A total of $387 million from the Bitget exploit is moving through active laundering channels once again. On-chain investigator ZachXBT reported that an illicit syndicate from China is transferring the stolen assets on behalf of North Korean (DPRK) hacking groups. This capital flow does not stem from a new attack, but rather represents a continuation of the Bitget exploit, with funds now being cashed out through an intermediary network.
What sets this incident apart from typical crypto money laundering is the communication channels chosen by the perpetrators. Rather than operating in secret, the money launderers surfaced in open communication channels.
Seeking Help on Public Discord and Telegram Servers
Instead of carefully covering their tracks, the perpetrators openly requested technical support on public Discord servers and Telegram channels associated with the services they used. They asked platform operators and communities directly about technical hurdles in moving funds and procedures for swapping assets.
This casual attitude in public forums demonstrates the boldness of the perpetrators on the ground. ZachXBT noted that the syndicate likely feels safe from cross-jurisdictional law enforcement, given that differing national borders and limited international legal cooperation make it difficult for authorities to reach cybercriminals within their safe havens.
Involvement of Alias 4 and Proxy Syndicates
In the findings shared with the public, ZachXBT flagged the involvement of one specific identity: Alias 4. This entity was identified as playing a key role in facilitating the transfer of Bitget exploit funds from the source addresses to pre-arranged laundering pathways.
The involvement of Alias 4 underscores the tight coordination between the primary hackers and proxy networks. DPRK hacking groups rely on illicit facilitators in China to navigate complex transaction flows, ensuring that hundreds of millions of dollars can be moved gradually without immediately triggering exchange security systems.
DPRK’s Multi-Billion-Dollar Track Record
The DPRK hackers’ involvement in the Bitget case adds to a long list of large-scale crypto exploits tied to the group. Cumulative losses from North Korean cyber operations are estimated to have surpassed billions of dollars across global digital asset platforms.
For the crypto industry, the incident serves as a stern warning that security challenges do not end when system vulnerabilities are patched. As long as proxy networks feel immune to the law and freely request guidance on public forums, tracking down stolen assets will remain a formidable challenge for law enforcement and on-chain analysts.
Reported via @zachxbt on X.
Read also: Buying Ledger Outside Official Stores - User Loses $90M Wiped via CryptoBillis Reseller Device
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
