REKTCOON
Case file № 002 Status: active Opened 24 Sep 2026 · 18:31 UTC Case open 6d 06h 00m Lead REKTCOON Last entry 1 Oct · 03:10 UTC
Active
investigationcase 002 · open
Case 002 · open · funds moving

Following $387.5M of stolen Bitget money

An exchange hack, four blockchains, a laundering fee cashed out to OKX, and one swap storefront shared by three North Korea-linked thefts. Everything here is on-chain and verifiable.

Explore the money mapRead the latest: Part 4 →
● 24 Sep · $387.5M drained from Bitget hot wallets21 min to swap $47.6M in stablecoins before any freeze● 485 laundering wallets mapped on ETH + XRP131,982 USDT of launderer fees deposited to OKX● THORChain refused to block the attackernaswap: 99% of its swaps from Kelp DAO, AFX Trade, Bitget● naswap.io: a live storefront with only ETH→BTC, XRP→BTC, XRP→ETH● 29 Sep · last ETH storage wallets drainedU-turn: Bitget BTC → ETH → DAI → TRON → 1.2M USDD● 9,260 ZEC pushed into the shielded pool ● 24 Sep · $387.5M drained from Bitget hot wallets21 min to swap $47.6M in stablecoins before any freeze● 485 laundering wallets mapped on ETH + XRP131,982 USDT of launderer fees deposited to OKX● THORChain refused to block the attackernaswap: 99% of its swaps from Kelp DAO, AFX Trade, Bitget● naswap.io: a live storefront with only ETH→BTC, XRP→BTC, XRP→ETH● 29 Sep · last ETH storage wallets drained18,581 ZEC (~$26M) still on the attacker's Zcash address
$387.5M
Stolen · 24 Sep 2026 (Bitget figure)
~$187M
Swapped through THORChain (gross)
485
Laundering wallets we mapped
3 hacks
Sharing one swap storefront
§ 01 · Case file

The file on Case 002

What we know, what we filed, and what is still unknown.

Case №002 · "Following the Bitget money"
StatusActive funds still moving
Incident24 Sep 2026 · 18:31 UTC · Bitget hot wallets
Loss$387.5M across 7 chains (Bitget figure)
VectorCompromised backend, spoofed transaction data (per Bitget). Media report a fake job interview and a compromised third-party tool.
AttributionNorth Korea / TraderTraitor, per Bitget, TRM and Elliptic. Not independently verified by us
Laundering frontnaswap THORChain affiliate + naswap.io storefront, shared with Kelp DAO and AFX Trade
Front operator████████████unknown. We name no one.
Wallets mapped485 (246 ETH + 239 XRP), 120 BTC destinations
Still movable$362.3M in attacker-held addresses, plus $19.45M gone into mixers (Bitget tracker, 1 Oct)
Reports filed2 to Bitget's recovery program: ····RDBX ····2HSJ
PublishedPart 1 · Part 2 · Part 3 · Part 4

Everything in this file comes from public blockchains, public certificate logs and public statements. Each claim links to its source in the parts.

§ 02 · Case log

The investigation, entry by entry

Each check, finding and filing, newest first, all times in UTC.

