Suspected North Korean-linked hackers allegedly utilized decentralized finance protocols to launder cryptocurrency stolen from the Bitget exchange breach. SlowMist founder Cos reported that MistTrack’s TrackAgent identified transactions linking the exploit to CoW Protocol and Chainflip. The analysis suggests attackers used automated scripts to create CoW orders with pre-generated Chainflip deposit contracts as recipients, allowing settled assets to enter Chainflip’s infrastructure for cross-chain exchanges before conversion into Bitcoin.
Bitget initially estimated losses at $351.6 million but raised the figure to approximately $387.5 million after identifying additional losses in ZEC and TRX. A separate investigation by Bitquery traced 21 transfers across eight blockchains, documenting routes through THORChain, Chainflip, bridges, and other services. Specific findings include 2,450 ETH sent to a Chainflip liquidity pool resulting in a 74.46 BTC withdrawal, while another route involved 812 ETH and $14.6 million in stablecoins converted into Bitcoin. Additionally, 90.5% of stolen XRP was exchanged for Bitcoin via THORChain.
The alleged use of CoW Protocol and Chainflip highlights a sophisticated laundering technique where automated order creation facilitates rapid movement between networks. By leveraging cross-chain infrastructure, attackers can obscure the origin of funds by converting native assets like ETH, XRP, and TRX into Bitcoin, which serves as a final destination for value preservation. This method exploits the interoperability of DeFi protocols, creating interconnected operations that challenge traditional transaction tracing capabilities.
From an institutional perspective, this incident underscores the operational risks associated with cross-chain bridges and swap services being exploited for illicit activities. While stablecoin issuers like Circle and Tether froze significant amounts of USDC and USDT, native assets remain unfreezable, limiting recovery options. Investigators face challenges due to the speed of fund movement across multiple chains, emphasizing the need for enhanced monitoring of automated trading patterns within decentralized exchanges.
