Highlights
- Launderers handling funds from the $387 million Bitget exploit are soliciting order support in public Discord servers and Telegram channels, according to ZachXBT.
- One alias tied to the laundering was previously seen moving proceeds of the $292 million Kelp DAO theft earlier this year.
- Bitget CEO Gracy Chen said attackers used a zero-day flaw in a third-party security product to obtain internal credentials; private keys were not exposed.
- By 16:50 UTC+8 on September 28, Bitget had processed roughly 7,683 BTC withdrawal requests totaling about 3,609 BTC.
The people cleaning up the proceeds of 2026's largest crypto theft are not hiding in the dark web. They are posting in public chat rooms.
On-chain investigator ZachXBT said on September 28 that a group of Chinese illicit actors laundering funds from the roughly $387 million Bitget exploit, on behalf of the alleged North Korean attackers, has been openly asking for help with orders in the public Discord servers and Telegram channels of the services they rely on. He identified several aliases involved, and said one of them had also been seen laundering stolen funds from the $292 million Kelp DAO exploit earlier this year.
That overlap matters. It suggests the Bitget cash-out is being run through an established professional network rather than an improvised operation, the same kind of for-hire laundering pipeline investigators have repeatedly linked to North Korea's state-backed hacking units. ZachXBT said he had observed the identical pattern after several other attacks attributed to TraderTraitor, a DPRK cluster that sits under the broader Lazarus umbrella, and that he plans to publish more data in the coming weeks. For now, the stolen funds are hopping between chains through cross-chain bridges and being deposited into mixers such as Wasabi.
Handles flagged in the disclosure include cc02006 and jack_34808. Neither the services whose channels were used nor the individuals behind the aliases have publicly responded.
How the attackers got in
The laundering update landed on the same day Bitget's leadership gave its most detailed account yet of the breach itself. Speaking during a September 28 livestream, CEO Gracy Chen said the attackers exploited a zero-day vulnerability in a third-party security product to obtain internal network credentials. With those credentials, they issued fraudulent withdrawal commands to the exchange's wallet system, effectively getting Bitget's own approval process to sign off on the transfers.
That distinction is central to the exchange's defense. Private keys were never compromised and cold wallet assets were untouched, Bitget has said, and its head of Greater China, Xie Jiayin, described the incident as a supply-chain attack targeting third-party security software. It is the first security incident in Bitget's eight-year history, he said. Mandiant and SlowMist are conducting an independent review, and the exchange has pledged to overhaul how it monitors and manages third-party components.
Related: Bitget Sets Withdrawal Restart for Sept. 28 as Hack Losses Hit $387.5M
The attribution to North Korea rests on IP behavior and on-chain signatures that Bitget says are consistent with DPRK-linked groups. That aligns with the picture that has formed since the exchange first pointed to North Korea as the loss estimate climbed, and with the growing body of government work on Pyongyang's crypto operations, including the recent move by Japan, the US and Germany to jointly expose the WaterPlum hacking group.
Withdrawals come back, chain by chain
Chen also explained why withdrawals are returning in stages rather than all at once. The breach hit withdrawal infrastructure spanning multiple chains and assets, so each chain has to be checked and brought back separately. Bitcoin went first, with BTC withdrawals on the Bitcoin network reopening at 08:00 UTC on September 28.
Early data from the restart looked orderly. As of 16:50 UTC+8, Bitget said it had handled about 7,683 BTC withdrawal requests worth roughly 3,609 BTC, with no backlog, and around 6,946 of those had already been confirmed on-chain. ETH withdrawals across Ethereum, BNB Smart Chain, Arbitrum, Base and Optimism are scheduled for September 29, followed by USDT on September 30 and remaining tokens and fiat on October 2, each at 08:00 UTC.
To fund the restart, 2,042.28 BTC (about $169 million) was moved from the exchange's roughly 5,500 BTC protection fund into hot wallets ahead of time, according to on-chain analyst Ai Yi, with another 3,457.72 BTC still sitting in the fund. She cautioned that the transfer was made in advance and should not be misread as a warning sign. Bitget has said user losses will be fully covered by the fund and that it will top the fund back up to at least $300 million within a week of drawing on it.
Why public laundering is still hard to stop
It may seem strange that launderers would advertise in the open. But the channels in question belong to the services they already use, and the flows themselves are moving through bridges and mixers built to resist freezes. Stablecoin issuers have frozen small slices of the loot, roughly 99,990 USDC and 218,023 USDT by September 26, yet the bulk of the stolen assets sits in ETH, XRP, ZEC and BTC, which no issuer can claw back.
The next checkpoint is whether the services named in ZachXBT's follow-up data act on the aliases, and whether the ETH withdrawal restart on September 29 goes as smoothly as Bitcoin's did. Bitget has also said a formal incident report is coming, which may clarify whether other firms relying on the same security product face similar exposure.
