North Korean hackers have reportedly laundered over $1 billion through a Chinese crime network, and some of the money came from hacks against Bitget and Kelp DAO. That is the claim from ZachXBT, who posted the details to X on Sept. 28.
Sanctioned Traders and the 2023 Action
In 2023, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned two crypto traders for helping the DPRK convert stolen crypto and bypass financial controls. One trader was from Hong Kong, the other from China. The move targeted the conversion of stolen funds and the evasion of financial controls.
The sanctions came after years of pressure on North Korea’s financial networks, and they were aimed directly at the people and systems that move stolen crypto into usable cash. OFAC’s action in 2023 was part of a broader push to cut off the DPRK’s ability to fund its operations through cryptocurrency theft.
The ZachXBT Post
ZachXBT’s post pointed to Chinese actors openly seeking support in public Discord servers and Telegram channels operated by services they used. The post also linked Chinese actors to the laundering of funds from the $387.5 million Bitget exploit in September.
One operator was also named as having been involved in laundering funds from the $292 million Kelp DAO exploit in April.
The Pattern of Open Coordination
The post described a pattern of open communication. Chinese actors were allegedly seeking support in public spaces, and the operators of those services were themselves tied to earlier laundering activity.
The Kelp DAO link is notable because it connects the current Bitget investigation to a separate hack that happened months earlier. ZachXBT’s account suggests the same network moves across multiple targets.
The Numbers Behind the Claim
- The $387.5 million Bitget exploit hit in September.
- The $292 million Kelp DAO exploit hit in April.
- OFAC sanctioned two traders in 2023 for helping the DPRK convert stolen crypto.
The sanctions targeted the conversion of stolen funds and the evasion of financial controls.
What This Means for Crypto Users
The ZachXBT post raises questions about how public forums are being used. Operators who run services that Chinese actors use for laundering appear to have been involved in multiple hacks.
The pattern is consistent: operators tied to one exploit show up again in another. That suggests a network that moves from one target to the next, using the same infrastructure each time.
The implications reach beyond the two exploits named in the post. If operators are willing to host criminals openly in public forums, the risk extends to any user who trusts those platforms.
The Verdict on ZachXBT’s Claim
The pattern ZachXBT describes is troubling. A network that moves across multiple targets, using the same infrastructure each time, is a serious threat to the industry.
The question now is whether this network can be stopped. The sanctions from 2023 showed what is possible, but the ZachXBT post suggests the problem persists.
The evidence is mounting. The question is whether anyone acts on it.
The paper’s honest reaction to this story is unease. North Korean hackers have reportedly laundered over $1 billion through a Chinese crime network, and some of the money came from hacks against Bitget and Kelp DAO. That is a lot of money moving through a system that seems to work.
The stakes are high. The numbers are large, and the connections between hacks are specific. Whether anyone acts on this information remains to be seen.
See the a run of 18 images at Cointelegraph.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.