rektcoon@case-002:~$ tail -f case.log
  • FINDINGSlowMist/Mandiant: attackers first got into Bitget on 31 Aug. naswap.io's code says BUILD_TIME 2026-08-31 16:00. Same day.
  • PUBLISHPart 4: the U-turn. Bitget BTC → ETH → DAI → TRON → 1.2M USDD.
  • CHECKZcash stash down to 8,582.56 ZEC. Bitget's tracker counts 9,260 ZEC shielded and mixers at $19.45M. naswap fee wallet up to 139,140.58 RUNE.
  • FINDINGBTC hub bc1qcucpas… (88.3 BTC) merges naswap payouts from 38mHJz… with pre-hack wallet bc1qle6cq42….
  • FINDINGThe 1.2M is traced: DAI → USDT → USDT0 bridge (dstEid 30420 = TRON) → USDD → TUddQsNe3f…, holding 1,200,000 USDD.
  • FINDINGU-turn: Part 1 BTC address bc1qqmp67f… → 4 naswap swaps BTC→ETH (69.3 ETH) → 0x4a77…d330 → 475 ETH → CoW Swap → 1.28M DAI.
  • CHAINLast USDD lands on TUddQsNe3f…. No movement since.
  • CHECKnaswap fee wallet thor148…m8sau still holds 138,320.64 RUNE, unmoved. Zcash stash still 18,581.18 ZEC.
  • FILEDSupplement to Bitget's recovery program: naswap / naswap.io, flagging the fee wallet and a hosting/registrar lead. Ref ····2HSJ.
  • PUBLISHOff-chain evidence: naswap.io storefront, code excerpts, VIP mirror, certificate history.
  • FINDINGnaswap.io's code hard-codes AFFILIATE_NAME = 'naswap' (30 bps). First TLS certificate was issued 20 Apr, the same day the THORName was registered.
  • PUBLISHPart 3: one laundromat, three North Korea-linked hacks.
  • CHAINZcash stash t1WgMd… spends again. Small chunks go to fresh t-addresses.
  • CHAINLast ETH storage wallet emptied. The funnel phase is over.
  • CHAINLast swap tagged "naswap" seen on THORChain so far.
  • FINDINGA Bitget attacker XRP wallet and AFX Trade-funded swaps both paid bc1qtgzpq7…. It's a hard link between the two hacks.
  • FINDING"naswap": 1,803 swaps, 99% from Kelp DAO, AFX Trade and Bitget. Registered 41 hours after the Kelp hack.
  • CONFIRMBitget's tracker now lists the OKX deposit address we reported.
  • PUBLISHPart 2: the launderers took a cut, then cashed it out to OKX.
  • FILEDLead to Bitget: 131,981.53 USDT of launderer fees deposited to an OKX account. Ref ····RDBX.
  • FINDINGAffiliate thor18dvg…: 15 of 16 senders are attacker wallets. Its fees are swapped to USDT and swept to "OKX: Hot Wallet 5".
  • FINDINGXRP leg mapped: 239 wallets, 5,281 THORChain deposits, 111 BTC destinations; 6 are shared with the ETH leg.
  • PUBLISHPart 1. The case goes public.
  • CHAINExploiter 5 starts moving after 2.5 days of silence.
  • FINDING$47.6M in stablecoins swapped to ETH in 21 minutes, before any freeze.
  • INCIDENTBitget hot wallets drained. Case 002 opened.
watching: 1.2M USDD on TUddQs… · naswap fee wallet · ZEC stash · BTC hub bc1qcucpas…
26 entries · 2 filings · 4 parts
§ 03 · The case in 60 seconds

Six moves, from theft to cash-out

🔓
24 Sep · 18:31 UTC

The heist

Attackers compromise a backend system in Bitget's wallet infrastructure and spoof transaction data. The exchange signs off on its own robbery: $387.5M leaves across seven chains.

⏱️
19:08 → 19:29

21 minutes

$47.6M in USDT/USDC plus tokenized gold becomes 22,327 ETH through UniswapX before Tether or Circle can freeze it, via a wallet upgraded with EIP-7702.

🧺
25–29 Sep

Split, wait, drain

ETH sits in round 10,000-ETH wallets, then gets relayed into a "funnel" wallet and sprayed across 246 fresh addresses. XRP goes through 239 more. On 29 Sep the last one empties.

🌉
26–29 Sep

Bridge to Bitcoin

About $187M goes through THORChain, mostly into BTC, with extras via LayerZero, Skip:Go, Chainflip, Symbiosis and NEAR Intents. THORChain refuses Bitget's request to block the attacker.

