The launderers took a cut. Then cashed it out to OKX.
We followed Bitget's stolen money across ETH, XRP, TRON and Bitcoin. It is one operation, and the people washing it charged a fee and sent it to a centralized exchange.
by @REKTCOON · on-chain only · every claim links to a txZachXBT named the launderers. We followed the money.
On 24 Sep 2026 attackers drained Bitget's hot wallets. Bitget later raised the loss to $387.5M across Ethereum and EVM chains, XRP Ledger, TRON and Zcash. Bitget and TRM point to North Korea.
On 28 Sep ZachXBT published five aliases of Chinese launderers who openly asked THORChain-ecosystem support channels why their XRP→BTC swaps were stuck. The same day THORChain refused Bitget's request to block the attacker.
This update covers what wasn't public yet: where the money actually went, how the legs connect, and who got paid for washing it.
A 0.6% "laundering fee", cashed out to OKX
Every THORChain swap memo can carry an affiliate: the interface that routed the swap and the fee it takes. Most affiliates are public apps. One wasn't.
thor18dvgrgpvxlh7rhhld4qjyrxs9c7tvwdakrkjm4 has no registered name. It appeared as the affiliate on 401 swaps, all on 26–27 Sep, 397 of them from XRP, charging up to 0.6%. 15 of its 16 senders are the Bitget attacker's XRP wallets. The 16th is the address itself, cashing out. It had no other customers. It looks like the launderers' own fee wallet.
Follow the fee
| Deposit (UTC) | USDT | Deposit tx | Sweep to OKX |
|---|---|---|---|
| 26 Sep 20:28 | 6,613.60 | 0xd61d2e0a…d0d573 | 0x05be5514…3a671a |
| 26 Sep 21:31 | 21,312.05 | 0xba29d805…b1d528 | 0x79e335aa…bc2970 |
| 27 Sep 21:59 | 92,586.74 | 0x57888a8e…4a6619 | 0x3a50b73c…d70e0f |
| 28 Sep 08:11 | 11,469.14 | 0x65c4d593…d5c2cb | 0xa4594caa…2a37d0 |
| Total | 131,981.53 |
Reported to Bitget's recovery program on 28 Sep. OKX can identify the account behind this deposit address. It may belong to the operator or to an intermediary such as an OTC desk; we make no claim about who that is.
Verify: affiliate on thorchain.net · Midgard: swaps with this affiliate
~$327K in fees written into the laundering memos
We decoded 5,569 attacker deposits into THORChain (5,281 from XRP, 288 from ETH), about $187M gross including funds re-deposited after refunds. 4,546 carried an affiliate. Below are the fees declared in those memos. The protocol only pays them on successful swaps, so real payouts are lower. Public apps take these fees automatically, and that alone says nothing about intent. The only affiliate whose sole customer was the attacker is #1.
Names are THORNames from the on-chain registry. Only "ss" is labeled on Etherscan (ShapeShift DAO Treasury). "thor18dvg…" has no THORName.
The XRP and ETH legs end in the same Bitcoin wallets
THORChain memos state the destination address of every swap. Six BTC addresses receive swaps from both the XRP leg and the ETH leg, and two ETH wallets in our laundering graph also receive XRP→ETH swaps. Same pipeline, same operator.
| BTC address | From XRP leg | From ETH leg |
|---|
Four chains, one pipeline
Simplified. Line widths approximate.
What happened on each chain
Storage wallets are being drained one by one into a funnel, Exploiter 4: Ex.14 → Ex.4 (28 Sep 11:52), Ex.9 → Ex.4 (14:28), Ex.10 → Ex.4 (18:55). Ex.4 sprays it into the same intermediate wallets used since 27 Sep. The main $47.6M in stablecoins was swapped to ETH within 21 minutes of the hack, before any freeze.
Split into 20M chunks, then pushed through 239 fresh wallets into THORChain with 5,281 deposits in 4 days. About 101M XRP went to BTC (111 addresses), ~8M to ETH, 1.36M to BNB, 321,786 via NEAR Intents.
One wallet that received 5.57M TRX was created 24 Sep 13:48 UTC, ~5 hours before the hack. 15M TRX was swapped to 5.07M USDT on a TRON DEX and bridged out via the USDT0 (LayerZero OFT) contract, plus USDD and an xSwap vault. Everything left within ~15 hours.
1,967 BTC in. Only 20.8 BTC went straight to a mixer.
The 96 BTC destinations decoded from the ETH leg and the first XRP pass received 1,967 BTC (~$164M). Only 20.8 BTC went directly into CoinJoin-style transactions. The rest moved on through ordinary transfers. These 163.66 BTC are sitting untouched in seven second-hop addresses:
| Address | BTC |
|---|
Exchanges: flag deposits from these. All 120 BTC destinations are in the downloads.
$107M still waiting
| Wallet | Address | ETH | Status |
|---|
Small things that matter
Burner Discord accounts
Discord IDs encode their creation time. From ZachXBT's list: "HELP ME" was created 31 minutes before asking for help, "jack" 5 hours before his first ticket. "lolo / Marin" dates back to Sep 2022, and "Cc" and "Melon" to 2025. Two were made for this job; three are regulars.
Wallets older than the hack
An ETH wallet active since May 2026 (0x8eEc4bcA…54c9) received ~3M XRP worth of swaps and fed ETH back into the graph. A BTC address that got THORChain payouts in Apr–May 2025 (bc1qle6cq42…6edr) woke up on 26 Sep. These are leads, not attribution.
Tools in the kit
THORChain, LayerZero/Stargate, USDT0 OFT, Skip:Go (identified from source: CCTPRelayer / SkipGoSwapRouter / GoFastHandler), Symbiosis, Chainflip, NEAR Intents, Umbra stealth payments (100 ETH), CoW Swap, ParaSwap, USDD, xSwap.
Already frozen (not ours)
Tether and Circle blacklisted 0xe07Bd590…7d57 (218,023 USDT + 99,990 USDC). Tether also froze the TRON address TRzmHLa8…36Ku4. Credit to whoever flagged them.
Every laundering wallet
How, and what we don't claim
- Ethereum: Blockscout / Etherscan labels; followed ETH and major tokens from labeled "Bitget Exploiter" wallets. Only wallets first seen after the hack count as attacker wallets. THORChain vaults and busy services were excluded.
- XRP: full account_tx crawl from the Bitget XRP address; memos decoded from every THORChain deposit.
- TRON: TronGrid; swap outputs read from USDT Transfer logs.
- BTC: mempool.space; CoinJoin detected by structure (many equal outputs).
- Affiliates: THORName registry + Midgard via public gateways.
- Who owns the OKX account, or that it's the attacker rather than an intermediary.
- That any interface, market maker, bridge or exchange acted knowingly.
- Attribution to North Korea. That's Bitget's and TRM's assessment.
- Identities behind Discord/Telegram aliases.
- Final numbers. Funds were still moving at publication.