Blockchain investigator ZachXBT has identified individuals allegedly laundering funds from the $387.5 million Bitget hack. According to his findings, these actors are Chinese money launderers working for suspected North Korean attackers. They have been openly requesting customer support in public Discord and Telegram channels of services used to move stolen assets.
The Bitget exchange lost $387.5 million on September 24. CEO Gracy Chen stated that attackers manipulated the internal approval system to authorize transfers. ZachXBT linked five specific accounts to transactions, noting that users complained to the THORChain swap service about failed XRP-to-Bitcoin exchanges. One user reported that 277,724 XRP were sent, but only 431 were returned.
ZachXBT identified a connection to the $292 million Kelp DAO exploit in April, noting that one of the accounts involved in the Bitget case also laundered funds from that incident. The investigator stated that these groups follow patterns attributed to the North Korean hacking group TraderTraitor, which the FBI previously linked to the $308 million theft from DMM Bitcoin in 2024.
The stolen funds are currently being moved across blockchains via bridges and mixers like Wasabi. While THORChain has declined to block the wallets associated with the attackers, Bitget announced that withdrawals would resume on Monday. ZachXBT intends to publish additional data regarding these groups in the coming weeks.
