Here’s how North Korea launders billions from crypto hacks

Illustration generated with OpenAI

5 Oct 2026Hugh Bernard

Operations organized on Telegram and Discord

The hack of the Bybit platform carried out in February last year stands out as a historic event in the cryptocurrency ecosystem, mainly due to the unprecedented amount of its estimated damage totaling $1.5 billion.

An operation quickly attributed to the group << TraderTraitor >>, directly linked to North Korea, which the famous crypto investigator ZachXBT will try to analyze in detail, in order to understand the procedure that allows these stolen funds to be laundered.

⚠️ How to secure your digital and financial environment?

Indeed, he noticed shortly after the hack a phenomenon presented as << recurring >>, involving << more than 15 accounts asking for help, in public groups on Telegram and Discord, regarding orders directly related to the stolen funds >>.

Requests published directly on these messaging platforms to which ZachXBT decided to respond, by contacting << several accounts that asked for help regarding transactions linked to the funds stolen from Bybit >>, including a Telegram user known by the pseudonym << Jimmy Green >>.
Crypto Strategist

A contact that proves fruitful

To carry out this infiltration, ZachXBT will credit an Ethereum address with 349,700 USDC in order to make several transactions with Jimmy Green. The latter will then send him an address to receive stablecoins, before sending him back USDT implanted on the Tron network.

From this first exchange, the crypto investigator notices that the address provided by Jimmy Green received the necessary funds for paying its gas fees from another address, which he presents as << directly traceable to the funds from the Bybit hack and listed on the public site cataloging blacklisted addresses linked to this hack >>.

🗞️ Crypto scam: do not trust phone numbers that call you

Following this successful first step, ZachXBT will make further transfers to gain Jimmy Green's trust. A strategy that will soon bear fruit, as the latter will quickly talk to him about << fund movements from Bybit made on behalf of North Korea, while providing some general information about their organization in Hong Kong and mainland China >>.

He claimed that his team had laundered most of the $1.5 billion stolen from Bybit, which matched the laundering patterns I had observed. At this point, I understood that I had to continue losing 5% on each order and take the risk of continuing the operation in order to gather as much actionable intelligence as possible. ZachXBT

More than $75 million frozen since 2022

Over time, Jimmy Green will become increasingly talkative. He even went so far as to send a screenshot to ZachXBT regarding an ongoing fund transfer via a bridge. An operation that the crypto investigator will have no trouble linking to the Bybit hack. Operation identified by ZachXBT from Bybit

He will also reveal three Solana addresses that will allow to << uncover a cluster of over $12 million from the Bybit hack, whose funds were exchanged in real-time according to the following path: BTC → ETH → SOL → Tron >>. 442,000 USDT linked to this cluster will be frozen by Tether.

📰 The USDT stablecoin becomes one of the most used payment methods by Iran

ZachXBT also explains that he will discover << a new laundering method using Uniswap liquidity pools associated with illiquid tokens >>, while Jimmy Green will mention the freezing of $332,000 in 2024, ultimately linked to the Poloniex hack, or the laundering of $3 million from a fraud on behalf of another client, which ZachXBT will link to a hot wallet from the illicit market Huione Guarantee.

All this data collected was transmitted to law enforcement, as part of a work led by ZachXBT that would have << contributed to the freezing of over $75 million in funds linked to incidents involving North Korea >>.

This allows the crypto investigator to hope that he will continue to receive grants from foundations and donations from individuals to finance his investigations.

Source: ZachXBT

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.