💸
26–28 Sep

The launderers take a cut

A THORChain affiliate whose only customer is the attacker charges up to 0.6%, swaps the fees to USDT and deposits 131,982 USDT to an OKX account.

🇰🇵
Apr → Sep 2026

Same laundromat

The storefront "naswap" was registered 41 hours after the Kelp DAO hack. 99% of what it ever swapped comes from Kelp DAO, AFX Trade and Bitget, the first two already attributed to TraderTraitor.

§ 04 · Money map

The money map

Hover a stream for details. Widths are approximate, to show proportions, not accounting.

← swipe to see the whole map →
ETH & EVM≈ $199METH · USDT · USDCXAUT · Arbitrum… XRP102.98M XRP≈ $154M TRON≈ $6.9M Zcash≈ $27.9M THORChain~$187M grossrefused to block Bridges & swapsLayerZero · Skip:GoUSDT0 · Chainflip… Still parkedZEC address Bitcoin120 dest. addresses163.66 BTC untouched OKX account Mixers Frozen
ETH/EVMXRPTRONZcashTHORChain → BTC
§ 05 · Status

Where the money is now

Bitget's public tracker, 1 Oct 2026 (02:23 UTC). Almost all of it is still under the attacker's control, just not in a form anyone can freeze.

93.5%still attacker-held
Held in attacker-controlled addresses4,019.8 BTC (94%), 9,587 ZEC, $5.4M in stablecoins incl. the 1.2M USDD on TRON
$362.3M
Mixers +$15.5M in a day9,260 ZEC into the shielded pool, 60 BTC CoinJoin
$19.45M
Bridge / swap lossesFees and slippage paid while laundering
$3.54M
ServicesNEAR Intents, StealthEX, OTC, ~$698K stuck in wrong-chain Chainflip deposits
$1.39M
In flightOn bridges right now
$0.60M
FrozenNEAR Intents, Tether, Circle
$0.34M
ExchangesIncludes the OKX deposit address we reported
$0.21M

Source: trace.bgblockchain.xyz. Categories and amounts are Bitget's; they move as funds move.

§ 06 · Exhibits · click a card

The evidence board

Wallets, services and endpoints that matter, each with an exhibit number and a status. No people, only addresses and what they did.

§ 07 · Open leads

What we're watching

Each lead is either filed with someone who can act, watched for movement, or still open. Last checked 1 Oct, 02:35 UTC.

Filed reported, awaiting action Watching funds parked, any move matters Open still digging Confirmed acted on
LEAD-01 · EX-12Confirmed

OKX account behind 0x51B2…B7be

131,981.53 USDT of launderer fees went to this deposit address. We filed it on 28 Sep, and Bitget's tracker now lists the address. Only OKX can identify the account holder.

Filed 28 Sep 19:49Next: OKX freeze / KYC
LEAD-02 · EX-09Watching

naswap fee wallet: 138,320 RUNE

thor148sahwr…m8sau earned fees on Kelp, AFX and Bitget swaps and has never cashed out. On 27 Sep it tried to add the RUNE to the BTC pool. Any transfer would signal a cash-out.

Balance 139,140.58 RUNE+820 on 30 Sep, no cash-out
LEAD-03 · EX-10Filed

Who runs naswap.io?

The storefront sits behind Cloudflare with a registrar on file. Hosting and registrar records can identify the operator, but only authorities can request them. We filed it with Bitget on 30 Sep.

Filed 30 Sep 01:10Needs: legal request
LEAD-09 · NEWWatching

1,200,000 USDD on TRON

The end of the Part 4 U-turn: TUddQsNe3fRonEER4JbuWjSnfM1nmwqxhF, created 30 Sep. USDD has no issuer freeze, so its next hop (exchange, OTC or bridge) is the moment to act.

