Sponsored by
The KillChain
Criminals build the trap. Institutions hold the key. We name both.
|
| ◆ A SIGNAL FROM AN OPERATOR WE TRUST ◆ |
Join 2M+ Professionals Getting Ahead on AI
Keeping up with AI shouldn't feel like a second job.
But between the new tools, viral posts, and endless hot takes, most people spend hours every week trying to figure out what actually matters.
The Rundown AI fixes that.
It's a free newsletter that gives you the AI news, tools, and tutorials you actually need to know. All in just 5 minutes a day.
Over 2M professionals at companies like Apple, Google, and NASA already read it every morning to stay ahead.
Plus, if you complete the quiz after signing up, they'll recommend the best tools, guides, and courses for your specific job and needs.
| ◆ |
Lazarus's Laundromat Is in Beijing. The DOJ Just Started Knocking.
North Koreans don't run their own cash-out. They never have. TRM just named the desks that do, and Operation Level Up showed the DOJ has the cooperation framework to reach them.
April was the loudest month DeFi has had in years. The protocol drains we already covered in this newsletter (Drift on April 1, KelpDAO on April 18) made up 76% of all crypto hack value stolen in 2026 so far. Two attacks. $575 million. We named the heists. The interesting story now is what happens next.
Because Lazarus does not cash out. They have never cashed out. North Korean operators are excellent at exfiltration and execution. They are not in the business of converting crypto to fiat. That part of the kill chain is outsourced, and after years of speculation TRM Labs put a name on the desks doing the work this week. The offramp is in Beijing, Macau, and Hong Kong. Chinese OTC brokers, not state actors, run the laundromat. And on May 1 the DOJ showed how the next round of indictments gets made.
| GM, WELCOME BACK TO THE KILLCHAIN. |
The Story
The KelpDAO drain on April 18 was textbook North Korean tradecraft. $292 million through a single-verifier LayerZero bridge configuration that LayerZero shipped as a default and Kelp accepted as good enough. Tether and Circle between them froze $75 million on Arbitrum inside 47 hours. Three days after the exploit, on April 21, Arkham tracked 75,701 ETH (about $175 million at that day's price) moving to fresh wallets, swapped to USDC through Jupiter, routed through Umbra (an Ethereum privacy tool), and pushed to native Bitcoin via THORChain. What happened to that surviving $175 million is the part nobody covered until this week.
According to TRM Labs reporting published April 30, the post-THORChain Bitcoin is currently being processed by Chinese OTC brokers operating out of mainland China, Macau, and Hong Kong. These are not Lazarus. These are not even North Korean. They are Chinese intermediaries who specialize in converting recently-laundered crypto to USD-equivalent fiat through a cluster of nominee accounts at small Asian banks, a process TRM has been documenting since 2024 and Elliptic has corroborated. The North Korean side of the operation handed off the assets at the THORChain swap. The Chinese side is running the cash-out playbook.
This is not a new pattern. The same structure showed up in the Bybit $1.4 billion theft in February 2025, the WazirX hack in 2024, and a string of smaller exploits going back to 2022. Lazarus reaches the bridge. Chinese OTC reaches the fiat. The handoff is the seam, and the seam is where every single one of these cases has historically been recoverable, frozen, or interdicted.
Then the DOJ raised its hand. On May 1, 2026, the Justice Department announced the results of Operation Level Up: 276 arrests, 9 scam center compounds dismantled across multiple jurisdictions, $701 million restrained, $562 million returned to victims. The operation was not Lazarus-targeted. It was a coordinated takedown of pig-butchering compounds. But the framework is identical to what the next set of Lazarus-OTC indictments will look like: Mandiant attribution, Chainalysis tracing, Treasury sanctions, DOJ unsealing, foreign cooperation. Five-stack. Repeatable. The May 1 takedown is the precedent.
“Every dirty dollar longs for redemption. Most settle for real estate. A good money launderer doesn’t erase the footprints, but rather builds a marble floor over them.”
| ◆ |
Wallet Watch
Three address clusters tracked by TRM Labs and Elliptic this week. The seam between Lazarus and the Chinese OTC desks is right here, in plain sight, on the chain you can read for free.
THORCHAIN EXIT
Holds $215M in BTC after the LayerZero-to-THORChain swap. Has not moved in 6 days. Daily activity shows micro-transactions consistent with Chinese OTC pre-staging.
This is the surviving share of the KelpDAO drain that did not get frozen on Arbitrum. Sitting in plain sight, waiting for the OTC desk to pick it up.
|
ARBITRUM FREEZE
$75M frozen by Tether and Circle within 47 hours of the KelpDAO drain. The fastest joint stablecoin enforcement response on record.
