SlowMist’s Yu Xian: North Korean hackers laundered cryptocurrency via cross-chain combinations of CoW Protocol and Chainflip, ultimately converting the funds to Bitcoin (BTC).

SlowMist founder Yu Xian tweeted that SlowMist TrackAgent has discovered North Korean hackers used a combination of CoW Protocol and Chainflip to cross-chain launder stolen funds from Bitget. The hackers’ automated scripts create orders via CoW Protocol, setting the order’s receiving address to a pre-prepared Chainflip Deposit-related contract address; once the order is filled, the assets are cross-chained on Chainflip and converted to BTC. Yu Xian cited an example: In one related transaction, the hacker first created an order on CoW Protocol, which was then completed. The receiving address 0xcEAE932A8bEE3a81a681A59890cb26d3110FDb65 corresponds to the Chainflip Deposit Contract, and Chainflip records show the cross-chain assets were ultimately transferred to the BTC address bc1qa0rjjhyu9pg3adgpel4v7dct6a8606az863jyh. Yu Xian previously noted that Chainflip has been blocking North Korean hackers’ money laundering attempts, but the laundering group uses automated scripts to split funds into small amounts, immediately switches to other cross-chain paths when blocked by risk controls, eventually converts the funds to BTC, and further obfuscates them via CoinJoin. He described this process as an "evolving money laundering operation".