ZachXBT: Bitget-trail launderers ask for help in public Discord and Telegram

By Crypto Wire
September 28, 2026

The Bitget fund trail just got a human ops layer. On-chain investigator ZachXBT, wrapped by CoinDesk about 08:02 a.m. EDT (12:02 UTC) September 28, says Chinese illicit actors laundering funds from the roughly $388 million Bitget exploit on behalf of alleged DPRK attackers have been openly asking for support with orders in public Discord servers and Telegram channels of the services they use. This UPDATE links Monday’s THORChain swap tally (9939) rather than silent-editing that URL.

What ZachXBT published. His X thread names five aliases with Discord or Telegram usernames, numeric account IDs, and matching on-chain transaction hashes—company/investigator tape, not a desk re-run of Midgard or Wasabi fills. Screenshots in the thread show operators complaining to staff at THORChain-linked support about stalled XRP→BTC swaps, refunded transactions, and missing bitcoin payouts. One account, styled lolo on Discord and confirming Marin on Telegram, was also seen laundering funds from the roughly $292 million Kelp DAO exploit earlier in 2026, ZachXBT said. He framed the pattern as familiar after multiple exploits attributed to TraderTraitor, the name U.S. authorities use for a North Korea-linked hacking cluster.

How the hops fit the trail. ZachXBT said stolen funds are being hopped across blockchains through bridges and deposited into mixers such as Wasabi, a bitcoin wallet that pools coins to obscure provenance. That sits beside Monday’s CoinDesk read of about 2,390 ETH (~$6.3 million) into 75.2 BTC via 27 successful THORChain swaps from a Lookonchain-linked Bitget attacker wallet. Secondary wraps also cite a TRM Labs-watermarked flow chart in ZachXBT’s thread mapping Bitget exploit wallets into clusters tagged with the same aliases and onward into THORChain—attribute that chart to the investigator’s post, not an independent desk redraw. Bitget has already published attacker addresses, offered a 5% recovery bounty frame, and pressed THORChain to refuse tracked service; THORChain’s Monday reply still treats a network halt as protocol protection, not a selective freeze.

---

---

Why public support chats matter for collectors watching settlement rails. Cross-chain swap desks and mixer routes still depend on human support when an order stalls; if laundering crews use the same public Discord and Telegram lanes as ordinary users, investigators can pair chat handles with transaction hashes without waiting for a closed ticket dump. Secondary desk wraps also name SwapKit-linked channels among the venues where operators allegedly posted. ZachXBT says he plans to publish more data on the groups in the coming weeks. Do not invent that THORChain blacklisted the five aliases, that Bitget froze retail withdrawals because of the Discord posts, that every stalled XRP→BTC complaint in the screenshots later filled, or that the desk independently verified each Discord ID against a full AMLBot run. Stick to ZachXBT’s naming of five accounts, the public-support ask, the Kelp DAO overlap on the lolo/Marin alias, the bridge-and-Wasabi hop description, and CoinDesk’s same-day THORChain swap context.

How this differs from prior chapters. 9939 quantified Monday’s ETH→BTC THORChain batch. 9813 carried the permissionless reply to CEO Gracy Chen’s refuse-service ask. Sibling reopen LNs (9902, 9908, 9916) cover retail BTC restore and AMA throughput—operational rails, not launderer chat ops. Today’s new fact is ZachXBT’s Monday beat: five named support-channel aliases, open order troubleshooting on Discord/Telegram, Wasabi/bridge framing, and a Kelp DAO reuse claim on one handle. ETH reopen for Bitget retail still sits on September 29 on the hack-and-withdrawals tracker.

Bottom line: ZachXBT says Bitget-trail launderers working for alleged DPRK attackers are troubleshooting stalled swaps in public Discord and Telegram support channels—naming five aliases and pointing again at bridges, THORChain-linked rails, and Wasabi—Rug Room UPDATE after Monday’s 9939 swap tally.

Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).