Investigator traces $1 billion laundering network tied to Lazarus Group exploits
Security & Exploits ·
An undercover inquiry by blockchain investigator ZachXBT mapped a Chinese organized-crime operation moving stolen funds for the DPRK-linked hacking group, feeding intelligence that led to several asset freezes.
According to a post on X, ZachXBT infiltrated the syndicate by posing as a client seeking help moving funds, gaining access to addresses and advance notice of transfers tied to the February 2025 Bybit exploit, which was attributed to the DPRK-linked group TraderTraitor and totaled $1.5 billion. The syndicate is said to have laundered over $1 billion across multiple exploits connected to Lazarus Group. ZachXBT identified a pattern of more than 15 accounts soliciting help with orders tied to stolen funds in public Telegram and Discord groups, then built a relationship with one contact using the alias Jimmy Green.
To establish trust, ZachXBT funded an Ethereum address with 349.7K USDC and conducted a series of exchanges with Jimmy Green, swapping USDC for USDT on Tron through several addresses. One of those addresses was funded with gas traceable directly to Bybit exploit funds and flagged on the public Bybit exploit blacklist. As the relationship deepened, Jimmy Green began describing the operation's structure across Hong Kong and mainland China and previewed fund movements before they occurred, including a same-day shift of funds to Solana that matched his advance description.
The intelligence gathered enabled real-time tracking of laundering activity. In one instance, a screenshot shared by Jimmy Green of a bridging transaction matched, by amount and timing, an order on the THORChain explorer. Three Solana addresses he disclosed revealed a cluster moving more than $12 million in Bybit exploit funds through a chain of swaps from BTC to ETH to SOL to Tron. Tether subsequently froze 442K USDT linked to that cluster, which was also found to have used a laundering method involving Uniswap liquidity pools built on illiquid tokens.
Additional details surfaced during the exchanges pointed to other illicit flows. Jimmy Green referenced a prior freeze of roughly $300K in 2024, which ZachXBT traced onchain to an actual 332K USDC tied to the Poloniex exploit. He also described laundering $3 million in fraud proceeds for a separate client, funds later traced to a hot wallet connected to Huione Guarantee, an entity that has since been sanctioned, with its former chairman arrested.
The investigation remains ongoing, and it is not yet clear how much of the broader $1 billion in laundered funds across exploits has been traced or recovered, or whether additional members of the syndicate face enforcement action.