preferred on
Points of Focus
- ZachXBT identified five aliases he alleges are laundering funds from the $387.5-million Bitget hack for suspected North Korean attackers.
- Several alleged intermediaries appeared in public Discord and Telegram support channels, while stolen funds moved through bridges and mixing services.
- Near Intents said its SHIELD system detected more than $50 million in attempted laundering flows, while $166,000 passed through the protocol and $503,000 was frozen during execution.
Suspected intermediaries moving funds from Bitget’s $387.5-million hack have appeared in public support channels as stolen assets continue moving through cross-chain infrastructure.
The laundering activity extends the Sept. 24 Bitget breach, which initially carried an estimated loss of $351.6 million. Bitget later raised the figure to $387.5 million after adding Zcash and Tron transfers to its accounting.
Suspected Bitget launderers appear in public chats
Blockchain investigator ZachXBT identified five aliases he alleges were laundering funds from the exploit on behalf of alleged Democratic People’s Republic of Korea (DPRK) attackers.
His Sept. 28 investigation linked each alias to specific transactions and documented accounts asking for support with orders in public Discord servers and Telegram channels used by the services processing their transfers.
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen… pic.twitter.com/KfdTo51M2o
— ZachXBT (@zachxbt) September 28, 2026
ZachXBT said funds were being moved between chains through bridges and deposited into mixing services, including Wasabi. One alias had also appeared in laundering activity connected to the $292-million Kelp DAO exploit earlier this year, according to his analysis. The identities of the account operators and their alleged DPRK links have not been independently established.
Large hacks have repeatedly produced complicated cross-chain trails. More than 230 million in USDC (USDC) moved between Solana and Ethereum during the Drift Protocol exploit, while recent incidents have pushed some protocols to reassess cross-chain infrastructure.
Near Intents detects $50 million in attempted laundering flows
Near Intents general manager Alex Shevchenko said the protocol’s SHIELD risk-intelligence system detected more than $50 million in attempted laundering flows linked to the Bitget hack after duplicate transactions were removed.
Around $166,000 passed through Near Intents, while $503,000 was frozen during execution and remains restricted pending legal and recovery procedures. Shevchenko reported the estimates could deviate by as much as 10% because some transactions may be mislabeled.
Near Intents’ flow analysis shows the largest unidentified protocol handled at an estimated $94.5 million, followed by a native bridge at $39 million and another protocol at $18.5 million.
The distribution shows how exploit proceeds spread across multiple services and chains, a pattern also seen in the recent fake GIWA network incident and other multichain hot-wallet attacks.
Bitget traces hack to third-party security product
Bitget attributed the breach to a vulnerability in a third-party security product that allowed attackers to obtain internal credentials, generate forged withdrawal commands, and bypass risk verification. The exchange said its private keys and cold wallets remained secure.
Bitget began restoring withdrawals on Sept. 28, while investigators continued tracking the stolen assets. The exchange has offered a recovery bounty as efforts to identify, freeze, and return funds continue.
Share
Most read articles
