Money Laundering Group Adopts Semi-Public Operations
In a significant development reported by on-chain investigator ZachXBT on September 28, the money laundering syndicate linked to the massive $387 million hack of cryptocurrency exchange Bitget has shifted its operational tactics. Rather than operating solely in the shadows, the group has begun publicly soliciting new money laundering business within the open Discord and Telegram channels of the services they utilize.
Key Individual Identified
The investigation highlights a member using the aliases "lolo" or "Marin" (Telegram handle @pvpcz), whose footprint is not new. This individual has been previously implicated in laundering proceeds from another major crypto heist this year—the approximately $292 million theft from Kelp DAO. This connection points to a persistent network specializing in processing high-value criminal funds.
Mapping the Fund Flow
The movement of the stolen assets demonstrates a high degree of sophistication and obfuscation. Currently, funds are being routed across multiple cross-chain bridges, hopping between different blockchain networks, before being deposited into specific privacy-enhancing services for mixing. This process is designed to sever on-chain trails and complicate asset recovery efforts.
A Recurring Post-Attack Laundering Pattern
ZachXBT emphasized that this pattern of publicly soliciting laundering services has repeatedly emerged following several large-scale thefts attributed to "TraderTraitor" supply-chain attacks. It appears to have become a standardized phase in the hackers' cash-out process. The investigator indicated plans to release more data, including five key aliases, associated accounts, and specific transaction hashes linked to this case, to aid community and law enforcement identification and tracking.
Implications for Ecosystem Security
This incident underscores several critical realities:
- The laundering phase of major heists is trending toward "professionalized services."
- Criminal organizations are growing bolder, experimenting with semi-public operations.
- The combination of cross-chain bridges and privacy tools remains a primary technical challenge in combating money laundering.