North Korean Hackers Launder Bitget Funds via CoW, Chainflip

North Korean-linked hackers are allegedly exploiting decentralized protocols to launder funds stolen from the Bitget exchange. Security firm SlowMist reports that attackers are utilizing CoW Protocol to create orders that pair with Chainflip deposit addresses, ultimately converting the stolen assets into Bitcoin.

The process reportedly involves automated scripts that set receiving addresses to Chainflip deposit contracts. Once executed, Chainflip facilitates the cross-chain swap, and the funds are converted to Bitcoin. Security analysts note that these methods outpace traditional anti-money laundering checks. While Chainflip attempted to block some of these suspected laundering activities, the hackers employed strategies like automated fragmentation and repeated attempts across different bridges to circumvent rejections.

SlowMist's investigation traced the initial compromise to a zero-day vulnerability in a third-party product exploited on August 31, followed by a further breach on September 25 using compromised employee credentials. The firm also recovered a custom withdrawal tool designed to bypass Bitget's risk controls and initiate illicit fund transfers. The stolen funds were eventually obscured further using CoinJoin.