ZachXBT Identifies Five Intermediaries Moving Bitget’s Stolen Crypto Through THORChain, Wasabi, and Bridges

ZachXBT says five people are helping move crypto stolen from Bitget, with the flow running through bridges, Wasabi, stablecoins, and THORChain. For PSPs and exchanges, the useful bit is not the detective work itself but the routing pattern: once funds start bouncing across cross-chain infrastructure and mixers, recovery and compliance get harder fast.

1. ZachXBT says the group consists of people from China working for North Korean hackers. He has been tracking the cluster across several hacks and has been asking for help processing transactions on public Discord servers and Telegram channels used by the group.
2. He published nicknames and handles for five alleged intermediaries: Cc (cc02006 on Discord), Jack (jack_34808 on Discord), Melon (under0346 on Discord), lolo / Marin (pvpcz on Telegram, losern on Discord), and HELP ME (helpme031897 on Discord).
3. According to screenshots shared by ZachXBT, these people contacted support teams for services tied to THORChain, complaining about a stuck XRP-to-bitcoin swap, reversed transactions, and missing payouts. In other words, they were not exactly subtle about needing the plumbing to work.
4. ZachXBT also says the user known as lolo / Marin is linked to the hack of Kelp DAO, which he puts at $292 million. He says the stolen funds are now moving through cross-chain bridges and then into mixers.
5. He traced about 4 BTC connected to Bitget through Wasabi, then into USDT, then into 145 ETH, and back through THORChain into 4.59 BTC. THORChain previously said it would not selectively block addresses tied to the exchange hack, because the protocol does not support targeted address or transaction blocking and only halts the network in case of a threat to the protocol itself.

Bitget said on 24 September that $387.5 million in crypto assets were taken in the attack. It resumed bitcoin withdrawals on 28 September, said ether withdrawals would resume on 29 September, USDT withdrawals on 30 September, and other supported tokens plus fiat and P2P services on 2 October.