Launderers moving $387 million from Bitget exploit seek help in public chats, ZachXBT says
On-chain investigator ZachXBT reported that Chinese illicit actors laundering funds from the $387 million Bitget exploit on behalf of alleged North Korean attackers are seeking assistance in public Discord and Telegram support channels.
Chinese illicit actors laundering proceeds from the $387 million Bitget exploit on behalf of alleged North Korean attackers have been openly asking for order support inside the public Discord servers and Telegram channels of crypto services they use, according to on-chain investigator ZachXBT. Stolen funds are reportedly being routed across cross-chain bridges and deposited into mixing protocols such as Wasabi.[4][5][2][3]
ZachXBT detailed five aliases tied to the activity—Cc, jack, Melon, lolo / Marin, and HELP ME—releasing their Discord handles, user IDs, and corresponding transaction hashes. One of the operators, Alias 4 (lolo / Marin), was also detected laundering funds from the $292 million Kelp DAO exploit earlier this year. ZachXBT noted that this activity mirrors methods seen across multiple exploits attributed to the TraderTraitor threat group, adding that he intends to publish additional tracking data in the coming weeks.[4][2][5]
In one documented exchange, a suspected launderer sought help in THORChain's public Discord server regarding an uncompleted XRP-to-BTC swap, writing, "Losing my assets would cause a lot of trouble in my life."[1]
Key facts
- ZachXBT reported that Chinese illicit actors are laundering funds from the $387 million Bitget exploit for alleged DPRK attackers.
- The launderers have openly sought help with orders in public Discord servers and Telegram channels of services they utilize.
- Stolen assets are being moved across bridges and deposited into privacy mixers like Wasabi.
- ZachXBT named five aliases—Cc, jack, Melon, lolo / Marin, and HELP ME—with associated Discord or Telegram account IDs and transaction hashes.
- Alias 4 (lolo / Marin) was previously tied to laundering funds from the $292 million Kelp DAO exploit earlier in the year.
- A suspected launderer asked for support with a stuck XRP-to-BTC swap in THORChain's Discord, stating that losing the assets would cause significant personal trouble.
- ZachXBT observed identical patterns following other TraderTraitor-linked attacks and indicated he will publish more tracking data in the coming weeks.
Sources · 5 sources
- SO
SolanaFloor@SolanaFloorPost on X ·
NEW: A suspected launderer for the alleged DPRK attackers behind the $387M @Bitget hack asked for help with a stuck $XRP to $BTC swap in @THORChain’s public Discord. “Losing my assets would cause a lot of trouble in my life.” Screenshot Credit: @zachxbt https://t.co/m0QRqFXOXF
Open source - CB
Crypto Banter@crypto_banterPost on X ·
🚨HACKERS ARE ASKING FOR HELP MOVING BITGET FUNDS! @zachxbt said Chinese illicit actors moving the $387 million Bitget exploit for the alleged DPRK attackers are asking for help in public Discord and Telegram groups. He tied one of the same aliases to the earlier Kelp DAO $292 million exploit and said the pattern matches other TraderTraitor jobs he has tracked.
Open source - CB
Crypto Briefing@Crypto_BriefingPost on X ·
🚨JUST IN: ZachXBT said Chinese illicit actors tied to the $387M Bitget exploit are openly seeking help laundering funds through public Discord servers and Telegram channels. He also linked one actor to the $292 million Kelp DAO exploit. https://t.co/lYQLWiUVsi
Open source - ZA
ZachXBT@zachxbtPost on X ·
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use. Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year. I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks. Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi. Alias 1 - Cc Discord: cc02006 Discord ID: 1351486674386948148 Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363 Alias 2 - jack Discord: jack_34808 Discord ID: 1553705721768714377 Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69 Alias 3 - Melon Discord: under0346 Discord ID: 1394240539108573215 Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B Alias 4 - lolo / Marin TG: pvpcz TGID: 6223514198 Discord: losern Discord ID: 1024415186527985704 Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15 Alias 5 - HELP ME Discord: helpme031897 Discord ID: 1554035533817188384 Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
ZachXBT: Bitget Hack Funds Are Being Laundered Through Cross-Chain Bridges and Wasabi According to ZachXBT, Chinese illicit actors allegedly laundering funds from Bitget’s $387.5 million hack on behalf of suspected North Korean attackers have been openly seeking order support through Discord and Telegram channels tied to services they use. He said one operator, known as “Alias 4,” was also involved in laundering funds from the $292 million Kelp DAO exploit earlier this year, with similar patterns observed after other TraderTraitor-attributed attacks. The funds are currently being moved across chains and deposited into mixing services including Wasabi. ZachXBT said he plans to publish additional data in the coming weeks.
Open source