Bitget Exploit: How Alleged DPRK-Linked Hackers Launder $387M Through Crypto Bridges and Mixers

The movement of stolen cryptocurrency following major exchange exploits is increasingly revealing a sophisticated ecosystem of intermediaries, bridges and mixing services designed to make illicit funds harder to trace.

The latest activity surrounding the reported $387 million Bitget exploit offers another example of how alleged North Korean-linked attackers may rely on specialized laundering networks to move and obscure stolen assets.

According to ZachXBT, a blockchain investigator tracking the activity, Chinese illicit actors allegedly involved in laundering funds connected to the exploit have openly sought assistance through public Discord servers and Telegram channels associated with services used in the laundering process.

The visibility of these requests is notable. Rather than operating entirely within closed networks, some participants appear willing to advertise their services and seek orders in communities where cryptocurrency transactions, swapping and privacy tools are discussed.

Such activity highlights an important characteristic of modern crypto-enabled financial crime: the infrastructure used to move stolen assets can be as significant as the original exploit itself. Once funds are stolen, attackers face the challenge of converting, transferring and eventually concealing assets without triggering widespread detection.

This creates demand for intermediaries capable of moving money across blockchains and services while attempting to disrupt the transaction trail. Blockchain analysts have identified connections between some of the actors involved in the Bitget-related laundering and previous cryptocurrency thefts.

An actor identified as “Alias 4” was reportedly observed laundering funds associated with the $292 million Kelp DAO exploit earlier in 2026. If those links are confirmed through further investigation, they could indicate that the same laundering infrastructure is being reused across apparently unrelated attacks.

The pattern is particularly significant because similar behavior has reportedly appeared following multiple exploits attributed to the TraderTraitor activity cluster. Repeated use of the same or closely connected intermediaries could provide investigators with valuable intelligence.

Blockchain transactions are generally permanent, meaning that even when criminals move assets through multiple networks, historical relationships between wallets, bridges and services remain available for forensic analysis.

Currently, investigators are observing funds being chain-hopped through bridges before reaching mixing services such as Wasabi. Chain-hopping involves moving assets across different blockchain networks, potentially complicating straightforward tracing by forcing investigators to follow transactions across several ecosystems.

Mixing services add another layer by attempting to obscure the connection between the original source and subsequent recipients. For investigators, complexity does not necessarily mean invisibility.

Each bridge transaction, wallet interaction and deposit creates another piece of evidence. Timing, transaction amounts, wallet reuse and funding relationships can collectively reveal patterns that individual transactions may conceal.

The wider concern is that successful laundering operations can become reusable infrastructure for future cyberattacks. If the same intermediaries repeatedly help monetize stolen cryptocurrency, they effectively become part of an ecosystem supporting persistent digital theft.

The Bitget case therefore extends beyond one exploit or one exchange. It illustrates the continuing contest between attackers developing increasingly flexible laundering networks and investigators learning to identify the infrastructure connecting them.

Further data on these groups could help clarify how these networks operate, how frequently the same actors reappear, and how illicit funds move through the increasingly interconnected architecture of digital assets.