ZachXBT Links Same Operator to Fund Flows From Bitget and Kelp DAO Attacks

On-chain investigator ZachXBT linked an operator he says played a role in laundering funds stolen from Bitget to the fund flows from the $292 million Kelp DAO attack.

Tracing assets stolen in the approximately $388 million Bitget attack, ZachXBT alleged that there was a notable connection between two major attacks. At the center of the statement, reported by Wu Blockchain, is an operator using the pseudonym “Alias 4,” who is alleged to have helped move and launder the funds.

According to the investigator’s findings, this operator also played a role in laundering funds from the $292 million Kelp DAO attack, which took place earlier this year. The link extends the Bitget investigation beyond individual wallet movements to the intermediaries used after the attacks.

Stolen funds move across chains

ZachXBT said assets linked to the Bitget attack were moved across cross-chain bridges and transferred to mixing services, including Wasabi. Such services can be used to make it harder to trace the connections between different transactions.

The shared transfer diagram shows a total of approximately 103 million XRP transferred from Bitget to an address in three transactions, followed by movements to different addresses. One of the links in the diagram also shows a total of 200,000 XRP sent to THORChain in two transfers.

Seeking help in Discord and Telegram channels

The investigator also said Chinese actors alleged to have laundered funds on behalf of attackers suspected of having links to North Korea openly sought help with transactions in Discord and Telegram channels associated with the services they used.

ZachXBT said similar patterns had also emerged after other attacks attributed to TraderTraitor and plans to publish additional data in the coming weeks.