preferred on
Points of Focus
- ZachXBT ties one alias to laundering both Bitget and Kelp DAO hack funds.
- Bitget’s $387.5-million hack fits a record year for North Korean crypto theft.
- THORChain refused Bitget’s request to block the addresses moving the funds.
Onchain investigator ZachXBT identified four Discord and Telegram aliases laundering funds from Bitget’s $387.5-million September hack and said one of those aliases was also seen laundering funds from April’s Kelp DAO exploit, a separate hack already attributed to North Korea.
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen… pic.twitter.com/KfdTo51M2o
— ZachXBT (@zachxbt) September 28, 2026
Bitget’s security disclosures confirm the hack: a backend approval-system exploit on Sept. 24, 2026, at 18:31 UTC that moved an initial $351.6 million, later revised to $387.5 million, to attacker-controlled addresses across Ethereum, other Ethereum Virtual Machine chains, XRP Ledger, Zcash, and Tron.
ZachXBT finds a repeat launderer across two separate DPRK-linked hacks
ZachXBT’s Sept. 27, 2026, post names the aliases as “Cc,” “Jack,” “Melon,” and “Lolo,” also going by “Marin,” each listed with a Discord handle, Discord ID, and at least one onchain transaction tied to the Bitget hack; the Marin transaction alone moved 431.08696 XRP (XRP) through THORChain before a portion was refunded and rerouted.
He wrote that Lolo/Marin was “also seen laundering funds from the Kelp DAO $292M exploit earlier this year.” He said he has “observed the same pattern after multiple TraderTraitor attributed exploits,” adding that he has “closely tracked these groups” since.
That Kelp DAO connection has independent backing. LayerZero’s incident statement on the April 18, 2026, exploit, which drained approximately $290 million from Kelp DAO’s rsETH configuration through a compromised single-verifier setup, says, “Preliminary indicators suggest attribution to a highly-sophisticated state actor, likely DPRK’s Lazarus Group, more specifically TraderTraitor.”
Screenshots accompanying ZachXBT’s post also show two of the aliases, Jack and Cc, publicly pleading with THORChain-based swap services for help after their swaps got stuck or refunded, with one support representative joking back, “Will Kim get mad? You chose the wrong job pal.”
Bitget’s hack fits a record year for North Korean crypto theft
North Korean hackers stole $2.02 billion in cryptocurrency in 2025, a 51% year-on-year increase that pushed their all-time total to $6.75 billion, according to Chainalysis.
Bitget CEO Gracy Chen has publicly said North Korea is suspected in the hack, and the exploit method itself, a manipulated internal approval system rather than stolen private keys, matches tactics security researchers have tied to DPRK-linked operators infiltrating exchange infrastructure rather than cracking cryptography directly.
TraderTraitor, the subgroup ZachXBT and LayerZero both point to, is not a label either party invented. The US Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency, and the US Treasury Department jointly named TraderTraitor as a North Korean state-sponsored group targeting blockchain companies as far back as April 2022, well before either the Kelp DAO or Bitget hacks.
A single laundering network surfacing across two of 2026’s largest exploits fits a pattern federal advisories have already flagged as recurring, not incidental.
THORChain refuses to block the addresses Bitget flagged
Bitget has pressed THORChain to block the addresses now moving funds through its network. THORChain rejected that request. In a Sept. 27, 2026, post on X, the protocol said, “A THORChain network halt is an emergency security mechanism designed to protect the protocol,” adding that “a halt is not a selective freeze of specific funds or an individual swap.”
A THORChain network halt is an emergency security mechanism designed to protect the protocol.
A halt is not a selective freeze of specific funds or an individual swap.
During the May 2026 exploit that resulted in $10.7M stolen from the liquidity pools, the attackers addresses… https://t.co/HrigTUbA4Q
— THORChain (@THORChain) September 28, 2026
It pointed to its own May 2026 exploit, in which $10.7 million was stolen from its liquidity pools, as an example of a full protocol halt used to contain damage, distinct from singling out any one address. The protocol has positioned itself as permissionless infrastructure comparable to Bitcoin or Ethereum, unable to discriminate against specific addresses without breaking that design. This argument puts THORChain’s technical neutrality claim directly at odds with Bitget’s demand for a targeted intervention.
That stance leaves the aliases ZachXBT identified free to keep routing funds, which he said are currently being chain-hopped across bridges and deposited into mixing services such as Wasabi. He has said he plans to share more data on these groups “in coming weeks,” raising the prospect of a larger, named laundering network rather than a one-off case tied to a single hack.
Share
Most read articles
