The $1.5 billion Bybit hack in February 2025 was more than a record-breaking theft: it exposed how quickly North Korea-linked operators can move stolen cryptocurrency through a web of intermediaries. In an investigation described by crypto investigator ZachXBT, an apparent Chinese laundering network was traced through messages, test transactions and blockchain activity. The reported trail offers a rare look at the practical work behind money laundering: finding brokers, arranging swaps across networks and converting digital assets into forms that can be moved or spent.
In brief: ZachXBT says he contacted people seeking help with transactions linked to the Bybit theft, built trust with one Telegram user and traced transfers across several blockchains. The investigation identified a cluster of more than $12 million in suspected stolen funds, led to the freezing of $442,000 in USDT and contributed to freezes totaling more than $75 million connected to North Korea-related incidents since 2022. The case also shows why tracing a transaction is only one part of disrupting cybercrime: cooperation from stablecoin issuers, exchanges and law enforcement can help turn evidence into action.
How North Korea-linked crypto laundering came into view
In the months after Bybit was breached in February 2025, ZachXBT said he noticed more than 15 accounts asking for assistance in public Telegram and Discord groups with transactions connected to the stolen assets. The incident was attributed to TraderTraitor, a group associated with North Korea. Those public requests offered an opening to examine the people and services allegedly helping move the funds.
One contact, using the Telegram name “Jimmy Green,” agreed to transact. ZachXBT says he funded an Ethereum address with 349,700 USDC and exchanged messages and assets with the contact. The first transaction provided a significant clue: the address Jimmy Green supplied had received funds for network fees from an address reportedly traceable to the Bybit theft.
For a beginner, the detail matters because a blockchain records transfers publicly, even when the identity behind an address is unknown. Paying a transaction fee can create a link between otherwise separate wallets; it does not, by itself, prove who controls them. In this case, ZachXBT says the address was also listed among wallets associated publicly with the Bybit incident, adding context to the on-chain trail.
From Telegram conversations to cross-chain transfers
After the initial exchange, ZachXBT says he continued making transactions to build trust with Jimmy Green, accepting a reported 5% loss on each order. The contact allegedly discussed movements made on behalf of North Korea and described an operation spanning Hong Kong and mainland China. Such statements are claims attributed to the investigator and contact; blockchain records can help corroborate transaction paths, but they do not independently verify every conversation or identity.
The contact later shared an image relating to a bridge transfer that ZachXBT connected to the Bybit hack. Three Solana addresses then helped identify a cluster of more than $12 million in suspected proceeds. According to his account, the assets moved through a route involving Bitcoin, Ethereum, Solana and Tron—a process known as cross-chain laundering or chain-hopping.
Imagine a small exchange that accepts one digital asset and pays out another: each conversion may complicate the trail, but it also leaves transactions for analysts to compare. Bridges and swaps can make tracking more difficult by spreading activity across networks, yet they do not erase the public record. The key lesson is that “moving chains” is not the same as making funds invisible.
Why stablecoin freezes can interrupt the cash-out process
ZachXBT reported that Tether froze 442,000 USDT associated with the identified cluster. Stablecoins are designed to track the value of a traditional currency, which can make them useful for transfers between crypto networks and for holding value during a transaction. Some issuers also have the ability to freeze tokens at specific addresses, subject to their policies and applicable processes.
That intervention illustrates a tension at the heart of cryptocurrency: public transaction records can support independent investigation, while centralized services may sometimes act on an address-level alert. Readers can learn more about how such interventions work in this overview of Tether freezes involving USDT on Tron. A freeze does not recover every asset or establish guilt on its own, but it can block a portion of funds from being moved further.
What the laundering network allegedly handled beyond Bybit
The Bybit case was not the only activity discussed in the reported conversations. ZachXBT said Jimmy Green referred to $332,000 frozen in 2024 in connection with the Poloniex hack, as well as $3 million allegedly laundered for another client after a fraud. The investigator said he linked that separate activity to a hot wallet associated with the illicit marketplace Huione Guarantee.
ZachXBT also described a method involving Uniswap liquidity pools paired with illiquid tokens. In plain language, low trading activity can make a token harder to value and may complicate the interpretation of swaps. But unusual trading is not proof of criminal conduct by itself; investigators need to assess wallet links, timing, counterparties and other evidence together.
According to ZachXBT, information from the investigation was passed to law enforcement and his work contributed to the freezing of more than $75 million connected to North Korea-related incidents since 2022. That figure covers a broader set of cases, not just the Bybit investigation. It shows how public blockchain analysis can support action across multiple incidents when investigators and relevant financial services cooperate.
Why crypto tracing matters beyond one record-breaking hack
For newcomers, the scale of the Bybit theft can make cryptocurrency seem impossible to secure or police. The more useful takeaway is that crypto hacking often depends on a sequence of human and technical failures, while money laundering depends on people and services willing to move assets onward. Public blockchain data can expose connections in that process, even when a wallet’s owner is not immediately known.
Those connections matter because stolen funds do not become usable cash simply by being transferred. Operators may need brokers, exchanges, peer-to-peer traders or other financial networks to convert or distribute them. Where North Korea-linked operations are involved, these pathways also raise concerns about sanctions evasion and the movement of value beyond conventional banking controls.
For an ordinary user, the practical response is straightforward: use strong account security, verify requests through trusted channels and be wary of strangers offering to exchange assets or “solve” a transaction problem. For investigators, the case underlines the value of acting quickly, documenting address links and sharing reliable findings with organizations capable of intervening. The blockchain preserves a trail; coordinated action can determine whether that trail leads to a meaningful freeze.
More background on the role of stablecoin issuers in these cases is available in this guide to freezing crypto funds on the Tron network. Together, the reported investigation and the subsequent token freeze show that tracing digital assets is not just a technical exercise—it is one part of a wider effort to limit the reach of cybercrime.
