ZachXBT reports that accounts allegedly laundering proceeds from the $387.5 million Bitget hack openly requested support in public Discord and Telegram channels. He matched five accounts to on-chain transactions, including one—"lolo"—previously tied to a $292 million Kelp DAO exploit. The investigator says funds are flowing across bridges and into mixers like Wasabi, while THORChain has declined to block implicated wallets. Bitget plans to reopen withdrawals and ZachXBT intends to release more data soon.
Suspected Launderers Behind $387.5M Bitget Hack Sought Help in Public Discord and Telegram, Investigator Says
Photo by BeInCrypto
Blockchain investigator ZachXBT says individuals believed to be laundering proceeds from the $387.5 million Bitget breach openly asked for technical help in public Discord and Telegram channels used to move stolen funds.
What Happened
Bitget disclosed a loss of $387.5 million on September 24. CEO Gracy Chen said attackers manipulated the exchange’s internal approval system to authorize transfers and that North Korea was "very likely" involved. Independent reporting and on-chain analysis have sought to trace how the funds were moved after the breach.
Investigation Findings
ZachXBT identified five accounts and linked each to specific on-chain transactions. Screenshots shared by the investigator show those accounts complaining in THORChain-related channels that XRP-to-Bitcoin swaps did not complete. One user, identified as "Cc," said 277,724 XRP was sent but only 431 XRP returned; another, "jack," wrote the loss would "cause a lot of trouble in my life." A SwapKit moderator reportedly replied in the chat with an image of Kim Jong Un.
ZachXBT Finds $387M Bitget Hack Suspects Asking for Help in Public Chats
The investigator also says one account, "lolo," previously laundered funds from the $292 million Kelp DAO exploit in April and confirmed in chat that they use the name "Marin" on Telegram. ZachXBT wrote that he has observed a repeated pattern across multiple incidents attributed to the group labeled TraderTraitor by the FBI.
How Funds Are Moving
According to ZachXBT, the stolen assets are being routed across blockchains via bridges and into coin-mixing tools such as the Wasabi wallet to obscure transaction trails. THORChain has declined to block wallets allegedly tied to the attackers, and some swap services have seen public pleas from the implicated accounts for support with failed transactions.
Responses And Next Steps
Bitget has said it plans to reopen withdrawals on Monday. The FBI has previously used the label TraderTraitor for a North Korean-linked group blamed for other large crypto thefts, including a $308 million heist from Japan’s DMM Bitcoin in 2024. ZachXBT said he plans to publish additional data about the groups and accounts involved in the coming weeks.
Note: Allegations cited in this report come from on-chain investigator ZachXBT and public chat screenshots; some links to state actors remain unconfirmed by independent law enforcement disclosures.
Help us improve.
