Chinese Launderers Openly Solicit Business for Alleged $387M Bitget Heist
Blockchain investigator ZachXBT says a cluster of Chinese money-laundering operators is publicly advertising for business in Discord and Telegram while allegedly moving funds from the $387 million Bitget exploit on behalf of suspected North Korean attackers.
The bigger picture
Bitget said assets equivalent to approximately $390.06 million were transferred to attacker-controlled addresses across multiple networks following the hack, which TRM Labs has linked to wallets used in previous North Korean hacks, including Bybit and AFX Bridge, pointing to the involvement of TraderTraitor. Elliptic said it spotted connections between stolen Bitget funds and addresses involved in the laundering of previous DPRK-attributed exploits, including the exploit of Bybit in 2025.
How the funds are moving
According to the report, launderers are chain-hopping stolen crypto through bridges before feeding it into mixing services such as Wasabi. That matches independent tracing: the final step in the chain brought funds to Wasabi, a Bitcoin wallet service built around the CoinJoin technique, which combines Bitcoin inputs and outputs from many participants to make tracing harder. AMLBot said roughly 4.59 BTC was split into smaller amounts before being sent into a CoinJoin round, with about 4 BTC in that round traced back to a Bitget-linked TRON wallet.
Who's named
ZachXBT's report identifies five aliases allegedly soliciting laundering orders in public servers, each tied to a Discord handle and on-chain transactions: Cc (Discord: cc02006) jack (Discord: jack_34808) Melon (Discord: under0346) lolo / Marin (Telegram: pvpcz; Discord: losern) — also allegedly seen laundering funds from the $292 million Kelp DAO exploit HELP ME (Discord: helpme031897)
None of these identifications have been independently confirmed, and the claims rest on ZachXBT's own tracking of the wallets and chat handles.
What happens now
ZachXBT says he has tracked the same laundering pattern across multiple TraderTraitor-attributed exploits and plans to publish more data on these groups in the coming weeks. Bitget, meanwhile, said the vulnerability had been fixed and promised to announce a withdrawal plan as the hunt for the stolen funds continues.