Bybit-Lazarus Chinese Money Laundering Syndicate
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·kLAjFm…5hDqSummary
A Chinese organized crime network operating from Hong Kong and mainland China is alleged by blockchain investigator ZachXBT to have laundered more than $1 billion in cryptocurrency stolen across multiple exploits by North Korea's Lazarus Group, including the February 2025 Bybit hack — the largest cryptocurrency theft in history at approximately $1.5 billion. ZachXBT disclosed on October 5, 2026, that he spent 18 months embedded undercover in the network as a paying client, spending approximately $349,700 in stablecoins to build trust and gather intelligence that contributed to asset freezes and on-chain attribution. As of October 2026, no members of the Chinese syndicate have been publicly arrested in connection with the Bybit funds, though parallel enforcement actions have targeted related infrastructure including Huione Group and Xinbi Guarantee.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(13 events)
19 February 2025
Lazarus Group actors inject malicious JavaScript into Safe{Wallet} front-end after compromising a developer workstation in early February 2025
The Hacker News21 February 2025
Bybit suffers the largest cryptocurrency theft in history — approximately 401,000 ETH valued at $1.5 billion drained from its Ethereum cold wallet via the compromised Safe{Wallet} interface
Bybit official timeline23 February 2025
$42.89 million in exploited funds frozen by industry partners including Tether, ChangeNOW, FixedFloat, and Circle within 48 hours of the hack
Bybit official timeline26 February 2025
FBI formally attributes the Bybit hack to North Korea's Lazarus Group (TraderTraitor)
TechTarget / FBI PSA6 March 2025
ZachXBT funds an Ethereum address with 349,700 USDC and initiates undercover contact with Chinese laundering network operators on Telegram/Discord, making contact with an operator using the alias 'Jimmy Green'
Decrypt / ZachXBT disclosure10 March 2025
Jimmy Green tells ZachXBT his team has '$1 million and is ready to start work,' indicating active laundering of Bybit funds
Decrypt / ZachXBT disclosure12 March 2025
ZachXBT matches Jimmy Green's advance descriptions of fund movements to on-chain THORChain transactions, corroborating the intelligence
Decrypt / ZachXBT disclosure1 May 2025
Telegram bans Huione Guarantee marketplace, which ZachXBT alleged was used by the Chinese laundering syndicate for at least one $3 million transaction
Decrypt / ZachXBT disclosure16 October 2025
FinCEN designates Cambodia-based Huione Group as a foreign financial institution of primary money laundering concern under Section 311 of the USA PATRIOT Act
Federal Register11 March 2026
One-year retrospective analysis finds 88% of Bybit stolen funds still traceable on-chain; only approximately 3.5% frozen; 27.6% have gone dark
Bex.co retrospective7 August 2026
Bybit files civil lawsuit in U.S. District Court for the District of Columbia against DPRK, its Reconnaissance General Bureau, and the Lazarus Group; U.S. court issues preliminary injunction freezing certain identified stolen assets
CoinDesk9 September 2026
OFAC designates Xinbi Guarantee — a $24 billion Chinese-language criminal marketplace used by Lazarus-linked actors to launder Bybit and WazirX hack funds — as a significant transnational criminal organization; $52 million in cryptocurrency seized or restrained
U.S. Department of State / Chainalysis5 October 2026
ZachXBT publicly discloses his 18-month undercover infiltration of the Chinese laundering syndicate in a 12-part thread on X, alleging the network laundered over $1 billion for Lazarus Group and describing its structure, methods, and the 'Jimmy Green' contact
ZachXBT on X / The Block / DecryptDecision Log
- slot 456438212 · hash FXDM9vVx6ae5u1mJCHJxKuYwbYYKP6Qi3VgHhp3jzQkJ
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 11 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/13/2026, 12:13:15 PM
last updated: 10/13/2026, 12:13:16 PM
1 viewavoid.net — verified advice for a post-truth world