ZachXBT links Bitget hack launderers to North Korea-tied TraderTraitor group

Blockchain investigator ZachXBT says the Chinese money launderers moving funds from Bitget’s $387.5 million hack are openly asking support staff for help in public Discord and Telegram channels, exposing operational details of a network tied to North Korea. The finding links an active nine-figure exchange breach to the FBI-named TraderTraitor group already blamed for a $308 million theft from Japan’s DMM Bitcoin in 2024.

• Bitget lost $387.5 million on Thursday, September 24, when attackers hijacked its internal transaction approval system.
• ZachXBT identified five accounts pleading for order support in THORChain and SwapKit chat channels.
• One laundering account, “lolo,” also moved funds from April’s $292 million Kelp DAO exploit, per ZachXBT.

• $387.5M Bitget’s loss on Sept 24, the hack driving this laundering trail
• $308M DMM Bitcoin theft the FBI attributes to TraderTraitor in 2024
• $292M Kelp DAO exploit in April linked to the same operator
• 277,724 XRP sent by user “Cc” in a swap, versus 431 returned

People allegedly laundering proceeds from the $387.5 million Bitget hack have been requesting customer support in public chat rooms, according to reporting by BeInCrypto. The outlet cites blockchain investigator ZachXBT, who says the group are Chinese money launderers working on behalf of suspected North Korean attackers.

Bitget lost $387.5 million on Thursday, September 24, when attackers manipulated the exchange’s internal approval system into signing unauthorized transfers. Bitget CEO Gracy Chen said North Korea was “very likely” behind the breach.

Launderers seek THORChain and SwapKit support amid stalled swaps

ZachXBT named five accounts and matched each to a specific transaction moving funds from the hack. Screenshots posted to the investigator’s X account show the accounts complaining to staff at THORChain, a cross-chain swap network that requires no user account, that XRP-to-Bitcoin swaps never arrived.

One user identified as “Cc” wrote that 277,724 XRP went into a swap but only 431 came back. Another account, “jack,” told support staff that losing the funds “would cause a lot of trouble in my life.” A moderator for the swap service SwapKit responded to one query with a photo of Kim Jong Un.

FBI’s TraderTraitor label ties the case to 2024’s $308M DMM theft

ZachXBT said the pattern matches groups he has tracked across multiple exploits attributed to TraderTraitor, the name the FBI uses for a North Korean state-linked hacking group.

I’ve observed the same pattern after multiple TraderTraitor attributed exploits, and I’ve closely tracked these groups.

ZachXBT, blockchain investigator

The FBI blamed TraderTraitor for the $308 million theft from DMM Bitcoin in 2024. That case began when a North Korean actor posing as a LinkedIn recruiter sent a malicious Python script to an employee of Ginco, a Japanese wallet software firm, then used stolen session cookies to manipulate a legitimate DMM transaction request.

ZachXBT also linked one Bitget-hack account, “lolo,” to the $292 million Kelp DAO exploit in April, where the same operator went by “Marin” on Telegram. He said the Bitget funds are now moving across blockchain bridges into mixers such as Wasabi, a wallet that blends coins to obscure their trail.

Bitget reopens withdrawals Monday as THORChain declines to block wallets

Bitget said withdrawals would reopen Monday. THORChain has not blocked wallets tied to the attackers despite the public complaints documented in the chat logs, and SwapKit’s response to those complaints is not represented as a policy change in ZachXBT’s account.

The BlockWest read. The exposure of these chats gives exchanges and bridge operators a rare real-time map of a laundering pipeline, but mapping is not blocking. Until THORChain, SwapKit or comparable protocols adopt wallet screening, counterparties moving through them carry the same exposure regulators already flagged in the DMM Bitcoin case. Expect compliance teams handling North Korea-linked flows to face renewed scrutiny from banking partners.

ZachXBT said he plans to release additional data on these laundering groups in the coming weeks, a disclosure that could pressure THORChain and SwapKit to act on the wallets his research has already flagged.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.