Bitget Hackers Ask for Help in Public Chats
ZachXBT links the suspected launderers to THORChain and SwapKit Discord and Telegram channels, with traces pointing to North Korean TraderTraitor hackers.
Key Takeaways
- Suspected launderers behind the Bitget hack openly asked for help in public Discord and Telegram chats.
- ZachXBT linked five accounts to transactions and saw complaints about XRP-to-Bitcoin swaps that never arrived.
- The case is tied to earlier hacks and to TraderTraitor, a North Korean group according to the FBI.
The suspected launderers behind the $387.5 million (€340 million) hack at Bitget reportedly asked for help openly in public chat rooms, according to blockchain researcher ZachXBT. The group is made up of Chinese money launderers who are said to be working for the suspected North Korean attackers. What stands out is that they asked their questions in Discord and Telegram channels for the services they were using to move the stolen crypto further.
Open Questions in Chat Rooms
ZachXBT said he has linked five accounts to separate transactions. In his screenshots, the accounts complain to THORChain staff, a network that lets coins be swapped between blockchains without an account, that swaps from XRP to Bitcoin had not arrived.
That fits the broader role THORChain plays in this case: the service had already refused to block the Bitget hack wallets, which allowed the stolen funds to be moved through the protocol.
A user named Cc wrote that 277,724 XRP had been sent and only 431 came back. Another user, jack, said losing the assets would cause “many problems in my life.” A moderator from the swap service SwapKit responded with a photo of Kim Jong Un.
Link to Earlier Hacks
According to ZachXBT, one of the accounts, lolo, is also involved in laundering money from the $292 million (€256 million) Kelp DAO hack in April. In the chat, lolo confirmed that he also uses the name Marin on Telegram.
The researcher said he has seen the same pattern after multiple attacks attributed to TraderTraitor. That is the name the FBI uses for a North Korean hacking group. The FBI previously also linked that group to the theft of $308 million (€270 million) from Japanese crypto exchange DMM Bitcoin in 2024. In 2025, North Korean hackers are estimated to have stolen about $2.02 billion (€1.8 billion) in crypto, according to earlier estimates, making up nearly 60% of all reported crypto thefts that year.
Why This Matters
The case shows how hard it is to move stolen crypto quickly and quietly, even when attackers use multiple blockchains and mixers. For European crypto users, that matters because it shows how strong the debate remains around security, tracing, and the role of intermediaries. Bitget said withdrawals will reopen on Monday, while ZachXBT said he plans to share more data about the groups involved later.
