North Korean hackers stole around $1.5 billion from Bybit in February 2025. While the hack itself has been widely covered and analyzed, few have focused on what happened afterward and what became of the stolen funds.

To move all that money, hackers needed to rely on an entire network of people willing to handle stolen assets, creating a chain of relationships that someone prepared to spend enough money could infiltrate.

That's what ZachXBT , a pseudonymous blockchain investigator, did. He committed 349,700 USDC and accepted a 5% loss on each completed order while posing as a client of a Chinese laundering network.

He eventually obtained information that helped him trace more than $12 million in Bybit -linked funds and, according to his account, contributed to Tether freezing 442,000 USDT .

His investigation led him to a network he believes laundered more than $1 billion from crypto thefts linked to the North Korean Lazarus Group, including proceeds from the Bybit attack.

The implications of his investigations extend to a much larger market for criminal financial services that American authorities have spent the past two years trying to disrupt.

In September, the US Treasury sanctioned Xinbi Guarantee , a marketplace it said has processed more than $24 billion in digital assets and fiat currency through its platforms since 2022, and explicitly identified North Korean hackers among the illicit actors reported to have used its services.

Treasury also acknowledged that criminals tried to preserve their operations by moving from Huione to Xinbi after it was sanctioned, showing how removing one marketplace doesn't eliminate the relationships and demand that supported it in the first place.

From an on-chain analytics and liquidity distribution perspective, developments around "Stealing $1.5B in crypto is easy, cashing out is the trap" signal important shifts in network participation. Market participants observe that derivative funding metrics, exchange reserve telemetry, and smart contract protocol interactions reflect cautious accumulation alongside disciplined risk hedging across the sector.

Technical research analysts at CryptoAce VIP note that high-density order book clusters and volume-weighted average price (VWAP) benchmarks near recent consolidation floors will serve as pivotal indicators. Market observers are advised to cross-examine telemetry on verified block explorers before making capital allocations.

Editorial Fact-Check & Verification Note: This briefing was curated, corroborated, and synthesized by the CryptoAce VIP Editorial Desk. Readers following "Stealing $1.5B in crypto is easy, cashing out is the trap" are encouraged to review the full primary source coverage linked below for complete historical context, direct quotes, and official statements.