Balance 1,200,000.06 USDDIdle since 30 Sep 22:41
LEAD-04 · EX-07Watching

Zcash stash: 8,583 ZEC left (~$13M)

About 10,000 ZEC left this address in two days, and 9,260 ZEC of it entered the shielded pool. From here, tracing is only possible by amount and timing as coins come back out.

Balance 8,582.56 ZECDraining into shielded pool
LEAD-05 · EX-14Watching

163.66 BTC in 7 second-hop wallets

BTC from THORChain payouts that has not yet moved to a mixer or an exchange. The addresses were sent to Bitget for exchange flagging.

Last checked 29 SepWatch: exchange deposits
LEAD-06 · EX-09Open

Who funded "naswap"?

The registration wallet was funded 16 minutes before sign-up through bc1q3empk84… with CoinJoin-sized inputs (262,144 and 16,384 sats). Next step: trace it upstream.

Opened 29 SepNext: upstream BTC trace
LEAD-07Open

Launderers asking for support in public chats

ZachXBT reports that launderers ask swap services for help in public Discord and Telegram groups. Next: match order times against our swap timestamps. We follow only services and wallets, not private people.

Opened 28 SepNext: timestamp matching
LEAD-08 · EX-04Closed

ETH storage wallets

About 69K ETH sat in round 10,000-ETH wallets. All of them were drained through the funnel by 29 Sep, 15:53 UTC.

Closed 29 Sep 15:53Result: 0 ETH left
§ 08 · April → September 2026

The timeline

Kelp DAO

Kelp DAO drained of ~$292M through its LayerZero bridge. LayerZero attributes it to TraderTraitor (Lazarus).

Finding

"naswap" is registered on THORChain by a wallet funded 16 minutes earlier with BTC in CoinJoin-style amounts. The same day, naswap.io gets its first TLS certificate.

Kelp DAO

Kelp exploiter wallets swap ~4,950 ETH to BTC, every swap through naswap.

AFX Trade

AFX Trade loses $24.15M in a bridge-key compromise on Arbitrum; AFX links it to UNC4899 / TraderTraitor.

AFX Trade

871 ETH from AFX Trade Exploiter 9 swapped to BTC through naswap. Payouts include bc1qtgzpq7…, an address that will receive Bitget money two months later.

Finding

naswap.io's code is rebuilt ("BUILD_TIME 2026-08-31 16:00"): three routes only, ETH→BTC, XRP→BTC, XRP→ETH, plus in-page XRP seed unlock. The same day, according to SlowMist, attackers first exploited a zero-day inside Bitget's security appliances. The theft follows 25 days later.

Bitget

Bitget hot wallets drained, $351.6M first reported, later $387.5M.

Bitget

$47.6M in stablecoins swapped to ETH in 21 minutes via UniswapX, from an EIP-7702 wallet.

Bitget

Tether and Circle freeze ~$318K. ZachXBT says he has "no current plans" to monitor.

Finding

XRP laundering peaks: 5,281 THORChain deposits. 1,546 go through naswap. The fee wallet thor18dvg… cashes out to OKX.

Finding

A Bitget attacker XRP wallet sends a payout to bc1qtgzpq7…, the same BTC address used for AFX Trade funds.

Bitget

ZachXBT publishes five launderer aliases. THORChain refuses Bitget's request to block the attacker.

Finding

REKTCOON reports the OKX cash-out to Bitget's recovery program. The address later appears in Bitget's own tracker.

Bitget

Last ETH storage wallets drained. Zcash starts moving. Bitget resumes ETH withdrawals.

Finding

The U-turn. BTC from a Part 1 address goes back to ETH through naswap, then into 1.28M DAI on CoW Swap, across the USDT0 bridge to TRON, and ends as 1.2M USDD. Part 4 →

Bitget

9,260 ZEC goes into Zcash's shielded pool, and Bitget's tracker puts the mixer total at $19.45M.

§ 09 · Evidence locker

The raw evidence

Every dataset behind the claims, fingerprinted with SHA-256 so nobody can quietly change it. Click a hash to copy it.

