How Stolen Crypto Gets Laundered (And Why It Matters If You Trade)

Every transaction on a blockchain is public forever. So how does anyone launder a billion dollars of stolen crypto?

This week the investigator ZachXBT published the answer, from the inside. After North Korea’s $1.5 billion theft from Bybit in February 2025, he noticed the people laundering the proceeds were asking for help in public Telegram groups. So he posed as a client, funded a wallet with $349,700 of his own money, and spent weeks trading with a launderer calling himself “Jimmy Green,” losing 5% on every order, to map how the operation worked. His findings helped freeze funds and were handed to law enforcement before he could publish.

Here’s the method, and then the part that matters for anyone who trades.

The system

It’s an OTC desk, not a hacker. The people who steal the money and the people who clean it are different. The hackers hand the proceeds to professional laundering syndicates, in this case one operating out of Hong Kong and mainland China, who run what looks from the outside like an over-the-counter trading desk. The pitch in the chats was blunt: “professional coin laundering, isolation, and freezing prevention.”

The desk sells a service and charges for it. This is the part that surprises people. The launderer isn’t selling dirty money at a discount. He’s selling fast, large, “guaranteed unfreezable” stablecoin to clients who want it, and charging a few percent for the privilege. Clients send clean money, receive stablecoin funded by the stolen pile, and pay a fee, because from the desk’s side of the table the client is the one asking for something. The syndicate gets clean assets and a spread.

Distribution, not concentration. The $1.5 billion didn’t go to one buyer. It went out through hundreds of clients in orders small enough not to trip anything, to what Jimmy called “different acceptors.” Many hands, each holding a little, each paying a fee.

Chain hopping. Funds move Bitcoin to Ethereum to Solana to Tron, through bridges and swap protocols, because every hop breaks the trail for anyone not following in real time. ZachXBT matched one of Jimmy’s screenshots to a THORChain transaction created minutes after the message, and traced three Solana wallets to a $12 million cluster being swapped across four chains as he watched.

Novel tricks. The same cluster used an unusual method: routing funds through Uniswap liquidity pools using illiquid tokens, which turns a traceable transfer into a swap that looks like trading.

Where it lands on traders

Frozen stablecoins. Tether froze $442,000 connected to the cluster. Stablecoin issuers can and do freeze addresses tied to stolen funds, and the freeze lands wherever the money is sitting, which may be a wallet that bought it in good faith from an OTC desk. If someone’s offering you Tron USDT at a good rate with a promise it “won’t be frozen,” that promise exists because the risk does.

Tainted liquidity. Stolen funds swapped through DEX pools and illiquid tokens pass through the same pools other people trade in. Most traders will never be affected, but the reason some exchanges flag deposits is that chain analysis tools track this, and a wallet that touched a tainted pool can get questions it didn’t expect.

Being the acceptor. The “different acceptors” in the chats were people who took stolen stablecoin in exchange for clean money, sometimes knowingly, sometimes because an OTC deal looked cheap. That’s the one that turns into a conversation with law enforcement.

What to actually do

Buy stablecoins from a regulated exchange or a reputable on-chain route, not from a Telegram OTC desk offering a better rate. Treat “it won’t get frozen” as the tell rather than the reassurance. And keep trading wallets separate from holdings, because if a wallet does get flagged, you want it to be the small one. Is it safe to connect your wallet and how to spot fake crypto support cover the retail-facing version of the same ecosystem, where the same syndicates run recovery scams on the people they’ve just drained.

The cost of knowing

ZachXBT fronted $349,700, lost 5% per order with no guarantee the launderer wouldn’t vanish with the rest, and has helped freeze over $75 million of North Korean funds since 2022, funded by grants and donations. The chats, between discussions of moving state-stolen billions, were about mahjong, rabbit hunting and holidays at Disney. The public blockchain didn’t catch him. A person pretending to be a customer did.

Axxel is non-custodial across Ethereum, Base, BSC, Solana and Robinhood Chain, with token analysis, market, limit, trailing and sniper orders, stop loss and take profit, and MEV protection. Flat 0.9%, no subscription.

The chain is public. The laundering happens in the gaps between chains, through desks that look like a service. Know what the service is before you use one.

Crypto trading carries risk. Nothing here is financial or legal advice. Investigation details are from ZachXBT’s public thread of 13 October 2026. Axxel is not available in all regions.