZachXBT — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"credibility":2,"name":"ZachXBT poses as money launderer to infiltrate Lazarus network — Protos","type":"news_article","url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/"},{"credibility":2,"name":"ZachXBT exposes the laundering network behind the Bybit and Bitget hacks — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/"},{"credibility":2,"name":"A Chinese Network Laundered More Than $1 Billion for North Korea's Lazarus Group, Says ZachXBT — 24/7 Wall St.","type":"news_article","url":"https://247wallst.com/investing/cryptocurrency/2026/10/06/a-chinese-network-laundered-more-than-1-billion-for-north-koreas-lazarus-group-says-zachxbt/"},{"credibility":2,"name":"ZachXBT Went Undercover With $349,700 to Follow Stolen Bybit Crypto — Blockonomi","type":"news_article","url":"https://blockonomi.com/zachxbt-went-undercover-with-349700-to-follow-stolen-bybit-crypto"},{"credibility":2,"name":"ZachXBT: $349,700 Sting Traced Bybit Hack Funds to Lazarus-linked Network — BitcoinWorld","type":"news_article","url":"https://bitcoinworld.co.in/zachxbt-349700-sting-traced-bybit-hack-funds-to-lazarus-linked-network/"},{"credibility":2,"name":"Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html"},{"credibility":2,"name":"FBI Confirms North Korean Lazarus Group Behind $1.5 Billion Bybit Crypto Heist — Picus Security","type":"news_article","url":"https://www.picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist"},{"credibility":2,"name":"US Treasury Sanctions Huione Group for Enabling $70B in Crypto Money Laundering — KuCoin News","type":"regulatory","url":"https://www.kucoin.com/news/flash/us-treasury-sanctions-huione-group-for-enabling-70b-in-crypto-money-laundering"},{"credibility":2,"name":"ZachXBT Posed As Client To Map Chinese Money Laundering Network — CrowdFund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/10/316065-zachxbt-posed-as-client-to-map-chinese-money-laundering-network-that-allegedly-laundered-1b-for-north-koreas-lazarus-group/"},{"credibility":2,"name":"Researcher Infiltrates Lazarus Group's Crypto Laundering Network After $1.5B Bybit Hack — CyberSecurityNews","type":"news_article","url":"https://cybersecuritynews.com/zachxbt-infiltrates-lazarus-group/"}],"summary":"A Chinese organized crime syndicate operating across Hong Kong and mainland China has allegedly laundered over $1 billion in stolen cryptocurrency on behalf of North Korea's Lazarus Group, according to blockchain investigator ZachXBT, who disclosed on October 5, 2026 that he spent months undercover posing as a client to map the network's operations. The investigation produced actionable intelligence shared with law enforcement and led to Tether freezing $442,000 in associated USDT linked to Bybit hack proceeds. As of the disclosure date, no criminal charges have been publicly announced against any identified members of the network.","timeline":[{"date":"2023-11-01","event":"Poloniex exchange hack occurs; 332,000 USDC later traced to the same Chinese laundering network per ZachXBT's 2026 disclosure.","source":"CoinTelegraph / ZachXBT disclosure","source_url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"date":"2024-01-01","event":"OFAC sanctions two crypto traders — one based in Hong Kong and one in mainland China — for allegedly laundering DPRK-stolen assets, providing regulatory context for the network's operating environment.","source":"CoinTelegraph / ZachXBT disclosure","source_url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"date":"2024-03-01","event":"Prior freeze of approximately $300,000 verified during ZachXBT's later investigation, connected to the same network.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/"},{"date":"2025-02-21","event":"Bybit exchange hacked; approximately $1.5 billion in cryptocurrency stolen via a Safe{Wallet} supply-chain attack. FBI later confirms attribution to North Korea's Lazarus Group (TraderTraitor).","source":"The Hacker News / Picus Security","source_url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html"},{"date":"2025-03-01","event":"ZachXBT begins undercover operation, funding a new Ethereum address with 349,700 USDC and engaging network operator 'Jimmy Green' as a paying client to map the laundering infrastructure.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"date":"2025-03-01","event":"Jimmy Green shares three Solana addresses that expose a cluster of $12 million-plus in Bybit-linked funds being swapped in real time across Bitcoin, Ethereum, Solana, and Tron.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"date":"2025-03-01","event":"Tether freezes approximately $442,000 in USDT associated with the wallet cluster identified by ZachXBT's undercover operation.","source":"Protos","source_url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/"},{"date":"2025-10-01","event":"U.S. Treasury OFAC sanctions Huione Group (Cambodian-linked marketplace connected to the laundering network) for allegedly enabling $70 billion in crypto money laundering.","source":"KuCoin News / Treasury records","source_url":"https://www.kucoin.com/news/flash/us-treasury-sanctions-huione-group-for-enabling-70b-in-crypto-money-laundering"},{"date":"2026-04-01","event":"Kelp DAO hack results in approximately $292 million in losses. A network operator using the alias 'lolo' is later alleged by ZachXBT to have handled proceeds from this exploit.","source":"ZachXBT disclosure via Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/"},{"date":"2026-09-01","event":"Bitget exchange hacked; approximately $387.5 million stolen. ZachXBT subsequently alleges the same Chinese syndicate was engaged to launder the proceeds, with Elliptic identifying reuse of established routing patterns.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/zachxbt-expose-laundering-bybit-bitget-hacks/"},{"date":"2026-10-05","event":"ZachXBT publishes a 12-part thread on X disclosing the full scope of his undercover investigation into the Chinese laundering syndicate, having previously shared findings with law enforcement.","source":"The Block / CoinTelegraph / Protos","source_url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"date":"2026-10-06","event":"Major crypto press (CoinTelegraph, The Block, Protos, Cryptopolitan, 24/7 Wall St.) publish coverage of ZachXBT's disclosure. No criminal charges announced as of this date.","source":"Multiple outlets","source_url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"}]},"v":1}