ItemFileWhat it showsSHA-256
DOC-01laundering_flow.csv
367 KB		1,297 ETH-leg transfers with hashes across 246 laundering wallets1c9358bcace0be6273e8f6c57d12258fbcb240ccfe688a957d5676586ddb07b4
DOC-02hacker_wallets.txt
11 KB		ETH-leg wallet list, excluding THORChain vaults and addresses that existed before the hackff3b232bf2fabaec17e23cb1f6e68ed0104c92c4e1fbf9b44010c7305987a3ec
DOC-03thorchain_to_btc.csv
62 KB		Decoded THORChain memos: ETH → BTC destinations115903dc939e707091a357d8e227eb560822b3fab457c8cbd6f58f11c8b9790c
DOC-04xrp_thorchain_deposits.csv
1.4 MB		5,281 XRP-side THORChain deposits with memosfa04d61793c73579734f371ac2bb61b3a72990e0a0efd8f483b6c30923a0e07f
DOC-05xrp_hacker_wallets.txt
8 KB		239 XRP laundering wallets from root rwNhef…CTck741ab942627b914b719ea9e091c9c7285a2c11e7d29bd674ec94b7509face6e4
DOC-06btc_destinations_all_legs.csv
7 KB		120 BTC destinations from both legs; 6 are sharedf5f4270ab6168b2e294c8700e87f0263ae1273b46167f596ccce85490a9fde61
DOC-07btc_addresses.txt
2 KB		First 15 BTC addresses (Part 1)afe3d06bd6b922776b7e287fffe83c24b5d051787e32f4db1c1c154a6de36b93
DOC-08naswap_swaps.csv
396 KB		All 1,803 "naswap" swaps, each labeled by source hack9ba3dc8130015c08d44e303279fcfb87d3d68b91a0f030974385f19b6688204c
DOC-09crtsh_naswap.io.json
9 KB		Certificate Transparency log for naswap.io; first certificate 20 Apr 2026cbecf30a48a9485ec9a5e9e6262370ac2f806903f4e1a93bb0d7e6927847da39
DOC-10naswap-io.png
175 KB		Screenshot of the naswap.io storefront, 30 Sep 20260eb63ca78ec71ca7d5571f2d5031678026a1af7af3c8f0c8988639a6b0d4cb6e
DOC-12uturn_2026-10-01.csv
5 KB		Every hop of the Part 4 U-turn: BTC → ETH → DAI → TRON → USDD, with tx hashes77be1c7904ccf246cb56bb0b6798ee3859f61880a6ea2399c6acd078b8d10e97
DOC-11naswap.io page source
held by REKTCOON		Full HTML/JS snapshot of naswap.io and vip.naswap.io (identical), 30 Sep 2026. Available to Bitget and law enforcement on request.675af8fb2469d438c07bad11f1af479b7c5ddad1e06d1093556f83fe408e84a6

Check a file yourself: shasum -a 256 <file>

§ 10 · Explainers

How crypto laundering actually works

The tools in this case, each in plain words and how it showed up here.

⚡THORChainSwap BTC for ETH with no account

A cross-chain exchange: you send coins to a vault with a short text memo, for example "=:BTC.BTC:bc1q…", and the network sends the other coin to that address. No sign-up, no KYC.

Here: ~$187M of Bitget funds went through it. The memos are public, and that's how we found every destination.

🏷️AffiliatesWho routed the swap, and their cut

Apps building on THORChain add their name and a fee in basis points to the memo. It's how wallets and interfaces get paid.

Here: two affiliates existed almost only for stolen money, naswap (Kelp, AFX, Bitget) and thor18dvg… (Bitget only), which cashed its fees to OKX.

🧊Why stablecoins get frozenand why this attacker moved fast

Tether and Circle can blacklist an address and make USDT/USDC on it unmovable. ETH, BTC and XRP have no such switch.

