Verify a decision

{"actor":"system:backfill","investigation_id":"83475c78-294b-4467-a6b7-243a496106b4","kind":"publish","page_slug":"bybit-lazarus-chinese-money-laundering-syndicate","published_at":"2026-10-13T12:13:26.358Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Bybit-Lazarus Chinese Money Laundering Syndicate","sections":[{"content":"On February 21, 2025, cryptocurrency exchange Bybit suffered the largest digital asset theft on record. Approximately 401,000 ETH and staked ETH, valued at roughly $1.5 billion at the time, were drained from Bybit's Ethereum cold wallet in a supply chain attack attributed to North Korea's Lazarus Group (also designated by the FBI as 'TraderTraitor'). The attackers did not breach Bybit directly. Instead, they compromised the development environment of Safe{Wallet}, a third-party multi-signature wallet platform used by Bybit. In early February 2025, Lazarus actors compromised a Safe{Wallet} developer workstation — likely through social engineering or phishing — and injected malicious JavaScript into the Safe{Wallet} front-end on or around February 19, 2025. The malicious code activated conditionally when Bybit-specific wallet addresses were detected, silently substituting the transaction destination in the user interface so that Bybit signers approved transfers to attacker-controlled wallets while believing they were authorizing routine internal transactions. The FBI formally attributed the attack to North Korea's Lazarus Group on February 26, 2025.","heading":"The Bybit Hack: Background","severity":"critical","sources":[{"credibility":2,"name":"Bybit hack traced to Safe{Wallet} supply chain attack — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html"},{"credibility":2,"name":"FBI confirms North Korean Lazarus Group behind $1.5B Bybit heist — TechTarget","type":"news_article","url":"https://www.techtarget.com/searchsecurity/news/366619872/FBI-Lazarus-Group-behind-15-billion-ByBit-heist"},{"credibility":2,"name":"Bybit security incident timeline — Bybit official","type":"official","url":"https://learn.bybit.com/en/this-week-in-bybit/bybit-security-incident-timeline"},{"credibility":1,"name":"The Bybit Heist: What Happened and What Now — Wilson Center","type":"research","url":"https://www.wilsoncenter.org/article/bybit-heist-what-happened-what-now"}]},{"content":"Following the February 21, 2025 theft, Lazarus Group operatives moved stolen assets through a layered laundering process documented by multiple blockchain analytics firms. The primary conversion pathway involved using THORChain, a decentralized cross-chain bridge, to swap the stolen ETH into Bitcoin. Elliptic and Chainalysis both tracked large volumes of the Bybit funds flowing through THORChain; BeInCrypto reported that Lazarus had substantially completed conversion of the stolen ETH to BTC via THORChain within weeks of the theft, with approximately $240 million laundered through THORChain in a single phase. The Bitcoin was then sharded — broken into many smaller amounts — and routed through mixers and low-volume token pools on decentralized exchanges such as Uniswap to obscure traceability. The final cash-out stage involved outsourcing to the 'Chinese Laundromat' — professionalized OTC brokers and underground banking intermediaries based in mainland China and Hong Kong — who absorbed the stolen assets and settled off-chain in fiat, distancing the theft operation from the conversion point. This structure is consistent with Lazarus Group's documented historical practice of using Chinese OTC networks as the fiat exit layer following on-chain laundering.","heading":"Lazarus Group Laundering Methodology","severity":"critical","sources":[{"credibility":2,"name":"Lazarus finishes laundering stolen Bybit funds using THORChain — BeInCrypto","type":"news_article","url":"https://beincrypto.com/lazarus-laundered-bybit-hack-funds-via-thorchain/"},{"credibility":2,"name":"Lazarus Group launders $240M through THORChain — Altcoin Buzz","type":"news_article","url":"https://www.altcoinbuzz.io/lazarus-group-launders-240m-through-thorchain"},{"credibility":2,"name":"North Korea and the industrialization of cryptocurrency theft — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/north-korea-and-the-industrialization-of-cryptocurrency-theft"},{"credibility":2,"name":"Lazarus Group: The North Korean hacking syndicate's on-chain footprint — Arkham Intelligence","type":"on_chain","url":"https://info.arkm.com/research/lazarus-group-the-north-korean-hacking-syndicates-on-chain-footprint"}]},{"content":"Blockchain investigator ZachXBT publicly disclosed on October 5, 2026, in a 12-part thread on X (formerly Twitter) that he had spent approximately 18 months embedded undercover inside a Chinese organized crime network allegedly responsible for laundering more than $1 billion in stolen cryptocurrency for the Lazarus Group. ZachXBT stated he initiated the operation in March 2025 after observing more than 15 accounts in public Telegram and Discord groups offering to move funds tied to the February 2025 Bybit exploit. He funded a new Ethereum address with 349,700 USDC on March 6, 2025, and made contact with a network operator using the pseudonym 'Jimmy Green.' To build credibility as a genuine client, ZachXBT accepted a 5% loss on each transaction he placed through the network. According to ZachXBT's account, by March 10, 2025, Jimmy Green had indicated that his team had '$1 million and is ready to start work.' By March 12, 2025, ZachXBT stated he was able to match messages from Jimmy Green describing forthcoming fund movements to actual on-chain transactions via THORChain, corroborating the authenticity of the intelligence. Jimmy Green allegedly disclosed that his team had different divisions of labor handling USDT distribution to multiple 'acceptors,' and described operations centered in Hong Kong and mainland China. ZachXBT also stated that Jimmy Green connected $3 million in laundering to Huione Guarantee, a Telegram-based marketplace subsequently sanctioned by U.S. authorities. All claims in this section derive from ZachXBT's own public disclosure and have not been independently confirmed by law enforcement or a court filing. ZachXBT held his findings for more than 18 months while the matter remained active, sharing intelligence with private-sector investigators and law enforcement before public disclosure.","heading":"ZachXBT Undercover Operation (March 2025 – October 2026)","severity":"high","sources":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"Crypto sleuth ZachXBT fronted $350K to pose as client of Lazarus' Chinese launderers — Decrypt","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"credibility":3,"name":"ZachXBT on X: thread disclosing infiltration of Chinese organized crime syndicate","type":"social_media","url":"https://x.com/zachxbt/status/2107081638073319437"},{"credibility":2,"name":"ZachXBT poses as money launderer to infiltrate Lazarus network — Protos","type":"news_article","url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/"},{"credibility":2,"name":"ZachXBT Posed as client to map Chinese money laundering network — CrowdFund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2026/10/316065-zachxbt-posed-as-client-to-map-chinese-money-laundering-network-that-allegedly-laundered-1b-for-north-koreas-lazarus-group/"}]},{"content":"According to ZachXBT's October 2026 disclosure, the Chinese network operated with a division-of-labor structure in which USDT (Tether) was received and distributed across multiple 'acceptors' — a term used by Jimmy Green in communications. The network allegedly handled stolen proceeds from multiple Lazarus exploits beyond the February 2025 Bybit hack, including the September 2025 Bitget exploit ($387.5 million) and the April 2025 Kelp DAO exploit ($292 million). ZachXBT alleged total laundering volume attributable to this network exceeds $1 billion across multiple incidents. The network's alleged techniques included converting BTC to ETH, Solana, and Tron assets, using THORChain for cross-chain bridging, and parking funds in low-volume Uniswap token pools to reduce detection. ZachXBT also alleged a connection to Huione Guarantee — the Telegram-based criminal marketplace operated by Cambodia's Huione Group — for a separate $3 million transaction. These figures and structural claims originate from ZachXBT's investigation and