Coin Crime: The Dark Knight of the Crypto World Fighting Against Criminal Organizations

[By Yang Won-mo, Block Media] February 25, 2025. A new client approached an individual using the name 'Jimmy Green' on Telegram. They inquired whether they could exchange suspiciously sourced Ethereum (ETH) for clean assets on another network. The transaction size was about 100 ETH. The other party began discussing the terms of the trade without any particular suspicion.

The client was not an ordinary investor. They were an anonymous investigator named 'ZachXBT' tracking the flow of criminal funds on the blockchain. ZachXBT was conducting a kind of undercover investigation. Green was suspected of being a member of a Chinese criminal network laundering digital assets stolen by the North Korean hacking group 'Lazarus'.

ZachXBT subsequently spent about $350,000 (approximately 469.31 million KRW) of his own money to conduct several transactions. To gain the trust of the other party, he even accepted losses of about 5% on each transaction. In return, he secured information about the movement plans of North Korean hacking funds, related wallet addresses, and the internal operations of the criminal organization.

Suspicious Posts Found on Telegram and Discord

On February 2025, approximately $1.5 billion (about 2.11 trillion KRW) worth of Ethereum was stolen from the global digital asset exchange Bybit. The hacking group behind the attack was identified as 'TraderTraitor', linked to North Korea.

While tracking the movement of the stolen funds after the hack, ZachXBT discovered suspicious posts on public channels on Telegram and Discord. Accounts requesting help, saying "there was a problem with the trade order," began to appear one after another. ZachXBT confirmed over 15 accounts, and among the orders they inquired about were trades directly connected to the stolen funds from the Bybit hack. This meant that accomplices handling criminal funds were asking about trading issues in a public customer support channel.

ZachXBT approached one of these individuals using the alias 'Jimmy Green'. He introduced himself as a customer looking to exchange a large amount of digital assets and inquired about the trading terms. The method proposed by Green was simple. If the customer sent USDC on the Ethereum network, he would provide USDT on the Tron network. This was an off-exchange method of exchanging assets across different blockchains.

On March 6, 2025, ZachXBT deposited 349,700 USDC into a new wallet. This was the fund for conducting the actual transaction. Although there was a risk that the other party might take the money and disappear, he continued with the trade.

The first clue came from the wallet provided by Green. The address was found to have received gas fees necessary for transaction fees from another wallet connected to the Bybit hacking funds. If gas fees were received from the hackers' wallet, it indicated that both parties were in a collaborative relationship. They had caught a lead.

As the transactions continued, Green gradually lowered his guard. He introduced his organization as "the largest professional money laundering team in China" and even began mentioning plans for the movement of funds related to North Korea.

"Most of the $1.5 billion was laundered by our team"

Green claimed to ZachXBT that "his team laundered most of the $1.5 billion worth of Ethereum stolen from Bybit." He further hinted at the laundering route, stating that the stolen funds would move to the Solana (SOL) network. The next day, transactions were observed on Solana involving the movement of those funds.

The decisive clue was captured on March 12, 2025. When Green sent a screen showing the movement of funds to another blockchain, ZachXBT cross-referenced the amount and time displayed on the screen with the transaction records of the cross-chain protocol THORChain. As a result, he found an actual transaction created just a few minutes after the message was sent.

Subsequently, while tracking three Solana wallet addresses provided by Green, a larger scale of fund flow was revealed. ZachXBT stated, "I confirmed a group of wallets connected to over $12 million (approximately 1.6 billion KRW) of Bybit hacking funds centered around these addresses."

The funds moved from Bitcoin (BTC) to ETH, then to SOL, and finally to the Tron network. In this process, bridges and decentralized exchanges (DEX) that move assets between blockchains were utilized. Some transactions also confirmed the use of tokens with low trading volumes in Uniswap's liquidity pool (LP). This was a method to complicate the transaction structure and make fund tracking difficult.

Confirmed Structure of 'North Korean Hacking Organization Asset Theft → Chinese Professional Organization Laundering'

The conversation with Green was not limited to money laundering. He shared everyday stories about mahjong, food, and family trips. Unaware of ZachXBT's true identity, Green freely mentioned his past criminal activities. It became clear that Green was a member of a Chinese organization.

Green told ZachXBT, "A team I used to know had about $300,000 (approximately 402.26 million KRW) frozen." ZachXBT tracked this down and found a case of 332,000 USDC being frozen linked to the 2023 Poloniex hacking incident. Another customer's fraudulent funds of $3 million (approximately 402.26 million KRW) were traced to a hot wallet related to Huione Guarantee.

Through this, ZachXBT confirmed a division of labor structure where North Korean hacking organizations steal digital assets, and Chinese professional organizations receive and launder the funds. ZachXBT also stated that he had "captured similar circumstances" in the Bitget hacking incident, estimated to have occurred in September, involving $387 million (approximately 518.9 billion KRW).

ZachXBT shared the information he obtained with private investigative agencies and law enforcement. He explained that he delayed the release due to sensitive content related to the investigation. Based on ZachXBT's investigation, Tether froze 442,000 USDT connected to the group of wallets.

ZachXBT, with his face covered by a mask, resembled Batman punishing villains. He stated, "I hope the support from foundations and individuals continues, as it allows others to take greater risks in cases that they believe have low feasibility."

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.