Investigation Disclosure: ZachXBT Identifies Transnational Money Laundering Network in Bybit Hack Case
Crypto security investigator ZachXBT has disclosed that a Chinese criminal network has been accused of laundering more than $1 billion for Lazarus, with the related funds linked to the $1.5 billion Bybit hack. The disclosure connects the post-hack laundering route in the Bybit case with a transnational criminal network, raising security and compliance concerns. According to available information, ZachXBT disclosed the network through an undercover investigation. The case involves a huge amount of money and has strong market impact.
Key Entities: ZachXBT, Lazarus, Bybit and the Alleged Criminal Network
The parties involved include ZachXBT, Lazarus, Bybit and the alleged Chinese criminal network. Available information shows the network laundered more than $1 billion for Lazarus and was involved in laundering funds from the $1.5 billion Bybit hack. ZachXBT disclosed the relevant information through an undercover investigation, making the whereabouts of the hack funds once again a focus in the security and compliance field. Because the available information does not provide specific individuals, on-chain addresses, trading platforms or timelines, what can currently be confirmed is the link indicated by the investigation between this network and the laundering of funds from the Bybit hack.
Case Background: Laundering of Funds from the $1.5 Billion Bybit Hack
The $1.5 billion Bybit hack is an important background to this disclosure. Available information mentions that the laundering of the involved funds is related to the Bybit hack. ZachXBT's investigation points the money laundering activity to a criminal network serving Lazarus. For exchanges and compliance teams, such cases mean that handling funds after a hack does not stop at on-chain transfers; the funds may also be laundered through transnational networks. The hack involved $1.5 billion, while the laundering scale disclosed this time exceeded $1 billion. Both amounts are high, so the event attracts significant attention at the security and compliance level.
Investigation Method: Undercover Investigation Combined with On-Chain Tracking
ZachXBT disclosed the network through an undercover investigation, indicating that investigations into crypto security incidents are increasingly combining on-chain tracking with offline information. Available information notes that the investigation exposed a transnational criminal network and involved laundering of funds from the Bybit hack. For the industry, the value of such investigations lies in identifying fund paths, discovering suspicious service providers and providing leads for exchange risk control, law enforcement cooperation and compliance reviews. Although the available information does not disclose specific tracking tools, fund flows or the investigation period, the two points—undercover investigation and more than $1 billion—are enough to show the complexity of the case.
Security and Compliance Impact: Exchanges and Institutions Face Greater Scrutiny
The high attention on this event centers on security and compliance. The Bybit hack itself involved $1.5 billion, and the subsequent laundering scale exceeded $1 billion, putting trading platforms, custodians and compliance departments under greater scrutiny. Available information notes high security and compliance attention and strong market impact. This means the market will focus on how large hack-related fund flows affect exchange risk management, user confidence and compliance processes. For compliance departments, how to identify risk exposure related to Lazarus and how to monitor suspicious fund activity may become key topics for follow-up discussion. However, currently available public information does not provide regulatory actions or case handling results, so the related impact remains at the observation stage.
Industry Takeaways: Tracking Hack Funds Requires Cross-Institutional Collaboration
Based on disclosed information, the laundering of funds from the Bybit hack is not a single step but involves a transnational criminal network. ZachXBT's disclosure connects the hack, money laundering and security investigation, highlighting the necessity of cross-institutional collaboration in crypto security. Trading platforms need to strengthen on-chain monitoring and risk labels, security teams need to continuously track hack-related addresses, and compliance teams need to incorporate such investigation results into risk reviews. Available information does not explain specific collaboration mechanisms or law enforcement progress, but the event itself shows that recovering funds from large-scale hacks remains an industry challenge.
Follow-up Focus: Investigation Details and Fund Flows
Follow-up attention should be paid to more details disclosed by ZachXBT, the on-chain flows of related funds, whether the involved network is further identified, and whether there are new developments in the investigation into laundering of funds from the Bybit hack. For industry participants, the focus is on how security teams use investigation leads to strengthen risk control and how compliance departments identify risk exposure related to Lazarus. Because available information does not provide a timetable or handling conclusions, the event remains at the disclosure and tracking stage. Market participants may continue to focus on security and compliance implications rather than short-term price movements.
