ZachXBT says $387 million Bitget hack suspects seek help in public chats

ZachXBT said people allegedly laundering money from the $387 million Bitget hack asked for customer support in public chats. He said the group were Chinese money launderers working for suspected North Korean attackers. He said they posted openly in Discord servers and Telegram channels for services used to move the funds. ZachXBT identified five accounts and matched each one to a transaction. Screenshots showed the accounts complaining to THORChain staff that XRP-to-Bitcoin swaps had not arrived. Bitget lost $387.5 million on September 24. Bitget CEO Gracy Chen said attackers tricked the exchange's internal approval system into signing the transfers. Chen said North Korea was "very likely" behind the attack. One account named "Cc" wrote that 277,724 XRP went in but only 431 came back. An account named "jack" wrote that losing the assets "would cause a lot of trouble in my life." A moderator for the swap service SwapKit replied with a photo of Kim Jong Un. ZachXBT said an account named "lolo" also laundered money from the $292 million Kelp DAO exploit in April. In the chat, lolo confirmed using "Marin" as a name on Telegram. ZachXBT wrote that he had observed the same pattern after multiple exploits attributed to TraderTraitor and had closely tracked the groups. The FBI uses TraderTraitor as the name for a North Korean hacking group. The FBI blamed the group for the $308 million theft from Japanese exchange DMM Bitcoin in 2024. ZachXBT said funds were moving between blockchains through bridges and reaching mixers such as Wasabi. Wasabi is a wallet that blends coins to hide their trail. THORChain has refused to block wallets tied to the attackers. Bitget said it would reopen withdrawals Monday. ZachXBT plans to release more data on the groups in the coming weeks.