The trail from the $387 million Bitget hack leads to publicly accessible Discord servers and to a launderer previously tied to the $292 million Kelp DAO exploit, according to an investigation reported by CCN.

The findings connect two of the largest crypto security incidents on record. Investigators tracing the movement of stolen Bitget funds found that key coordination and laundering infrastructure operated in the open, on public Discord channels, rather than through concealed infrastructure.

The reported link to a launderer from the $292 million Kelp DAO exploit suggests the same actors, or an overlapping network, may be responsible for both operations. Kelp DAO, a restaking protocol, suffered the $292 million exploit in a separate incident that remains one of the largest DeFi losses attributed to malicious actors.

What does the trail reveal?

According to the report, investigators followed the stolen funds from the Bitget breach — which totals $387 million — and found the laundering path intersecting with public Discord communities. The use of openly accessible channels marks an unusual operational choice for a theft of this scale, and it provided investigators with visibility into the actors' coordination.

The connection to the Kelp DAO launderer strengthens the case that sophisticated exploit teams recycle personnel and infrastructure across multiple high-value targets rather than operating as isolated actors.

Why does the cross-incident link matter?

The overlap between the Bitget hack and the Kelp DAO exploit gives exchanges, protocols and investigators a consolidated profile of the responsible network. Attribution of this kind can support:

• Exchange-level freezing of addresses linked to the laundering chain
• Coordination between Bitget and Kelp DAO-affected parties on fund tracing
• Potential law enforcement action built on a unified evidentiary trail spanning both incidents

Neither Bitget nor representatives of Kelp DAO have publicly commented on the specific attribution findings as of the report's publication.

What comes next?

Investigators and affected platforms are expected to continue tracing the laundered funds across chains, with the public Discord trail offering a persistent evidentiary surface. Any exchange that touches addresses downstream of the laundering chain now faces a narrowing window to freeze funds before they are dispersed beyond recovery.