Clean on Paper blog

How the Bybit hack was laundered so fast

Fri, 28 Aug 2026 00:00:00 GMT

On February 21, 2025, attackers stole roughly $1.5 billion in ether from the exchange Bybit: about 500,000 ETH, the largest crypto theft on record. Five days later the FBI formally attributed it to North Korea's TraderTraitor operation, better known as Lazarus Group, and published 51 Ethereum addresses already busy moving the money.

What happened next is the part worth studying. Within about ten days, essentially the entire haul had been moved. For comparison: the 2016 Bitfinex thieves sat on their coins for years and still got caught. Lazarus treats laundering as a race, and in 2025 it ran the race in record time.

The pipeline

Step one: fragment. The ETH was immediately split across hundreds of fresh wallets, standard practice to multiply the tracing work before analytics firms can label addresses.

Step two: hop chains. The bulk was converted from ether to bitcoin using THORChain, a decentralized cross-chain swap protocol with no operator to serve papers on and no KYC to fail. Analysts tracking the flows reported THORChain processed over $5.5 billion in volume in that window, with roughly 86% of the stolen funds ending up as ~12,800 BTC spread across some 9,100 wallets.

Step three: wash through no-KYC services. A meaningful share passed through eXch, a swap service that openly declined to block the FBI-flagged addresses. That decision had a price: German federal police seized eXch's servers on April 30, 2025, taking 8 terabytes of data and €34 million in crypto, and stating the service had laundered about $1.9 billion overall.

Step four: cash out slowly. From thousands of BTC wallets, the funds drip toward OTC brokers and buyers: the patient retail end of the operation, where North Korea's networks convert coins into currency and goods.

Why it was so fast

Three structural reasons, each covered in depth in the technique pages linked below.

First, cross-chain infrastructure has no chokepoint: a decentralized protocol cannot freeze funds even when the FBI names the addresses on day five. Second, speed beats attribution: freezing requires a cooperative service holding the funds at the moment of the request, and Lazarus simply outran the paperwork, leaving only ~3% frozen. Third, state sponsorship removes the usual constraint: an ordinary criminal needs to cash out without being identified; Lazarus is already identified, indicted, and sanctioned, and simply does not care.

The Bybit laundering run is the strongest version of an argument that runs through the whole crypto section of this site: the ledger is public, the analytics are excellent, the attribution took days, and the money still left. Detection is not the same as recovery.

What TD Bank's guilty plea changed

Fri, 28 Aug 2026 00:00:00 GMT

On October 10, 2024, TD Bank's US subsidiary did something no American bank had done before: it pleaded guilty to conspiracy to commit money laundering. Not a deferred prosecution, not a consent order: a felony conviction, plus about US$3.09 billion in combined penalties across the DOJ (~$1.8 billion), FinCEN ($1.3 billion, its largest-ever penalty against a bank), the OCC ($450 million), and the Federal Reserve ($123.5 million).

What the schemes looked like

Prosecutors said TD failed to monitor roughly $18.3 trillion in customer activity between 2014 and 2023, and that three laundering networks moved more than $670 million through its accounts. The largest was run by Da Ying Sze, known as "David," who pleaded guilty in 2022 to laundering $653 million (over $470 million of it through TD) while handing TD employees more than $57,000 in gift cards. Another scheme saw five TD insiders issue dozens of ATM cards that moved about $39 million to Colombia. A third moved over $100 million tied to fentanyl proceeds.

None of the techniques were exotic. Bulk cash deposits nobody questioned, structured activity nobody aggregated, insiders nobody audited. The DOJ's theory was simple: years of flat compliance spending while the bank grew made TD the path of least resistance for cash that other banks would have flagged.

What actually changed

Three things distinguish this from the parade of bank AML settlements before it.

The guilty plea itself. HSBC (2012) got a deferred prosecution agreement. TD got a conviction. That matters less for punishment than for precedent: DOJ showed it will take a systemically important bank to a plea, ending a decade of assumptions that no such bank could be convicted without financial chaos.

The asset cap. The OCC capped TD's US retail assets, the first cap of its kind since Wells Fargo's in 2018. A fine is a cost of doing business; a growth cap is a strategy tax that compounds every quarter it stays on. It is the main reason TD's US expansion plans stalled.

The monitor and the lookback. Guidepost Solutions was approved as independent monitor in February 2025, and TD is spending on the order of a billion dollars on remediation, including re-reviewing years of transactions it should have flagged the first time. Suspicious-activity reports from that lookback keep feeding investigations, which is how bank penalties turn into downstream prosecutions of actual launderers.

What it didn't change

The incentives that produced the failure are industry-wide: compliance is a cost center, monitoring systems drown analysts in false positives, and the penalty, even at $3 billion, arrived a decade after the conduct began. Whether the first bank money-laundering conviction changes behaviour at other institutions, or just changes how carefully they write internal jokes, is the question the next case will answer.

For the mechanics the TD networks used, see the technique pages on structuring and money mules; for how reports and monitoring are supposed to work, see the detection section.

Why they call it the Vancouver Model

Fri, 28 Aug 2026 00:00:00 GMT

Most laundering techniques get generic names. British Columbia managed to get a typology named after its biggest city: the "Vancouver Model," a term used by academics and regulators for a specific triangle of drug cash, Chinese capital flight, and casino chips.

The triangle

Start with two groups who each have a problem. Drug networks in BC hold large amounts of Canadian cash they cannot bank. Meanwhile, wealthy Chinese citizens want to move savings out of China, past its annual foreign-exchange limits, money that is often perfectly legal at home but cannot lawfully leave.

An underground bank sits in the middle and solves both problems at once. The high-roller arriving in Richmond gets a suitcase of the drug network's $20 bills to gamble with, often delivered straight to the casino parking lot. In exchange, the gambler's family in China transfers the equivalent in yuan to an account the network controls there. The drug organization gets value in China it can use to buy precursor chemicals or goods; the gambler gets spendable money in Canada; nothing crosses a border, and the casino turns street cash into chips, cheques, and winnings.

In July 2015 alone, the River Rock Casino in Richmond accepted roughly C$13.5 million in $20 bills. Suitcases and hockey bags of cash appear throughout the inquiry testimony.

The collapse of E-Pirate

The RCMP's answer was E-Pirate, its largest-ever money laundering investigation, aimed at the Richmond underground bank Silver International, alleged to be moving hundreds of millions a year. In November 2018, prosecutors stayed all charges after the identity of a confidential informant was inadvertently disclosed to the defence. Canada's flagship laundering prosecution ended without a verdict, and one of the accused was later shot dead in a Richmond restaurant.

That collapse, as much as the suitcases, is why the story became a public inquiry.

What the Cullen Commission found

Justice Austin Cullen's final report (June 2022, roughly 1,800 pages, 101 recommendations) concluded that money laundering in BC ran to billions of dollars a year, that federal enforcement had been largely ineffective, and that the casino pattern was real and persistent. A separate 2019 expert panel had estimated about C$7.4 billion laundered in BC in 2018, a model-based figure Cullen treated with caution, but one that framed the debate.

Since then BC has built tools the rest of Canada watches: a public land-ownership transparency registry, unexplained wealth orders (added May 2023, first applications filed that December), and tighter casino source-of-funds rules that have largely ended the suitcase era at the cage.

Why the name matters

The Vancouver Model is really two techniques fused: casino placement and the mirror-transfer logic of Chinese underground banking, where value moves by matching two flows rather than by crossing a border. The same demand (capital flight meeting criminal cash) powers cartel laundering networks across North America. Vancouver just supplied the most vivid stage set, and, thanks to the inquiry, the best-documented one.