have not been independently verified by a government authority in publicly available documents as of October 2026.","heading":"Alleged Syndicate Structure and Scale","severity":"high","sources":[{"credibility":2,"name":"Chinese network laundered over $1B for Lazarus, ZachXBT — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"credibility":2,"name":"ZachXBT infiltrates Chinese laundering ring used by Lazarus Group hackers — MoneyCheck","type":"news_article","url":"https://moneycheck.com/zachxbt-infiltrates-chinese-crypto-laundering-ring-used-by-lazarus-group-hackers"},{"credibility":2,"name":"Lazarus Group exploits THORChain for $292M rsETH laundering operation — CryptoBriefing","type":"news_article","url":"https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/"}]},{"content":"ZachXBT's intelligence contributed to several documented freezes. Tether froze 442,000 USDT linked to the network following ZachXBT's tracing of a $12 million-plus cluster of Bybit funds. An earlier freeze of 332,000 USDC was verified as connected to the November 2023 Poloniex hack. ZachXBT stated in his October 2026 disclosure that his work has contributed to more than $75 million in freezes related to North Korean hacking incidents since 2022. Separately, Bybit's broader recovery effort had frozen approximately $30.5 million across more than 28 exchanges and custodians, and recovered $48.4 million in total, as reported at the time of Bybit's August 2026 civil lawsuit. One year post-hack (March 2026), a retrospective analysis found that 88% of stolen funds remained traceable on-chain while only 3.5% had been frozen — representing a recovery rate significantly below the total stolen. Bybit launched a $140 million Lazarus Hack Bounty Program, offering 10% of recovered amounts to entities that freeze funds or contribute tracing intelligence. As of October 2026, no members of the Chinese laundering network described by ZachXBT have been publicly arrested or charged in connection with the Bybit funds. Enforcement has remained confined to asset freezes, stablecoin blacklistings, and civil litigation.","heading":"Asset Freezes and Enforcement Outcomes","severity":"high","sources":[{"credibility":2,"name":"ZachXBT: $349,700 sting traced Bybit hack funds to Lazarus-linked network — CryptoRank","type":"news_article","url":"https://cryptorank.io/news/feed/e3dcf-zachxbt-349700-sting-traced-bybit-hack-funds-to-lazarus-linked-network"},{"credibility":2,"name":"Bybit's $1.5B hack one year later: 88% traceable, only 3% frozen — Bex.co","type":"news_article","url":"https://bex.co/blog/2026/03/11/bybit-1-5b-hack-one-year-retrospective-lazarus-crypto-theft"},{"credibility":2,"name":"Bybit CEO confirms 27.6% of hacked funds still untraceable — Bitcoin Ethereum News","type":"news_article","url":"https://bitcoinethereumnews.com/tech/bybit-ceo-confirms-27-6-of-hacked-funds-still-untraceable-despite-recovery-efforts/"}]},{"content":"In August 2026, Bybit filed a civil lawsuit in U.S. District Court for the District of Columbia against the Democratic People's Republic of Korea, its Reconnaissance General Bureau (RGB) intelligence agency, and the Lazarus Group. The court issued a preliminary injunction freezing certain identified stolen assets held by unidentified 'John Doe' defendants. The court found that 'Bybit has demonstrated a likelihood of success on the merits.' The suit represents an unusual legal posture — a private corporation suing a sovereign nation directly in federal court — and is proceeding under the Foreign Sovereign Immunities Act's state-sponsor-of-terrorism exception. As of October 2026, the litigation is ongoing and no final judgment has been entered. The preliminary injunction does not constitute an adjudication of the underlying claims.","heading":"Bybit Civil Lawsuit Against DPRK and Lazarus Group","severity":"high","sources":[{"credibility":1,"name":"Bybit sues North Korea and Lazarus Group over $1.5B hack, secures asset freeze — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze"},{"credibility":2,"name":"Bybit sues North Korea and Lazarus Group, secures preliminary injunction — Bybit official press