A blockchain investigator suggested that crypto laundering by North Korean hackers may account for 15–25% of LiFi activity.
LiFi Protocol reported its highest activity figures yet. However, blockchain investigator ZachXBT suggested that much of the cross-chain bridge’s volume was tied to North Korean hackers laundering funds from the Bybit hack.
On Tuesday, June 3, ZachXBT highlighted LiFi Protocol’s record-breaking performance. The protocol’s founder, Arjun Chand, shared May data showing $3 billion in volume and 4.37 million executed transactions. Additionally, he claimed that over 510,000 unique users were served.
ZachXBT noted that the founder did not address the likely reason behind the significant surge in activity. According to the investigator, the primary driver was money laundering linked to recent North Korean hacks.
“Fun fact: Whenever your favorite cross-chain bridge flexes record usage/volume stats for the month, there’s a high likelihood the activity came from DPRK laundering funds from hacks,” ZachXBT.
North Korean hackers launder half of Bybit’s money
The investigator explained that the apparent spike in network volume likely came from laundering related to the Bybit hack. These hackers employ complex operations designed to obscure the source of funds, which substantially increases network activity.
“Usage gets overstated because they repeatedly chain hop back and forth to obfuscate movements,” ZachXBT claimed. He added that “DPRK represented at minimum 15-25% of LiFi activity during the period of time.”
While blockchain transactions are technically transparent, several laundering tactics can obscure their origin. These include frequent chain-hopping, token swaps, and splitting funds across thousands of wallets—practices that make tracing nearly impossible.
The Bybit hackers appear to have succeeded in their efforts. By the end of May, over half of the $1.4 billion in stolen funds were reportedly untraceable on-chain, indicating they had been successfully laundered.
