On-chain investigator ZachXBT has revealed that stolen funds from multiple recent cryptocurrency exchange hacks, attributed to North Korean state-sponsored Lazarus Group, have been laundered through a vast and illicit network operating on the Tron blockchain, dubbed the "Black U" market. Estimated to be worth between $5 billion and $10 billion, this marketplace facilitates laundering through small over-the-counter (OTC) brokers and peer-to-peer platforms, with much of the activity remaining untraceable.
ZachXBT highlighted that laundering groups have effectively outpaced enforcement efforts, with over 50% of some protocol usages potentially linked to stolen funds. The investigator criticized protocol teams for profiting through fees while ignoring illicit flows. Additionally, Lazarus has shifted tactics to target centralized finance (CeFi) job seekers via a malware campaign named "ClickFix," impersonating firms like Coinbase and Tether to install malicious software during fake interviews.
The laundering activities have impacted platforms such as Bybit, DMM Bitcoin, and WazirX, where stolen assets were processed with ease, prompting increased compliance challenges globally. The FBI has linked Lazarus Group to the Bybit hack and urged platforms to block known malicious addresses. Analysts foresee growing regulatory oversight and more robust anti-money laundering frameworks designed to counteract these sophisticated laundering operations.
ZachXBT also commented on a broader crime supercycle in crypto, where minimal accountability has emboldened malicious actors, including influencers running scams and courts siding with exploiters of smart contracts. Without enhanced enforcement or public pressure, the investigator warns that long-term ramifications could severely harm the crypto ecosystem.