On-chain investigator ZachXBT has revealed details of his undercover operation infiltrating an organized crime syndicate in China. The criminal network was responsible for laundering more than $1 billion worth of cryptocurrency derived from various blockchain security exploits. The laundering group operated as a dedicated service provider for the Lazarus Group, the North Korean hacking collective behind some of the world’s largest crypto heists.
The infiltration was carried out directly. ZachXBT signed up and posed as a prospective client seeking money laundering services, gaining access to their communication channels. From inside the syndicate’s circle, he gathered specific intelligence on the operational mechanics of the crypto laundering scheme. This intelligence was later used by security teams to track and freeze funds stolen from the Bybit exchange hack in February 2025.
Remapping Illicit Transaction Routes
The utility of the data collected by ZachXBT went beyond freezing the Bybit funds. Intelligence from the undercover operation helped investigators attribute various other money laundering activities. Cross-wallet crypto transfer patterns that were once obscure can now be mapped cleanly, allowing illicit fund flows to be convincingly linked to this Chinese group.
News of the laundering network’s exposure emerged alongside a report published by BankInfoSecurity. The security analysis highlighted the Bitget exchange breach that resulted in losses of up to $387 million. The exploit that drained hundreds of millions of dollars had previously been confirmed to involve hacking operations tied to North Korea.
Accumulated Losses Across 2026
Analytics firm Chainalysis had previously verified traces of North Korean hacker involvement behind the Bitget breach. The attack adds to the industry’s mounting losses from cross-border hacking operations. Data shows that the total crypto assets stolen by North Korean hackers has crossed the $1 billion mark throughout 2026.
A volume of stolen funds that large cannot be cashed out through open exchanges without triggering red flags. The collaboration between North Korean hackers and Chinese laundering syndicates underscores an interdependent cybercrime supply chain. Without intelligence gathered by someone willing to infiltrate these laundering intermediaries, transaction tracing would simply lead to dead-end wallet addresses.
Reported via @zachxbt on X.
Also read: This TRON Rental Site Drained $69,000 from 80 Victims - Ironically Google Gemini AI Called It Safe
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
