Crypto theft is easy; cashing out is the hard part

North Korean hackers stole about $1.5 billion from cryptocurrency exchange Bybit in February 2025. Converting the assets into usable money required intermediaries who could exchange tokens, move funds between blockchains and provide payment services.

The FBI attributed the theft to a North Korean group known as TraderTraitor on Feb. 26, 2025. The agency reported that the stolen assets were converted into Bitcoin and other cryptocurrencies before being distributed across thousands of blockchain addresses.

The pseudonymous blockchain investigator ZachXBT began tracking the funds after finding more than 15 accounts in public Telegram and Discord groups offering services linked to the stolen assets. He contacted several accounts and developed a relationship with a person using the Telegram alias Jimmy Green, who arranged cryptocurrency exchanges between networks.

On March 6, 2025, ZachXBT funded a new Ethereum address with $349,700 in USDC. He used the address to exchange USDC for USDT on the Tron network through the contact. He reported accepting a 5% loss on each completed order to appear to be a regular customer. The $349,700 was capital committed to the investigation, not a disclosed net loss.

The relationship gave ZachXBT access to private conversations about planned transactions. In one instance, the intermediary discussed moving funds to Solana before the transfer appeared on the blockchain. Comparing the conversations with later blockchain activity helped ZachXBT connect additional wallets and transactions to the Bybit theft.

ZachXBT reported identifying more than $12 million in Bybit-linked funds and contributing to Tether’s freeze of 442,000 USDT. The amount traced was not the amount frozen, and the freeze did not mean the tokens had been returned to Bybit. The 442,000 USDT figure comes from ZachXBT’s account. Tether has separately reported larger freezes connected to the Bybit theft.

Tether can restrict transfers from designated addresses because USDT is issued and administered by a centralized company. Bitcoin has no issuer with the same ability to block transactions. Authorities can still seize cryptocurrency held by custodians or obtain control of private keys.

Stolen cryptocurrency can move between wallets, blockchains, exchanges and payment services. Each transfer can require new evidence or legal action, especially when a service does not cooperate with investigators or operates outside their jurisdiction.

The use of intermediaries in North Korean cybercrime has been documented for years. In March 2020, the Justice Department charged Chinese nationals Tian Yinyin and Li Jiadong with laundering more than $100 million in cryptocurrency, mainly from exchange hacks. Treasury records later indicated that Tian converted nearly $1.4 million in Bitcoin into prepaid Apple iTunes gift cards.

In May 2025, the Financial Crimes Enforcement Network identified Cambodia-based Huione Group as a financial institution of primary money laundering concern. The agency found that the group had laundered at least $4 billion in illicit proceeds between August 2021 and January 2025, including at least $37 million in cryptocurrency linked to North Korean cyber thefts.

On Sept. 9, 2025, the Treasury Department sanctioned Xinbi Guarantee. Treasury reported that the marketplace had processed more than $24 billion in digital assets and fiat currency since about 2022, and that North Korean hackers and other criminal groups had used its services. Treasury also reported that some customers shifted from Huione-related services to Xinbi after earlier enforcement action.

Tether later froze more than $45 million in USDT across at least 22 wallets associated with Xinbi. Xinbi reportedly told customers it would favor USDD, a stablecoin without the same issuer-controlled freezing mechanism as USDT. The Xinbi-related freezes do not establish that the same wallets, participants or funds were involved in the Bybit case.