ZachXBT Uncovers North Korean IT Group’s $1.5M Crypto Money Laundering

Prominent on-chain investigator ZachXBT has exposed a sophisticated money laundering operation conducted by a North Korean IT team that successfully processed over $1.5 million in digital assets. The breach occurred after a Trojan horse infected a device belonging to one of the workers, leading to the leakage of critical data from an internal payment server. This data leak has provided a rare look into the clandestine financial workflows used by state-sponsored actors to bypass international sanctions and convert cryptocurrency into traditional fiat currency.

Mechanism of the Fraudulent Network

The leaked data set includes approximately 390 accounts, extensive chat logs, and detailed transaction histories. According to the investigation, the North Korean operatives utilized a centralized internal platform known as luckyguys.site to report their earnings and coordinate transfers. To maintain anonymity, the group employed a vast array of forged identities and fake legal documents to clear KYC (Know Your Customer) hurdles on various global exchanges.

• The funds were systematically moved from exchanges to a primary administrator wallet labeled "PC-1234".
• The group utilized cross-border accounts and platforms like Payoneer to facilitate the off-ramping process.
• A significant portion of the illicit capital was funneled through Chinese bank accounts to complete the conversion into fiat.

Timeline and Asset Seizures

The tracking of these assets reveals that the identified addresses have received over $1.5 million since November 2025. Despite the sophistication of the network, some of their activities were intercepted by industry watchdogs. In December 2025, a specific Tron (TRX) address linked to the group was blacklisted and frozen by Tether, preventing the further movement of stablecoin assets associated with that particular node of the network. Tether frequently collaborates with investigators to freeze assets tied to suspected illicit activity to maintain the integrity of the USDT ecosystem.

The leaked data shows that the North Korean IT team reported income through an internal platform... using a large number of forged identities and fake legal documents to transfer cryptocurrencies from exchanges.

Organizational Structure and Security Implications

The disclosure by ZachXBT further outlines the organizational hierarchy of the IT team, including payment schedules and publicly searchable information that ties these digital footprints to real-world entities. This incident highlights a growing trend where state-sponsored actors embed themselves in the global remote work economy to generate revenue. The use of a Trojan horse to inadvertently expose these operations underscores the ongoing cybersecurity vulnerabilities faced even by those conducting illicit digital operations.

The findings serve as a critical reminder for cryptocurrency exchanges and financial service providers to enhance their due diligence and identity verification protocols. As the investigative report circulates, it provides the broader blockchain community and regulatory bodies with actionable intelligence to better identify and mitigate the risks posed by fraudulent IT networks utilizing synthetic identities for money laundering.