Behind the $1.5 billion cryptocurrency heist: On-chain Batman tears apart North Korean hacker money laundering network

Original Title: Stealing $1.5B in crypto is easy, cashing out is the trap

Original Author: Andjela Radmilac

Original Compilation: Saoirse, Foresight News

In February 2025, North Korean hackers stole approximately $1.5 billion in cryptocurrency from Bybit. Although this hacking incident has been widely reported and analyzed, the aftermath and the whereabouts of the stolen funds have received little attention.

To transfer this massive amount of illicit funds, the hackers had to rely on a whole network of people willing to handle stolen assets. This chain of relationships can be infiltrated as long as sufficient funds are invested.

A blockchain investigator using the pseudonym ZachXBT adopted this approach. He put forward 349,700 USDC, posing as a client of a Chinese money laundering network, willing to accept a 5% loss on each transaction. He ultimately obtained key clues, tracing over $12 million related to the Bybit theft; according to him, this information also assisted Tether in freezing 442,000 USDT.

His investigation unveiled a money laundering network. He assessed that this network laundered over $1 billion from the North Korean Lazarus Group's crypto theft, including the proceeds from the Bybit attack.

This investigation points to a large-scale illegal financial services black market, which U.S. authorities have been cracking down on for the past two years.

In September of the same year, the U.S. Treasury imposed sanctions on Xinbi Guarantee. The U.S. stated that since 2022, this trading platform had processed over $24 billion in digital asset and fiat currency transactions through its system, and North Korean hackers were among the illegal entities using its services.

The Treasury also mentioned that after Huione Group was sanctioned, criminals turned to Xinbi Guarantee to continue their illegal activities. This indicates that merely shutting down a trading platform cannot eradicate the underlying networks and criminal demands.

Incredibly, invading exchanges and stealing funds is just a relatively simple part of the entire criminal chain. The real challenge lies in converting the stolen cryptocurrency into fiat currency or other assets with actual purchasing power.

To cash out, hackers must rely on various payment services and gray networks, which also leaves an opening for investigators and regulatory agencies to intervene.

The "Undercover Client" Investing 349,700 USDC

On February 26, 2025, the FBI identified the Bybit theft as being perpetrated by North Korean hackers, codenamed TraderTraitor, and issued a warning: the stolen assets were being converted into Bitcoin and other cryptocurrencies, then dispersed into thousands of blockchain addresses.

Although the identity of the hackers was quickly established, finding the intermediary institutions handling the stolen funds still required extensive investigative work.

ZachXBT stated that he found over 15 accounts in public groups on Telegram and Discord that were engaged in transactions related to the Bybit stolen funds. This means that at least in some laundering stages, intermediaries openly solicited business and facilitated transactions.

He contacted several of these accounts and eventually connected with a contact on Telegram nicknamed Jimmy Green, who claimed to assist in cross-chain transfers of cryptocurrency.

ZachXBT indicated that on March 6, 2025, he transferred 349,700 USDC to a brand new Ethereum address and used this contact to exchange USDC on the Ethereum chain for USDT on the Tron chain. To create a realistic client identity, he accepted less favorable exchange terms.

This 349,700 USDC was the principal for trading, not a net loss from the investigation; he was willing to bear a 5% loss on each transaction in exchange for intelligence that ordinary on-chain analysis could not obtain.

Such transactions also carry risks: intermediaries could potentially abscond with the funds.

The intermediaries relied upon by the hackers could also be untrustworthy and embezzle the stolen funds. With no enforceable commercial guarantees in place, reputation and personal relationships within the network became the core of maintaining this cooperation.

This precisely provided ZachXBT with an infiltration opportunity: for service providers, clients willing to repeatedly engage in transactions hold higher value.

With this undercover relationship, the information he obtained was no longer limited to wallet addresses. Intermediaries would discuss funding transfer plans with him before executing transactions. ZachXBT was able to cross-reference private communications with transaction records stored on the public blockchain.

