On-chain investigator ZachXBT published five aliases he says are linked to laundering funds stolen in the $387.5 million Bitget hack, describing the operators as Chinese illicit actors working on behalf of alleged North Korean attackers. The accounts reportedly sought help in public Discord and Telegram channels over stalled XRP-to-Bitcoin swaps, refunds and missing payouts. ZachXBT linked one alias, lolo / Marin, to the earlier $292 million Kelp DAO exploit, which Chainalysis and LayerZero attributed to the North Korean TraderTraitor cluster. Blockchain tracing shows the Bitget funds moving across TRON, Ethereum and THORChain before entering Wasabi CoinJoin, while Bitget says the loss is fully covered and withdrawals are restarting in phases. The account identities and transaction links have not been independently verified, and no government has formally attributed the Bitget hack.