According to CoinMeta, nearly $1.5 billion stolen by North Korean hackers through Bybit needs to be realized through grey payment intermediaries. On-chain analyst ZachXBT acted as an undercover agent using 349,700 USDC to obtain clues about funds across multiple chains, locking in over $12 million and prompting Tether to freeze some of the USDT. The investigation shows that it is not possible to trace the perpetrators solely based on on-chain data; cross-referencing private transaction records with intermediary connections is necessary. Although regulatory actions have targeted these platforms, the criminal network continues to operate with the help of multiple intermediaries, relying on complex funding channels and trust networks to realize the stolen funds.