On one occasion, before a transaction occurred, an intermediary discussed transferring funds to the Solana chain with him. Other exchange records and wallet association clues are believed to have helped him lock down a large batch of assets related to the Bybit theft.

This was a critical turning point in the investigation: on-chain data can only record transaction behaviors but cannot confirm the actors behind the transactions and their true motives. The private communication records between the two parties are the core evidence for identifying fund controllers and clarifying the purpose of the funds.

Although ZachXBT's investigative conclusions do not completely align with the FBI's official records, it remains one of the most significant investigative actions in recent years. It proves that work that cannot be completed solely with blockchain data can be substantiated through interpersonal relationships and business dealings; similar methods may also be applicable in investigations of other crypto theft cases.

Tracing $12 Million ≠ Successfully Recovering $12 Million

ZachXBT stated that through his connection with Jimmy Green, he identified a cluster of Bybit-related funds distributed across multiple public chains, totaling over $12 million.

He also revealed that Tether subsequently froze 442,000 USDT related to the North Korean hacker case. This indicates that when the stolen funds remain in tokens like USDT and USDC, which are controlled by issuers, quickly identifying stolen assets is crucial for recovering losses.

It is necessary to distinguish between two sets of data: tracing $12 million does not mean that all of these funds have been frozen; freezing 442,000 USDT does not equate to these tokens being confiscated and returned to Bybit.

The figure of 442,000 USDT and the connection between this freeze and the investigation come from ZachXBT's personal statements; Tether has also announced larger freeze operations related to the Bybit theft.

There exists a significant gap between discovering stolen cryptocurrency, finding the intermediaries involved, and obtaining legal or technical control over the stolen funds.

Public chains cannot prevent assets from being transferred again. Once funds flow through service platforms that are unwilling to cooperate with investigations or are outside of judicial jurisdiction, the situation becomes even more complicated.

Centralized issued stablecoins provide regulators with a means to intervene: issuers have management authority and can restrict transfers to specific addresses. Native Bitcoin does not have a freezing mechanism provided by issuers; however, once authorities obtain legal authorization, they can still seize Bitcoin held by custodians or control the corresponding private keys.

This means that investigations not only require precise tracing, but the funds identified must also be within the jurisdiction of institutions with technical capabilities and law enforcement authority.

During Bybit's asset recovery efforts, court injunctions combined with cooperation from financial intermediaries can restrict asset movement long after the theft has occurred, but they cannot guarantee full recovery.

The problem is that stolen cryptocurrencies continuously split and circulate among different wallets, public chains, custodians, and counterparties. Each time funds pass through a new platform, the recovery party often has to gather evidence anew and initiate a new round of legal proceedings.

This is why investigators can see the flow of funds but are powerless to stop the next transfer or recover the stolen funds.

A $4 Billion Crypto Money Laundering Operation

Using external intermediaries to launder stolen funds is not unique to the Bybit theft case. U.S. law enforcement records show that authorities have long been investigating various gray operations—these operations specifically convert stolen cryptocurrencies into assets that criminals can actually use.

In March 2020, the U.S. Department of Justice charged two Chinese citizens, Tian Yinyin and Li Jiadong, with laundering over $100 million worth of cryptocurrency, most of which originated from exchange hacking.

These charges indicate that even without personally executing the hacking, intermediaries still play a core role in the entire criminal chain.

The Treasury's sanction announcement also revealed that Tian Yinyin had exchanged nearly $1.4 million worth of Bitcoin for Apple iTunes prepaid gift cards. This shows that the end of the money laundering chain does not necessarily involve complex multinational financial services; ordinary retail stored-value cards can also be utilized.

The same cash-out demand operates on trading platforms that facilitate transactions between criminals and settlement, exchange, and payment service providers on a larger scale.

In May 2025, the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) designated Huione Group, based in Cambodia, as a key money laundering financial institution. Investigations found that from August 2021 to January 2025, the group laundered at least $4 billion in illegal proceeds.