release","type":"official","url":"https://www.bybit.com/en/press/post/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-bb55bb16f1710f487aa"},{"credibility":2,"name":"Bybit secures US asset freeze in $1.5B Lazarus hack lawsuit — Crypto Daily","type":"news_article","url":"https://cryptodaily.co.uk/2026/08/bybit-us-asset-freeze-lazarus-hack"}]},{"content":"Two Southeast Asian criminal marketplaces have been identified by U.S. authorities as serving as laundering infrastructure used by Lazarus-linked actors, with both connected to the broader Chinese-language underground banking ecosystem. The U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) designated Cambodia-based Huione Group as a foreign financial institution of primary money laundering concern under Section 311 of the USA PATRIOT Act, following findings that Huione-linked wallets moved more than $4 billion between August 2021 and January 2025, including at least $37 million traced to Lazarus Group cyber-heists. ZachXBT alleged in his October 2026 disclosure that the Chinese syndicate used Huione Guarantee — Huione Group's Telegram marketplace — for at least one $3 million transaction. Telegram banned Huione Guarantee in May 2025. Separately, on September 9, 2026, OFAC designated Xinbi Guarantee — a Chinese-language online marketplace processing an alleged $24 billion in digital assets since 2022 — as a significant transnational criminal organization. OFAC found that DPRK-linked actors moved tens of millions in stolen funds from the Bybit hack and the 2024 WazirX theft ($235 million) through Xinbi's vendor network, using a 'Black U' service to swap traceable stolen assets for stablecoins before converting to fiat through unlicensed OTC desks. OFAC also designated two Southeast Asia-based application developers supporting Xinbi's infrastructure. Authorities seized or restrained more than $52 million in cryptocurrency across the Xinbi network.","heading":"Related Infrastructure: Huione Group and Xinbi Guarantee","severity":"critical","sources":[{"credibility":1,"name":"Federal Register: Imposition of special measure regarding Huione Group — FinCEN","type":"regulatory","url":"https://www.federalregister.gov/documents/2025/10/16/2025-19571/imposition-of-special-measure-regarding-huione-group-as-a-foreign-financial-institution-of-primary"},{"credibility":2,"name":"US cuts off Huione over $4B crypto laundering, North Korea ties — DL News","type":"news_article","url":"https://www.dlnews.com/articles/regulation/us-cuts-off-huione-4bn-crypto-launder-north-korea-stablecoin/"},{"credibility":2,"name":"US sanctions Xinbi, Asia's multibillion-dollar cybercriminal marketplace — Chainalysis","type":"regulatory","url":"https://www.chainalysis.com/blog/ofac-sanctions-xinbi-cybercriminal-crypto-marketplace/"},{"credibility":1,"name":"Dismantling transnational criminal organization Xinbi Guarantee — U.S. Dept. of State / GlobalSecurity","type":"regulatory","url":"https://www.globalsecurity.org/security/library/news/2026/09/sec-260909-state03.htm"},{"credibility":2,"name":"The US sanctions Xinbi, one of Southeast Asia's largest illicit crypto marketplaces — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/the-us-sanctions-xinbi-one-of-southeast-asias-largest-illicit-crypto-marketplaces"}]},{"content":"The Bybit hack occurred within a documented pattern of escalating North Korean cryptocurrency theft. TRM Labs' 2026 Crypto Crime Report attributed $1.92 billion in stolen crypto to North Korea-linked actors in 2025 alone, representing more than half of the global total of $2.7 billion in crypto hacks that year. In a rare development reported in July 2026, North Korean authorities reportedly arrested former military hackers accused of stealing from two domestic state banks and laundering the proceeds through cryptocurrency via Chinese brokers. Chinese domestic enforcement also produced some results: in September 2026, China's central bank and public security authorities dismantled an underground bank that used virtual currency for money laundering, seizing approximately 130 million yuan ($18 million) in illicit proceeds and convicting several members for illegal business operations. These actions, while significant, represent a small fraction