Suspects involved in the $387 million Bitget hack were traced by on-chain investigator ZachXBT after they brazenly asked for technical help in public Telegram and Discord chats. According to the investigation, the individuals responsible for laundering the stolen assets sought advice on moving funds through decentralized protocols, inadvertently exposing their wallet addresses and communication patterns. This lapse in operational security allowed investigators to link the Bitget attackers directly to the previous exploit of Kelp DAO, suggesting a recurring group of actors behind recent high-profile DeFi and exchange breaches.
The discovery highlights a growing trend in 2026 where even sophisticated cybercriminals are struggling to bypass the increasingly transparent monitoring of the blockchain. As ZachXBT revealed, the suspects were caught discussing methods to obfuscate transaction paths, a move that typically occurs in private darknet forums rather than public-facing community groups. This error has provided law enforcement and security firms with a clearer roadmap for tracking the $387 million in assets as they move through various mixing services.
For US-based users and the broader crypto market, this event underscores the persistent risks associated with centralized exchanges (CEXs) and the importance of on-chain sleuthing in asset recovery. While the identification of the suspects is a positive step toward potential fund recovery, the scale of the Bitget breach serves as a reminder of the vulnerabilities inherent in large-scale custodial platforms. The link to the Kelp DAO hack also suggests that these attackers are targeting diverse sectors of the ecosystem, from liquid restaking protocols to major trading hubs.
Investors should watch for upcoming transparency reports from Bitget regarding the status of their insurance fund and potential compensation for affected users. Furthermore, the involvement of public social platforms may lead to increased pressure on Discord and Telegram to implement stricter monitoring or data-sharing protocols with international cybercrime units. As the investigation unfolds, the movement of the stolen funds will likely trigger alerts across major exchanges, making it increasingly difficult for the suspects to exit into fiat currency.