On-chain investigator ZachXBT has uncovered careless slip-ups by the money laundering ring behind the $387.5 million Bitget crypto exchange hack. Chinese illicit actors tasked with laundering funds for suspected North Korean (DPRK) hackers were caught red-handed seeking operational help in plain sight. They relied on public Discord servers and Telegram channels run by the very crypto services they used to obfuscate the stolen funds.
ZachXBT highlighted one particular operator using the screen name “Alias 4,” who was seen regularly posting technical inquiries in public chat channels. This open communication pattern shatters conventional notions of operational secrecy in cybercrime. Despite moving hundreds of millions of dollars in illicit proceeds, the operatives relied on public discussion boards - freely monitored by blockchain analysts - to guide their moves.
Laundering Routes Across Different Networks
The Bitget laundering scheme spanned multiple privacy-preserving and cross-chain protocols. Prior tracking data showed the attackers deposited 4 BTC into Wasabi’s CoinJoin service to break transaction history. On another network, the perpetrators converted 2,390 ETH into Bitcoin to obscure their initial trail on the Ethereum blockchain.
Part of the loot also flowed through decentralized exchange networks. The culprits routed 101.5 BTC through THORChain’s infrastructure. THORChain maintainers previously chose to uphold network neutrality by refusing to freeze the hacker wallets, allowing the multi-million-dollar Bitcoin transfers to proceed uninterrupted.
However, the obfuscation efforts did not succeed everywhere. The NEAR Intents network stepped in to freeze $50 million in assets closely linked to the Bitget exploiter wallets. This intervention intercepted a sizable portion of the exchange’s total losses before the funds could vanish into more complex protocols.
User Trust Proves More Costly Than the Exploit Itself
The flurry of revelations regarding the laundering operators has done little to calm Bitget users. As soon as management reopened withdrawals last week, users prioritized moving their assets off the platform.
Reports from Bloomberg and Cointelegraph revealed that Bitget recorded net outflows of up to $463 million within just 24 hours of resuming service. This daily withdrawal volume significantly exceeded the total value of assets lost in the breach. The massive fund exodus signals that users remain wary of the exchange’s internal security, even as services come back online and the hackers’ trail is gradually exposed to the public.
Reported via @zachxbt on X.
Previously: Internal Wallet Vulnerability Patched, Bitget Resumes Gradual Withdrawals Starting September 28
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