Of this, FinCEN confirmed that at least $37 million in cryptocurrency came from North Korean cyber theft, while the remaining illicit funds originated from various investment scams and online frauds.

The $4 billion figure represents the total amount involved in all the aforementioned criminal activities; the $37 million is the minimum valuation of the funds related to North Korea that the agency verified.

FinCEN's assessment report pointed out that the group's anti-money laundering and customer identity verification mechanisms had serious vulnerabilities. The lack of identity verification allowed the group's subsidiaries to indirectly receive funds obtained from North Korean hacker attacks.

The significance of this investigation is not limited to a single transaction. If an intermediary can continuously provide payment channels, it will become a shared criminal infrastructure for multiple criminal organizations, eliminating the need for each criminal group to establish its own channels for cashing out stolen coins.

A large amount of funds concentrated on such platforms also makes them targets for sanctions, asset seizures, cutting off banking cooperation, and other law enforcement actions.

The Huione Group's trading platform handled a massive volume of transactions and illegal activities. Even if Telegram banned some channels of this network, the platform operators still attempted to maintain business operations.

The total transaction volume of the platform and the illegal proceeds verified by FinCEN do not have the same statistical criteria, and not all funds flowing through the platform can be directly identified as confirmed criminal proceeds.

Criminal Platforms Can Be Shut Down, But Criminal Clients Still Exist

The challenge is that even if the infrastructure of illegal trading platforms is destroyed, the criminal demand that gives rise to such businesses will not disappear as long as criminals can still contact other alternative service providers.

In June 2026, the U.S. Department of Justice announced the seizure of the cloud server backend used by Huione Group's subsidiaries. These servers were reportedly used to transfer proceeds from fraud, cybercrime, and other illegal activities.

This action was launched following earlier restrictions imposed by the U.S. on the group, targeting the technical facilities supporting illegal fund transfers and asset concealment.

However, destroying the infrastructure does not automatically sever the connection between criminal clients and the intermediaries taking orders.

On September 9, the Treasury Department's sanctions announcement clearly revealed this limitation: the authorities sanctioned Xinbi Guarantee. This is an illegal trading market responsible for connecting criminal organizations with merchants that can provide financial services, technology, and other resources.

The Treasury Department stated that since around 2022, Xinbi has processed a total trading volume of digital assets and fiat currency equivalent to over 24 billion USD, primarily targeting the Southeast Asian market.

Such a large scale has made this platform a key target for law enforcement actions against the financial infrastructure of criminal organizations.

The Treasury Department also mentioned that after FinCEN cracked down on Huione, cybercriminals migrated their operations to Xinbi to maintain their activities. This new platform offers almost identical services to the same group of clients.

Regulators painted a picture of a market-driven gray ecology: when existing channels become unreliable due to law enforcement actions, participants will seek the next service provider.

During the crackdown on Huione, Telegram removed thousands of channels related to Huione Guarantee, and relevant merchants flocked to other alternative trading platforms.

Therefore, the effectiveness of the crackdown cannot be measured solely by the number of websites, accounts, or servers shut down. As long as criminal clients still have a demand for illegal financial services, they will find ways to locate service providers that are still operational and rebuild their funding channels.

Of course, law enforcement actions will still raise the costs of crime, such as freezing assets, failed settlements, and the disappearance of familiar trading counterparts. But as long as criminal activities remain profitable, the economic incentive to transfer illicit funds will always exist.

The dilemma faced by law enforcement agencies is to continuously raise the crime costs across the entire network of alternative service providers and reduce their business stability.

Tether's Freezing Operations Force Crypto Money Laundering Networks to Shift to Other Payment Tools

The law enforcement actions against Xinbi Guarantee indicate that financial restrictions can disrupt criminal activities but can also compel criminal groups to change their payment channels.

Tether conducted a series of freezing operations, freezing a total of over 45 million USD in USDT across at least 22 Xinbi-related wallets.

Subsequently, the trading platform informed users that it would switch to using USDD. This stablecoin does not have the address freezing authority like USDT.