of the overall volume of funds alleged to have moved through Chinese underground banking networks on behalf of North Korean actors.","heading":"Broader North Korean Crypto Crime Context","severity":"high","sources":[{"credibility":2,"name":"2026 Crypto Crime Report — TRM Labs","type":"research","url":"https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report"},{"credibility":1,"name":"North Korea arrests hackers accused of laundering stolen bank funds through crypto — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/25/north-korea-arrests-hackers-accused-of-laundering-stolen-funds-from-country-s-bank-via-crypto"},{"credibility":2,"name":"Asia Market Daily: China central bank cracks down on crypto money laundering, seizing $18M — PANews","type":"news_article","url":"https://panews.io/articles/01a08a8c-9fae-7780-8af2-9b61931bc28d"},{"credibility":2,"name":"Shadow Bankers report — TRM Labs","type":"research","url":"https://www.trmlabs.com/reports-and-whitepapers/shadow-bankers"}]},{"content":"The core narrative of this dossier rests on three evidentiary layers of different weight. First, the Bybit hack itself — the theft, its technical mechanism, and FBI attribution to Lazarus Group — is well-documented by multiple Tier 1 and Tier 2 sources including the FBI, The Hacker News, and Bybit's own official timeline. Second, the laundering methodology involving THORChain and Chinese OTC networks is supported by Tier 2 blockchain analytics firms (TRM Labs, Chainalysis, Elliptic, Arkham) with on-chain corroboration. Third, the specific Chinese syndicate detailed in this dossier — including the 'Jimmy Green' alias, the $1 billion laundering figure, and syndicate structure — derives primarily from ZachXBT's own public disclosure (Tier 3 social media thread) supplemented by Tier 2 reporting from The Block, Decrypt, CoinTelegraph, and Protos. ZachXBT is a credible and widely-cited independent blockchain investigator whose prior findings have been confirmed by law enforcement, but the October 2026 disclosure has not yet been confirmed by a government authority, indictment, or court filing as of the time of this writing. The $1 billion laundering figure, syndicate structure, and Jimmy Green's role should be understood as ZachXBT's allegations, not adjudicated findings. The regulatory actions against Huione Group (FinCEN) and Xinbi Guarantee (OFAC) are Tier 1 government sources and carry the highest evidentiary weight in this dossier.","heading":"Source Credibility and Confidence Assessment","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT fronted $349,700 to infiltrate Lazarus Group's Chinese laundering syndicate — TFTC","type":"news_article","url":"https://www.tftc.io/zachxbt-lazarus-group-chinese-syndicate-bybit-infiltration"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus — The Block","type":"news_article","url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"},{"credibility":2,"name":"Crypto sleuth ZachXBT fronted $350K to pose as client of Lazarus' Chinese launderers — Decrypt","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"credibility":2,"name":"Chinese network laundered over $1B for Lazarus, ZachXBT — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/chinese-crime-network-laundered-over-1b-for-lazarus-zachxbt"},{"credibility":3,"name":"ZachXBT on X: infiltration thread","type":"social_media","url":"https://x.com/zachxbt/status/2107081638073319437"},{"credibility":2,"name":"ZachXBT poses as money launderer to infiltrate Lazarus network — Protos","type":"news_article","url":"https://protos.com/zachxbt-poses-as-money-launderer-to-infiltrate-lazarus-network/"},{"credibility":2,"name":"Bybit hack traced to Safe{Wallet} supply chain attack — The Hacker News","type":"news_article","url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html"},{"credibility":2,"name":"FBI confirms North Korean Lazarus Group behind $1.5B Bybit heist — TechTarget","type":"news_article","url":"https://www.techtarget.com/searchsecurity/news/366619872/FBI-Lazarus-Group-behind-15-billion-ByBit-heist"},{"credibility":2,"name":"Bybit security incident timeline — Bybit