Here: the attacker swapped $47.6M of stablecoins in 21 minutes. Only ~$318K got frozen.

🌀CoinJoin (Wasabi)Mixing coins with strangers

Many users combine coins into one big transaction with equal-sized outputs, so it's hard to tell whose output is whose. Outputs often come in standard sizes like powers of two.

Here: ~$3.94M hit mixers. naswap's first funding came from inputs of 262,144 and 16,384 sats, typical CoinJoin denominations.

🏦Exchange deposit addressesThe weak spot of every launderer

Exchanges give each customer a personal deposit address that auto-forwards to a big "hot wallet". If you can see that forwarding, you've found an account the exchange can identify and freeze.

Here: 0x51B2…B7be forwards to "OKX: Hot Wallet 5" within minutes. That's how the OKX lead was found.

🧬EIP-7702A normal wallet with smart powers

A 2025 Ethereum upgrade lets an ordinary wallet temporarily behave like a smart contract, for example to batch approvals and swaps in one go.

Here: the attacker's swap wallet used MetaMask's StatelessDeleGator to dump $47.6M fast.

🎣Address poisoningScammers scamming the hacker

Bots send fake tokens from look-alike addresses (same first and last characters) and hope you copy the wrong one from your history.

Here: every exploiter wallet was spammed with fake "E឴឴ꓔH" and "Ú5឴឴DC" tokens within minutes.

🌉Bridges & chain-hoppingWhy money jumps across chains

Moving value between chains (TRON → Ethereum → Bitcoin) breaks simple tracking and lets launderers use whichever swap venue won't block them.

Here: TRX → USDT → USDT0 bridge → ETH → THORChain → BTC → Wasabi.

🕶️Zcash shielded poolWhere on-chain tracing goes dark

Zcash has transparent "t-addresses" (visible) and shielded addresses (encrypted). Once coins go shielded, amounts and destinations are hidden; analysts can only match amounts and timing coming out.

Here: 18,581 ZEC is still on a transparent address, and small chunks began moving on 29 Sep.

§ 11 · Read the investigation

Four parts

PART 1 · 27–28 SEP

Following the Bitget money

The 21-minute stablecoin swap, 246 laundering wallets, the first 15 BTC addresses.

Read Part 1 →
PART 2 · 28 SEP

The launderers took a cut, then cashed it out to OKX

XRP, TRON and BTC legs, 6 shared BTC wallets, 131,982 USDT to an OKX account.

Read Part 2 →
PART 3 · 29 SEP

One laundromat, three North Korea-linked hacks

naswap: registered 41 hours after Kelp DAO, used by Kelp, AFX Trade and Bitget.

Read Part 3 →
PART 4 · 1 OCT · NEW

The U-turn: Bitcoin back to ETH, then DAI, then TRON

A Part 1 BTC address, naswap in reverse, CoW Swap, the USDT0 bridge, and 1.2M USDD parked on TRON.

Read Part 4 →
§ 12 · Statements on record

What the players said

Gracy Chen · Bitget CEO28 Sep
"Decentralization is a design principle, not a shield for facilitating known stolen funds."
Cryptopolitan ↗
THORChain28 Sep
A network halt "is not a selective freeze of specific funds or an individual swap."
CoinDesk ↗
Star Xu · OKX founder26 Sep
"I don't think THORChain's TSS + validator model represents true decentralization."
Analytics Insight ↗
ZachXBT28 Sep
Launderers "are openly asking for support with orders in public Discord servers and Telegram channels of services they use."
X ↗
Elliptic29 Sep
The hack pushes North Korea's 2026 crypto thefts past $1 billion.
Insurance Journal ↗
REKTCOON29 Sep
The Bitget launderers used the same dedicated swap storefront, and in one case the same BTC payout address, as two hacks already attributed to TraderTraitor.
Part 3 →
— END OF PUBLIC FILE · CASE 002 REMAINS OPEN —