This is a critical shift: when the involved funds are still under the control of the issuer, the token freezing function is highly valuable to investigators; criminal clients looking to evade regulation will tend to choose assets with different control mechanisms.

This situation illustrates that when one link in the payment system is restricted, transactions will flow to other channels. Investigators need to track the direction of assets and investigate the service providers offering those channels.

In the September crackdown, authorities also targeted Xinbi's related infrastructure, seizing cryptocurrencies worth over 52 million USD. Meanwhile, the speed of asset withdrawals increased, and competing trading platforms reportedly began to restrict money laundering merchants from joining.

The aforementioned case and the freezing of 442,000 USDT related to North Korean hackers mentioned by ZachXBT are two separate incidents. Public reports cannot confirm whether the two involve the same addresses, individuals, or funds.

However, both cases confirm one point: criminal groups are highly dependent on financial intermediaries. Even if the original theft has been completed, intermediary services still leave a window for regulatory intervention.

If the token issuer has the ability to freeze assets, the risk is concentrated within the balances of identifiable addresses. If a platform serves multiple criminal groups, its vulnerabilities include infrastructure, merchant networks, and settlement arrangements.

Both paths can increase the costs and risks of transferring and using illicit funds.

Intermediaries Facilitating Transactions Are Harder to Replace

The breakthrough in ZachXBT's investigation lies in proving that establishing client relationships through paid undercover work can uncover the identities of those responsible for arranging transactions.

Long-term intermediaries dealing with stolen cryptocurrencies accumulate reputations within the circle, filter fixed trading partners, and understand which services can complete transactions without intercepting illicit funds.

These relationships make criminal operations more efficient over time, especially when clients need to make large transfers without wanting to expose their identities or fearing that trading counterparts will abscond with the funds.

However, once established service providers are taken down, this network of cooperation is difficult to rebuild quickly. Alternative service providers often charge higher fees, refuse suspicious funds, or lack business stability.

This dependency also provides new sources of intelligence for investigations. Service providers may reveal future transaction plans, other participants, and the payment infrastructure needed to complete orders.

Investigators still need to verify intelligence by combining on-chain records with other evidence. An address receiving funds related to theft does not mean the recipient is aware of or subjectively involved in the crime.

However, cross-referencing private chat records with subsequent blockchain fund flows can reduce information uncertainty, something that merely tracking transaction flows cannot achieve.

More law enforcement cases indicate that to weaken the appeal of illegal financial services, it is not enough to periodically shut down websites. The client base and profit motives that give rise to such businesses will outlast the existence of website servers.

However, seizing assets, cutting off financial channels, prosecuting service providers, and locking down settlement controllers can change the cost-benefit ratio of criminal behavior. Just that different service providers have varying thresholds for the risks they can bear.

This also explains why the total amount of stolen cryptocurrency does not equate to the funds that criminals successfully liquidate and can spend; nor can it be directly concluded that these funds are used for specific military or national expenditures.

The original stolen amount, the amount circulated through intermediary addresses, the amount successfully converted into actual purchasing power, and the amount ultimately recovered by law enforcement are four sets of independent statistical criteria that need to be evidenced separately.

For North Korean hackers, even if the intrusion is successful, relying on money laundering services can bring subsequent risks. Obtaining stolen assets does not mean there will be someone willing to accept, exchange, and ultimately spend them.

ZachXBT's undercover operation illustrates that this demand for liquidation can turn client relationships into breakthroughs for investigations. The U.S. crackdown on Huione and Xinbi also proves that even if criminal clients constantly change their bases, gray service providers themselves can still become targets of law enforcement actions.

The core vulnerability of criminal behavior lies in the fact that stealing cryptocurrency and actually using cryptocurrency are two entirely different matters. The latter still relies on business partnerships, where all participants have assets, reputations, and economic interests to protect.

North Korean hackers wanting to turn illicit funds into spendable money must once again step into a network of interpersonal relationships that require trust; meanwhile, the intermediaries providing services must also bear the risk of financial loss.