SlowMist Says Suspected North Korean Hackers Route Bitget Stolen Funds

SlowMist tracks suspected North Korean hackers moving stolen Bitget funds through CoW Protocol and Chainflip

Suspected North Korean-linked hackers are using cross-chain infrastructure to move cryptocurrency stolen in the Bitget breach, according to blockchain security firm SlowMist.

SlowMist founder Cos said the company’s MistTrack TrackAgent detected transactions in which the suspected attackers routed stolen Bitget funds through CoW Protocol and Chainflip. The analysis indicates that the method is designed to move assets across different networks while making the flow of funds more difficult to trace.

The suspected activity is connected to the roughly $350 million Bitget hack, although attribution to North Korean-linked actors remains under investigation.

Automated Transactions Move Funds Into Cross-Chain Swaps

According to Wu Blockchain SlowMist’s analysis, the attackers are using automated scripts to create orders through CoW Protocol. Those orders use pre-generated Chainflip deposit contracts as recipient addresses.

Once the transactions are settled, the assets can move directly into Chainflip’s cross-chain swapping infrastructure. The funds are then converted into Bitcoin, according to the security firm’s analysis.

The structure allows the movement of stolen assets to be distributed across multiple blockchain environments rather than remaining in the original form and network in which they were taken.

SlowMist’s findings indicate that the automated process is an important component of the suspected laundering route. By linking CoW orders with pre-generated Chainflip deposit addresses, the attackers can move assets through a sequence of transactions without relying on a single straightforward transfer path.

North Korean Attribution Remains Under Investigation

SlowMist has previously documented sophisticated cryptocurrency theft operations attributed or suspected to be linked to North Korean threat actors. Its security research has described increasingly complex attack chains involving cryptocurrency exchanges and other blockchain infrastructure.

However, the Bitget incident has not been definitively attributed to North Korean hackers. The current assessment remains a suspicion, and the investigation into the actors behind the roughly $350 million theft is ongoing.

That distinction is significant because blockchain transaction analysis can identify movement patterns and connections between wallets without necessarily establishing the real-world identity of the individuals controlling them.

Cross-Chain Activity Complicates Fund Tracking

The use of CoW Protocol and Chainflip adds another layer to efforts to follow the stolen assets. Each stage creates additional transaction records across different blockchain environments, while cross-chain swaps can change the assets being tracked.

SlowMist’s analysis suggests that the suspected attackers ultimately converted the routed funds into Bitcoin. Tracking those assets therefore requires investigators to follow both the original stolen tokens and the subsequent swaps across networks.

The latest findings provide a more detailed picture of how the funds associated with the Bitget breach are being moved, while the question of who carried out the attack remains unresolved.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.