Key Takeaways
- ZachXBT says actors laundering funds from Bitget’s $387.5 million hack are openly seeking transaction support in public Discord and Telegram channels.
- One alleged laundering operator was previously observed handling funds from April’s $292 million Kelp DAO exploit.
- NEAR Intents says its SHIELD system identified more than $50 million in attempted Bitget-linked flows and prevented most from passing through its infrastructure.
The laundering trail from the $387.5 million Bitget hack has produced an unusual lead: some of the people allegedly moving the stolen crypto appear to be asking for help in public Discord servers and Telegram channels.
Blockchain investigator ZachXBT said Chinese illicit actors are laundering funds on behalf of the suspected North Korean attackers, identifying five aliases and publishing transaction hashes he says connect them to the operation.
The funds are being moved between blockchains via bridges before reaching privacy services such as Wasabi, according to the investigator.
Bitget has confirmed that approximately $387.5 million was sent to attacker-controlled addresses during the Sept. 24 breach, up from its initial $351.6 million estimate after investigators identified additional Zcash and TRON losses. The stolen assets included ETH, XRP, USDT, USDC, ZEC, and several other tokens.
One Alias Connects Two of 2026’s Biggest Crypto Hacks
The most significant part of ZachXBT’s findings may be what happened months before Bitget was attacked.
One operator he labels “Alias 4,” using the names “lolo” and “Marin,” was also allegedly involved in laundering assets from the $292 million Kelp DAO exploit in April.
That attack drained 116,500 rsETH from Kelp’s LayerZero-powered bridge. Chainalysis later attributed the operation to North Korea’s Lazarus Group, saying attackers compromised off-chain infrastructure to make a fraudulent cross-chain transaction appear valid.
ZachXBT says he has observed similar laundering behavior following multiple attacks attributed to TraderTraitor and plans to publish more evidence about the groups.
The connection is notable because TraderTraitor is not merely a crypto-community label. The FBI uses the name for North Korean cyber activity and previously attributed the $308 million DMM Bitcoin theft and the $1.5 billion Bybit hack to TraderTraitor actors.
The evidence published by ZachXBT does not, however, independently establish that the Bitget attackers themselves were North Korean. Bitget has described the attackers as sophisticated and suspected a North Korean connection, while its investigation remains ongoing.
NEAR Says It Stopped $50M From Moving Through Intents
The investigation is also exposing how cross-chain infrastructure providers respond when stolen funds arrive.
NEAR Intents said its SHIELD risk-intelligence system detected more than $50 million in attempted transfers associated with the Bitget attackers.
Only around $166,000 ultimately passed through, while roughly $503,000 was frozen during execution, according to reports on the system’s response.
NEAR co-founder Illia Polosukhin argued that permissionless infrastructure does not require every application or liquidity provider to process every transaction.
That distinction is becoming increasingly important as hackers move stolen assets through bridges, swaps and mixers faster than centralized exchanges can freeze them.
The Bitget trail suggests another weakness for laundering networks: blockchains may be pseudonymous, but repeated use of the same operators, services, and even public support channels can leave patterns that investigators can follow across separate multimillion-dollar hacks.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