official","type":"official","url":"https://learn.bybit.com/en/this-week-in-bybit/bybit-security-incident-timeline"},{"credibility":1,"name":"The Bybit Heist: What Happened and What Now — Wilson Center","type":"research","url":"https://www.wilsoncenter.org/article/bybit-heist-what-happened-what-now"},{"credibility":1,"name":"Bybit sues North Korea and Lazarus Group over $1.5B hack, secures asset freeze — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze"},{"credibility":2,"name":"Bybit sues North Korea and Lazarus Group, secures preliminary injunction — Bybit official press release","type":"official","url":"https://www.bybit.com/en/press/post/bybit-sues-north-korea-and-lazarus-group-secures-preliminary-injunction-freezing-stolen-assets-in-landmark-crypto-asset-recovery-effort-bb55bb16f1710f487aa"},{"credibility":1,"name":"Federal Register: Imposition of special measure regarding Huione Group — FinCEN","type":"regulatory","url":"https://www.federalregister.gov/documents/2025/10/16/2025-19571/imposition-of-special-measure-regarding-huione-group-as-a-foreign-financial-institution-of-primary"},{"credibility":2,"name":"US sanctions Xinbi, Asia's multibillion-dollar cybercriminal marketplace — Chainalysis","type":"regulatory","url":"https://www.chainalysis.com/blog/ofac-sanctions-xinbi-cybercriminal-crypto-marketplace/"},{"credibility":1,"name":"Dismantling transnational criminal organization Xinbi Guarantee — U.S. Dept. of State / GlobalSecurity","type":"regulatory","url":"https://www.globalsecurity.org/security/library/news/2026/09/sec-260909-state03.htm"},{"credibility":2,"name":"Lazarus finishes laundering stolen Bybit funds using THORChain — BeInCrypto","type":"news_article","url":"https://beincrypto.com/lazarus-laundered-bybit-hack-funds-via-thorchain/"},{"credibility":2,"name":"North Korea and the industrialization of cryptocurrency theft — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/north-korea-and-the-industrialization-of-cryptocurrency-theft"},{"credibility":2,"name":"Shadow Bankers report — TRM Labs","type":"research","url":"https://www.trmlabs.com/reports-and-whitepapers/shadow-bankers"},{"credibility":2,"name":"2026 Crypto Crime Report — TRM Labs","type":"research","url":"https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report"},{"credibility":2,"name":"Bybit's $1.5B hack one year later: 88% traceable, only 3% frozen — Bex.co","type":"news_article","url":"https://bex.co/blog/2026/03/11/bybit-1-5b-hack-one-year-retrospective-lazarus-crypto-theft"},{"credibility":1,"name":"North Korea arrests hackers accused of laundering stolen bank funds through crypto — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2026/07/25/north-korea-arrests-hackers-accused-of-laundering-stolen-funds-from-country-s-bank-via-crypto"},{"credibility":2,"name":"Asia Market Daily: China central bank cracks down on crypto money laundering, seizing $18M — PANews","type":"news_article","url":"https://panews.io/articles/01a08a8c-9fae-7780-8af2-9b61931bc28d"},{"credibility":2,"name":"Lazarus Group: on-chain footprint — Arkham Intelligence","type":"on_chain","url":"https://info.arkm.com/research/lazarus-group-the-north-korean-hacking-syndicates-on-chain-footprint"}],"summary":"A Chinese organized crime network operating from Hong Kong and mainland China is alleged by blockchain investigator ZachXBT to have laundered more than $1 billion in cryptocurrency stolen across multiple exploits by North Korea's Lazarus Group, including the February 2025 Bybit hack — the largest cryptocurrency theft in history at approximately $1.5 billion. ZachXBT disclosed on October 5, 2026, that he spent 18 months embedded undercover in the network as a paying client, spending approximately $349,700 in stablecoins to build trust and gather intelligence that contributed to asset freezes and on-chain attribution. As of October 2026, no members of the Chinese syndicate have been publicly arrested in connection with the Bybit funds, though parallel enforcement actions have targeted related infrastructure including Huione Group and Xinbi Guarantee.","timeline":[{"date":"2025-02-19","event":"Lazarus Group actors inject malicious JavaScript into Safe{Wallet} front-end after compromising a developer workstation in early February 