North Korea-linked hackers allegedly laundered proceeds from the roughly $350 million Bitget theft through automated CoW Protocol orders, Chainflip cross-chain swaps and Bitcoin, SlowMist found. The firm said an attacker compromised a third-party product through a zero-day vulnerability on Aug. 31, later accessed another product's management platform using an internal employee identity, and began executing withdrawals on Sept. 25. Chainflip rejected at least one deposit attempt, but refunded the funds; SlowMist said the operators used repeated, fragmented transfers and ultimately applied CoinJoin after conversion to BTC. Elliptic has separately linked some Bitget theft addresses to last year's $1.5 billion Bybit breach and said preliminary analysis pointed to the TraderTraitor hacker organization, while broader attribution remains under investigation.