Zach XBT: $8.8 million of stolen funds is suspected to be connected with North Korea

Detectives say Bitget is suspected of laundering $387 million in stolen funds through mixers, with more details to be revealed in the coming weeks

Description: on-chain detectives say suspected North Korean attackers are laundering $387 million in stolen funds for Bitget, which was transferred to and deposited into a cryptocurrency service through cross-chain bridge , with multiple incidents of theft involved. Readers can learn about public clues such as tracking on-chain , risks of cryptocurrencies, platform security and subsequent data disclosure implications.

Tagged with: Bitget ;ZachXBT; mixed currency; stolen money; detectives

Featured image: Abstract technology and financial network style, depicting on-chain capital flows, hybrids nodes, audit trails and security barriers; no real person, exchange trademarks or specific price figures.

on-chain Detective Zach XBT publicly alleges that a group of alleged money launderers acting on behalf of the suspected North Korean attack camp is handling $ Bitget 387 million in stolen incident-related funds. According to his observation, these individuals are seeking support from subscribers through its Discord server and Telegram channels, with funds being transferred via cross-chain bridge , which were deposited into hybrid services such as Wasabi.

Public clues point to a pathway for crypto-hybrid backers

The key detail that ZachXBT mentions is the public seeking of sub-contractor support. This means that operators are not only transferring funds in secret, but also looking for people who can cooperate with executing transactions, splitting or converting assets within their commonly used community channels. For on-chain surveys, requests, addresses, service names and personnel codes from open communities often serve as an introduction to how restoration organizations collaborate.

In terms of how funds are moved, the original path given is cross-chain bridge in combination with a mixed-currency service. The role of cross-chain bridge , on the other hand, is to move assets from one chain to another while the mixed currency service attempts to cut off direct correspondence between input addresses and output addresses. Mixed currencies services such as Wasabi have been named indicating that investigators believe money may be entering more complex anonymized processing processes. Once this type of route has been completed, external tracking typically relies more heavily on address clusters, bridging behavior, time windows, and social information rather than relying solely on on-chain transfer records for final attribution.

Alias 4 vs TraderTraitor: Why this observation is not isolated

ZachXBT further notes that members of code name Alias 4 also laundered money for the $292 million robbery of Kelp DAO earlier this year. The value of this detail lies in its repeated occurrence. If the same code, community or operating model appears in different robberies, investigators typically consider it a possible trace of gang activity rather than random straying.

The article also mentions that the same pattern can be observed after multiple attacks have been attributed to TraderTraitor. "TraderTraitor" is a label often used in on-chain investigative contexts to describe one type of attack or money laundering activity. ZachXBT's putting together Bitget stolen funds, Kelp DAO stolen money and related incidents with Trader Traitor implies that he was trying to show that this wasn't an isolated case of transferring funds but could belong to some recurrent chain of operations.

Follow-up: data disclosure, tracking difficulties and platform wind control

ZachXBT said he plans to share more data in the coming weeks. For these types of incidents, follow-up disclosures are typically more critical than initial observations, as more complete data may include address bars, bridge paths, time spent interacting with mixers, evidence of community messages and connections to other stolen events. Only when this material is made public can outsiders judge how long a money laundering chain existed and which platforms or addresses might have been involved.

At the impact level, large amounts of stolen funds entering a cryptocurrency and cross-chain bridge can make asset freezes and tracking more complicated. Exchanges, on-chain analytics firms and law enforcement agencies need to simultaneously process information about on-chain , as well as off-chain : who ordered in the community; which bridges money passed through; whether crypto services remain analyzable; if pattern-related addresses have coincided with other events.