Stolen $387 million and complained on Discord. In response, they received a photo of Kim Jong Un

After a hacking attack on the cryptocurrency exchange Bitget, criminals are trying with varying success to launder the stolen $387.5 million. In the background, a dispute over the idea of decentralization is unfolding - THORChain refused to block the attackers' addresses and allowed them to transfer millions in bitcoins, while the NEAR Intents protocol halted an attempt to transfer over $50 million.
photo. Andy.LIU / / Shutterstock

The hacking attack on Bitget occurred on September 24, and its mechanism differed from the classic takeover of private keys. The hackers gained high internal privileges, forcing the authorization of unauthorized transfers. Loss estimates were quickly revised upward - from the initial $351.6 million to $387.5 million, as related transfers were detected in the Zcash and TRON networks during the investigation.

The criminals moved assets from EVM chains, XRP Ledger, Zcash, and TRON (including tokens such as XRP, ETH, USDT, USDC, BNB, AVAX, and TRX). However, the exchange's management emphasizes that the incident only affected the exchange's server infrastructure, bypassing cold wallets and the independent Bitget Wallet application.

Well-known blockchain analyst, operating under the pseudonym ZachXBT, pointed out that the money laundering pattern, the accounts used, and the infrastructure are identical to the scheme of the TraderTraitor group. Under this name, the American FBI catalogs North Korean hackers, who have been attributed with attacks on Kelp DAO (with losses of $292 million) and DMM Bitcoin (with losses of $308 million). Bitget's CEO Gracy Chen described North Korea's involvement as "very likely".

Two DeFi Philosophies

After the successful attack, the hackers transferred the funds to their wallets and began attempts to launder them. For most cryptocurrencies, this is not a simple task - every transfer leaves a trace on the blockchain, and one must work hard to "lose the trail". One way is to jump between chains. Quickly swapping assets from one blockchain to another (e.g., ETH to BTC, TRX, or XRP) using decentralized exchanges or bridges and custodial exchange protocols allows breaking the simple line of tracking funds in on-chain analysis. Examples of such custodial protocols are THORChain and NEAR Intents.

NEAR thwarted attempts to transfer over $50 million belonging to the Bitget hackers. The automated protection system "SHIELD", which detects anomalies in flows and data from external analytical agencies, froze $503,000 during the transaction, while only about $166,000 managed to pass through the network. The service manager Alex Shevchenko called on Bitget to contact through official legal channels for the return of the funds, simultaneously declaring the renunciation of any reward for tracking them down.

In contrast, the decentralized protocol THORChain acted differently. Despite the official appeal from Bitget's CEO, Gracy Chen, to block known addresses of the criminals, THORChain refused to create a blacklist. As a result, the hackers smoothly transferred at least 2390 ETH (about $6.3 million) converting it to bitcoins in 27 successful transactions. The THORChain team commented that the network's stopping mechanisms are solely for the protection of the protocol itself, not for selectively blocking specific wallets.

Chinese Launderers' Blunder

ZachXBT reported that behind the cryptocurrency laundering operation are Chinese intermediaries working for North Korean hacker groups. After unsuccessful attempts to exchange XRP for bitcoins, the criminals sought technical assistance on public Discord and Telegram servers of the THORChain and SwapKit networks, complaining about trapped funds.

When the exchange of stolen XRP for bitcoins got stuck in the network, the hackers began to complain to the support team. A user with the pseudonym "Cc" wrote that from the sent 277,000 XRP, he received a fraction of the amount, while another lamented that the loss "would cause huge troubles in his life". SwapKit moderators responded to these claims with a photo of Kim Jong Un.

The analyst linked one of these Discord accounts ("lolo") directly to the April attack on Kelp DAO ($292 million) and pointed to an identical digital fingerprint that the FBI attributes to the TraderTraitor group.

Bitget is implementing a phased plan to resume services. Withdrawals in Bitcoin started on September 28, in Ethereum on September 29, and in USDT are expected to return on September 30. Full platform functionality is set to be restored by October 2, although to date, stablecoin issuers Circle and Tether have managed to block only about $320,000 from the stolen pool.

Michał Misiura