The proof of concept. Stablecoin issuers can freeze recovered funds in 2 days when they want to. This is the lever the DOJ will pull next time, before the THORChain swap.
|
CN OTC INTAKE
Cluster of 14 nominee addresses receiving regular drops between $50K and $250K. Pattern matches the TRM-documented Chinese OTC laundering signature from the WazirX and Bybit cases.
This is where the BTC becomes USD, RMB, or HKD. Not via an exchange. Via nominee accounts at small Asian banks. The DOJ subpoenas have one address.
|
| ◆ |
Chain Reaction
How Lazarus's offramp actually works, in 5 stages.
| 01 | The bridge swap. The exploit funds move from Ethereum to Bitcoin via THORChain in 9 to 14 minutes. THORChain is the preferred bridge because it converts to native BTC, which is the asset class the offramp accepts. |
| 02 | The cooling period. Funds sit in a cluster of fresh BTC addresses for 5 to 21 days. No movement. No co-mingling. This is the "let the heat die" window. Bybit's funds sat for 6 weeks. KelpDAO's are sitting now. |
| 03 | The OTC handoff. The Lazarus operator transfers control of the BTC keys to a Chinese OTC broker. This is not on-chain. This is a Telegram message, a Macau hotel room, a USB drive at a Hong Kong border crossing. The chain shows nothing. |
| 04 | The fiat conversion. The OTC desk runs the BTC through a cluster of nominee accounts at small Asian banks (TRM has documented at least 4 such bank clusters). Conversion happens at a 6% to 12% spread off market. The desk keeps the spread. |
| 05 | The settlement. USD-equivalent fiat lands in mainland Chinese accounts controlled by intermediaries. From there it returns to Pyongyang via methods the DOJ has subpoenaed but not yet unsealed. The money is gone. The brokers are not. |
|
◆ THE LEDGER NOTE
There is a recurring fantasy in crypto that decentralization solves enforcement. That because the chain is censorship-resistant, the people who use it for crime are unreachable. The Drift and KelpDAO drains were marketed as proof of this fantasy. North Korea took $575 million. North Korea is unreachable. Therefore the chain wins. Every chain ends at a desk. The strongest cage a man ever sits in is the one he built with his own beliefs and handed the keys to a friend. But the laundromat sits in Beijing. The launderers go to the same office every day. They have phones, families, bank accounts at named institutions, and middlemen who flip in exchange for charge reductions. Decentralization stops at the bridge. After that you are in the building, and the FBI has been mapping the building for four years. May 1 was the demonstration. |
|
|||||||||||||||
The Position Desk
The Fraudfather's read on the three positions worth your attention this week.
BTC tagged $81K on Tuesday, the first time since January 2026. Up 5.2% over the prior 5 sessions. April spot ETF flows closed at $1.97 billion, the strongest month of 2026, and Friday alone added another $629M of net inflows. The drain news did not break the bid. Long-term holders are still net accumulators week over week. The setup is a reclaim of $85K with conviction or a clean retest of $78K; anything in between is chop.
|
ETH is 51% off its October 2025 peak but trades the $2,322 to $2,400 range cleanly, and tokenized Treasuries on Ethereum just hit an $8 billion all-time high (BlackRock, Franklin, Fidelity, WisdomTree). Restaking TVL is still 11% below the pre-Kelp baseline; that is the unfinished business. The trade is a clean break of $2,400 with volume to confirm a higher low. Without it, this remains a range trade.
|
A death cross is active on the daily, the third in 12 months. And yet Solana's DEX volume hit number 1 globally this week, ahead of every Ethereum L2. Mixed signals. SOL ETF inflows fell to $39.93M in April, down from a $419M peak in November 2025. The Drift exploit on April 1 rotated capital to L2s. $78 is the line. If it loses, $63 opens. If $90 reclaims with volume, the death cross is a fade. This is a watch, not a position.
|
|
◆ SIGNAL WATCH
Watch for OFAC designations on Chinese OTC broker entities in Q3. The framework is in place from the May 1 takedown. The targets are named in TRM's April 30 report. The timing is the only variable, and 2-4 months is the historical lag from public attribution to indictment in the DPRK enforcement track.
MONITORING WINDOW: 90 DAYS
|
|
◆ THE SETTLEMENT
The lesson in six words: anonymity ends where the bank begins. |
|
◆ SPREAD THE SIGNAL
The One Person Who Needs This Most Isn't In Our Crime Family.Algorithms won't find them. You will. If today's issue gave you a frame you didn't have before, forward it.
SHARE THE KILLCHAIN
THE CRIMINALS ARE ALREADY READING THIS.
YOUR FRIENDS SHOULD BE, TOO. |
Not financial advice. The KillChain is research and commentary, not personalized investment guidance. You're in command of every position. Read accordingly.
Stay Sharp, Stay Solvent