2025","source":"The Hacker News","source_url":"https://thehackernews.com/2025/02/bybit-hack-traced-to-safewallet-supply.html"},{"date":"2025-02-21","event":"Bybit suffers the largest cryptocurrency theft in history — approximately 401,000 ETH valued at $1.5 billion drained from its Ethereum cold wallet via the compromised Safe{Wallet} interface","source":"Bybit official timeline","source_url":"https://learn.bybit.com/en/this-week-in-bybit/bybit-security-incident-timeline"},{"date":"2025-02-23","event":"$42.89 million in exploited funds frozen by industry partners including Tether, ChangeNOW, FixedFloat, and Circle within 48 hours of the hack","source":"Bybit official timeline","source_url":"https://learn.bybit.com/en/this-week-in-bybit/bybit-security-incident-timeline"},{"date":"2025-02-26","event":"FBI formally attributes the Bybit hack to North Korea's Lazarus Group (TraderTraitor)","source":"TechTarget / FBI PSA","source_url":"https://www.techtarget.com/searchsecurity/news/366619872/FBI-Lazarus-Group-behind-15-billion-ByBit-heist"},{"date":"2025-03-06","event":"ZachXBT funds an Ethereum address with 349,700 USDC and initiates undercover contact with Chinese laundering network operators on Telegram/Discord, making contact with an operator using the alias 'Jimmy Green'","source":"Decrypt / ZachXBT disclosure","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"date":"2025-03-10","event":"Jimmy Green tells ZachXBT his team has '$1 million and is ready to start work,' indicating active laundering of Bybit funds","source":"Decrypt / ZachXBT disclosure","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"date":"2025-03-12","event":"ZachXBT matches Jimmy Green's advance descriptions of fund movements to on-chain THORChain transactions, corroborating the intelligence","source":"Decrypt / ZachXBT disclosure","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"date":"2025-05-01","event":"Telegram bans Huione Guarantee marketplace, which ZachXBT alleged was used by the Chinese laundering syndicate for at least one $3 million transaction","source":"Decrypt / ZachXBT disclosure","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"date":"2025-10-16","event":"FinCEN designates Cambodia-based Huione Group as a foreign financial institution of primary money laundering concern under Section 311 of the USA PATRIOT Act","source":"Federal Register","source_url":"https://www.federalregister.gov/documents/2025/10/16/2025-19571/imposition-of-special-measure-regarding-huione-group-as-a-foreign-financial-institution-of-primary"},{"date":"2026-03-11","event":"One-year retrospective analysis finds 88% of Bybit stolen funds still traceable on-chain; only approximately 3.5% frozen; 27.6% have gone dark","source":"Bex.co retrospective","source_url":"https://bex.co/blog/2026/03/11/bybit-1-5b-hack-one-year-retrospective-lazarus-crypto-theft"},{"date":"2026-08-07","event":"Bybit files civil lawsuit in U.S. District Court for the District of Columbia against DPRK, its Reconnaissance General Bureau, and the Lazarus Group; U.S. court issues preliminary injunction freezing certain identified stolen assets","source":"CoinDesk","source_url":"https://www.coindesk.com/policy/2026/08/07/bybit-sues-north-korea-and-lazarus-group-over-usd1-5-billion-hack-secures-asset-freeze"},{"date":"2026-09-09","event":"OFAC designates Xinbi Guarantee — a $24 billion Chinese-language criminal marketplace used by Lazarus-linked actors to launder Bybit and WazirX hack funds — as a significant transnational criminal organization; $52 million in cryptocurrency seized or restrained","source":"U.S. Department of State / Chainalysis","source_url":"https://www.chainalysis.com/blog/ofac-sanctions-xinbi-cybercriminal-crypto-marketplace/"},{"date":"2026-10-05","event":"ZachXBT publicly discloses his 18-month undercover infiltration of the Chinese laundering syndicate in a 12-part thread on X, alleging the network laundered over $1 billion for Lazarus Group and describing its structure, methods, and the 'Jimmy Green' contact","source":"ZachXBT on X / The Block / Decrypt","source_url":"https://www.theblock.co/news/defi/2026-10-06-zachxbt-infiltrated-chinese-launderers-lazarus-hack-417767"}]},"v":1}