Approximately $387.5 million was drained from Bitget’s hot and warm wallets on September 24, making the incident the largest digital asset theft of 2026. The stolen funds are being laundered through public Discord servers and Telegram channels, where participants have sought orders and support for the services they use. Blockchain investigator ZachXBT identified usernames including cc02006, jack_34808 and Alias 4, which had previously been associated with laundering $292 million stolen from Kelp DAO earlier in 2026. ZachXBT said the same pattern appeared after several attacks attributed to TraderTraitor and plans to release more data in the coming weeks. Funds are moving through cross-chain bridges and mixing services including Wasabi. The actors have been linked to suspected North Korean groups operating under aliases such as TraderTraitor and Lazarus. Attackers compromised a third-party backend system to spoof transaction data and bypass internal authorization processes; Bitget said its private keys were not compromised, keeping cold wallets secure. Withdrawals were suspended immediately and resumed in phases from September 28. Bitget said its User Protection Fund, worth more than $464 million, would cover user losses and offered a 5% recovery bounty, equivalent to about $19.4 million. Mandiant and SlowMist, along with law enforcement agencies, are investigating the breach. The Bitget and Kelp DAO incidents totaled nearly $680 million, raising concerns about a coordinated laundering network.