CryptoSlate • October 10th 2026, 12:00 PM
Stealing $1.5B in crypto is easy, cashing out is the trap
Key Summary
North Korean hackers stole $1.5 billion from Bybit in 2025, but the real challenge was converting the stolen crypto into real purchasing power. Investigator ZachXBT infiltrated a Chinese laundering network to gather information on over $1 billion in illicit funds, contributing to Tether freezing $442,000 USDT. The case highlights the complex web of relationships and services used by hackers to launder stolen assets.
Please see our real time news feed on our Home Page
Exposing Crypto Laundering Rings After North Korean Hack
The Aftermath of the Bybit Hack
The North Korean hackers who stole $1.5 billion from Bybit in February 2025 left behind a complex web of relationships and services used to launder the stolen assets. While the hack itself has been widely covered, few have focused on what happened afterward and what became of the stolen funds.Infiltrating the Laundering Network
ZachXBT, a pseudonymous blockchain investigator, gained access to a Chinese laundering network by committing $349,700 USDC and accepting a 5% loss on each completed order. This arrangement allowed him to establish a relationship with an intermediary who provided valuable information on the laundering process.Tracing Illicit Funds
The intermediary, who presented himself as Jimmy Green, helped ZachXBT trace over $12 million in Bybit-linked funds and contributed to Tether freezing $442,000 USDT. The investigation revealed a larger network that laundered more than $1 billion from crypto thefts linked to the North Korean Lazarus Group.The Complex Web of Relationships
The case highlights the complex web of relationships and services used by hackers to launder stolen assets. Without enforceable commercial protections, reputation and personal familiarity become especially important to keeping those relationships working. ZachXBT's investigation showed that personal and commercial relationships can be a powerful tool for investigators and regulators to disrupt illicit financial services.Implications for Law Enforcement
The US Treasury's sanctioning of Xinbi Guarantee, a marketplace that processed over $24 billion in digital assets, demonstrates the ongoing efforts to disrupt the market for criminal financial services. The fact that criminals tried to preserve their operations by moving from Huione to Xinbi after it was sanctioned shows that removing one marketplace doesn't eliminate the relationships and demand that supported it in the first place.#CryptoLaundering#NorthKorea#US#Bybit#BlockchainInvestigation