One laundromat. Three North Korea-linked hacks.
The THORChain storefront that washed Bitget's money was born 41 hours after the Kelp DAO hack. It later washed AFX Trade too. 99% of everything it ever swapped comes from these three thefts.
by @REKTCOON · on-chain only · every claim links to datanaswap: the swap storefront built for stolen money
In Part 2 we showed that every THORChain swap memo names an affiliate, the interface that routed it. One registered name kept showing up in the Bitget attacker's swaps: naswap. Across its whole history it routed 1,803 swaps from only 24 senders.
We classified every one of them. 1,787 swaps (99%) and $49.6M of $50.5M (98%) came from wallets belonging to three hacks. Two of them, Kelp DAO and AFX Trade, were publicly attributed to North Korea's TraderTraitor group before Bitget ever happened. The remaining 16 small swaps ($0.87M) include the operator's own test transactions.
■ Bitget $36.2M · ■ Kelp DAO $12.6M · ■ AFX Trade $0.86M · ■ unclassified $0.87M
Registered 41 hours after Kelp DAO
- Kelp DAO's LayerZero bridge is exploited for ~$292M.
- The future owner wallet is seeded with 0.009 BTC assembled from 11 small inputs in power-of-two amounts (262,144 and 16,384 sats), a denomination pattern typical of CoinJoin outputs.
- BTC swapped to 1,601 RUNE → thor148sahwr5pg44cy0n23zwc723ugy2fptw0m8sau.
- That wallet registers the THORName "naswap". The same day, the website naswap.io gets its first TLS certificate.
- Test swaps back and forth through its own wallets (0xcdd505c7…bc34, bc1qa6qz0y…67m7).
- Kelp DAO exploiter wallets swap ~4,950 ETH to BTC through naswap.
- AFX Trade proceeds (via 0x678335b4…) swap ETH to BTC through naswap.
- naswap.io code rebuilt (BUILD_TIME 2026-08-31 16:00): three routes, ETH→BTC, XRP→BTC, XRP→ETH. Same day: per SlowMist, attackers first exploit a zero-day in Bitget's third-party security appliances (BleepingComputer ↗).
- Bitget proceeds: 1,546 swaps through naswap.
The storefront is still collecting
naswap fee wallet
thor148sahwr…m8sau declared ~$80.8K in fees across all three hacks. It holds 138,320 RUNE (~$108K) and has never cashed out. On 27 Sep it tried to deposit 49,654 RUNE as liquidity into THORChain's BTC pool (memo +:BTC.BTC); it failed only because BTC deposits were paused.
The other fee wallet → OKX
From Part 2: thor18dvg…krkjm4, whose only customer was the Bitget attacker, cashed out 131,982 USDT to an OKX deposit address. After our report, Bitget's own tracker now lists that address as an exchange deposit endpoint holding the same 131,981.53 USDT.
Storage empty. Zcash is moving.
The last storage wallets were relayed and drained on 29 Sep: Exploiter 11 → Exploiter 4 at 01:14 UTC, then Exploiters 4, 12 and 13 sprayed out through the same intermediates as before (0xf7bC…96C3, 0x4a77…d330). The last transfer was at 15:53 UTC.
About $26M still sits on t1WgMdtND8…kMDVG. On 29 Sep it started moving again (16:05–18:32 UTC) in 1–44 ZEC pieces through fresh transparent addresses that empty immediately, which fits deposits into the shielded pool.
The fee wallet grew from 95,915 to 138,320 RUNE in 24 hours. The laundering hasn't slowed down.
The laundromat has a storefront
naswap isn't only a name in swap memos. It is a live website, naswap.io, with a Chinese/English interface built on THORChain. It offers exactly three routes: ETH → BTC, XRP → BTC and XRP → ETH, the same routes the Bitget, Kelp DAO and AFX Trade funds took.
naswap.io · captured 30 Sep 2026 without interacting
What its own code says
- AFFILIATE_NAME = 'naswap', the same THORName in the laundering memos
- AFFILIATE_FEE_BPS = 30 (0.3%), the fee seen on most naswap swaps
- A vip.naswap.io mirror where the fee is 0, which explains the zero-fee naswap swaps
- An in-page XRP wallet unlock by seed phrase ("use only a dedicated small wallet") that lets one operator drive many XRP wallets
- Libraries loaded via cdn.jsdmirror.com, a jsDelivr mirror used for access from mainland China; Chinese is the first language option
- BUILD_TIME = '2026-08-31 16:00', 24 days before the Bitget hack
Born the same day as the on-chain name
Certificate Transparency logs show the first TLS certificates for naswap.io were issued on 20 Apr 2026, the same day the THORName "naswap" was registered, 41 hours after the Kelp DAO hack. The website and the on-chain affiliate were launched together. crt.sh ↗ · certificate log (JSON)
We don't link to the site to avoid sending traffic. It asks users to paste wallet seed phrases; don't. The page is served through Cloudflare. Archived copy SHA-256: 675af8fb…408e84a6.
The public picture
Bitget's own tracker counts $375M of the $387.5M as still held in attacker-controlled addresses (mostly BTC after swaps), $632.7K frozen (NEAR Intents, Tether, Circle), and 1,049 attacker addresses. Elliptic says the hack pushes North Korea's 2026 crypto haul past $1 billion. OKX founder Star Xu publicly questioned THORChain's decentralization after it refused to block the attacker. Bitget resumed BTC withdrawals on 28 Sep and ETH on 29 Sep.
Until now the North Korea link rested on Bitget's IP analysis and on TRM's wallet overlaps. This page adds a public, verifiable one: the Bitget launderers used the same dedicated swap storefront, and in one case the same Bitcoin payout address, as two hacks already attributed to TraderTraitor.
How, and what we don't claim
- All swaps with affiliate "naswap" pulled from THORChain Midgard; senders matched against our traced Bitget wallets (Part 2) and Etherscan labels (Kelp DAO Exploiter 20/21/34, AFX Trade Exploiter 9).
- THORName registration and first funding from Midgard / THORNode.
- naswap.io: public HTML and JavaScript read without interacting; certificate history from crt.sh.
- BTC destinations read from swap memos; shared address checked on mempool.space.
- Zcash via Blockchair; ETH via Blockscout / Etherscan; balances as of 29 Sep 18:54 UTC.
- OFAC SDN digital-currency addresses: no overlap with our ~650 addresses (they're fresh, so this was expected).
- Who operates naswap or naswap.io. We name no person.
- That THORChain, its node operators or any other interface acted knowingly.
- Formal attribution. Kelp DAO (LayerZero) and AFX (AFX / Mandiant-tracked) attributions are theirs; Bitget's is Bitget's and TRM's. We show shared infrastructure.
- That the power-of-two seed inputs prove a specific mixer. They fit a CoinJoin denomination pattern.