Suspected North Korean-linked hackers are allegedly using decentralized finance (DeFi) protocols to move cryptocurrency stolen from Bitget. SlowMist founder Cos said MistTrack’s TrackAgent detected transactions linking the exploit to CoW Protocol and Chainflip, adding another layer to the investigation into the September 24 exchange breach.
Table of Contents
The suspected actors allegedly use automated scripts to create CoW Protocol orders with pre-generated Chainflip deposit contracts as recipient addresses. This setup allows assets settled through CoW to enter Chainflip’s cross-chain infrastructure, where they can be exchanged between networks. The movement eventually leads to Bitcoin, according to the analysis.
Bitget initially estimated the stolen assets at about $351.6 million before raising the figure to approximately $387.5 million after identifying additional losses involving ZEC and TRX. Bitquery’s September 29 investigation separately traced 21 transfers across eight blockchains and documented multiple routes through THORChain, Chainflip, bridges, and other services.
Also Read | NEAR Protocol Expands AI Focus With New Ecosystem Development
Bitget Hack Funds Move Through Automated Routes
As described above, the proposed CoW Protocol tactic takes advantage of automation, not manually executed operations. It is possible to create orders using Chainflip deposit addresses, so the assets obtained after the execution of CoW settlement could be instantly used for other cross-chain operations. Such an approach generates a number of interconnected operations while enabling the stolen funds to transfer between different chains and denominations.
In turn, according to the results of Bitquery analysis, before arriving at Bitcoin, the stolen assets went through several cross-chain transfers. In particular, it was revealed that stolen TRX first migrated to Ethereum, and then to THORChain and Chainflip. Moreover, ETH and stablecoin deposits were detected in Chainflip-related operations.
Finally, the findings indicate that Chainflip activity led to the creation of Bitcoin payments. Specifically, according to Bitquery, 2,450 ETH were sent to the Chainflip liquidity pool, and then 74.46 BTC was withdrawn from it, while another 812 ETH and $14.6 million in stablecoins made their way through Chainflip swaps into Bitcoin.
Chainflip Activity Adds Another Layer
Chainflip is now among several cross-chain services that have surfaced on the fund trail. In addition to Chainflip, Bitquery identified the use of stolen BNB and TRX on THORChain, as 51.26 BTC was withdrawn from BNB swaps and 48.05 BTC via the TRX channel routed via Ethereum and THORChain. Another TRX-to-BTC route involved Chainflip as well, resulting in a 21.65 BTC withdrawal.
These Bitcoin withdrawals are important since they prove the trail moving further from the networks in which the assets had originally been stolen. By September 25, Bitquery had recorded a total of 126.71 BTC paid out in relation to the stolen BNB and TRX. The report highlights that other cryptocurrency addresses also received payments; thus, all assets in their wallets cannot be attributed to Bitget.
Chainflip-related transactions do not represent the entire laundering route. The investigation also identified bridges including Stargate, Across, and Circle’s CCTP that were used together with decentralized exchanges and routing services. A majority of stolen ETH was transferred to new wallets, after which some of it was withdrawn to BTC and other cryptocurrencies.
Bitget Hack Funds Move From XRP and Ethereum Into Bitcoin
Bitcoin has become a prominent destination for all the funds that have been found to be stolen until now. According to Bitquery, 90.5% of the stolen XRP worth 93.22 million XRP was exchanged for Bitcoin using the THORChain service. 7.6% of the funds were exchanged for ETH, demonstrating the use of different assets by the hacker while focusing the major part on BTC.
The funds in Ethereum have also begun moving, even though these funds were not moved at first. As per Bitquery’s latest snapshot, seven wallets holding Ethereum have already moved 51,899 ETH to other wallets, from which the funds were further moved through swap services and bridges. There is one more wallet that holds 10,000 ETH without making any transactions.
The large size and the fast movement of funds have become problematic for the investigators since public blockchains keep all transaction records; however, funds can move through various blockchain networks, bridges, wallets, and swapping mechanisms in a short time.
Investigation Tracks Cross-Chain Bitcoin Conversions
This latest information is just one part of the ongoing work to trace the destination of the assets taken from Bitget. Bitquery stated that Circle froze around 99,990 USDC while Tether froze around 239,113 USDT in the attacker wallets; however, native assets like ETH, XRP, and TRX are unable to be frozen by the issuer.
The attribution of the attack to North Korean-linked hackers is still developing and not yet conclusive. The latest SlowMist investigation identified suspicious behavior linked to the Bitget hack, with other blockchain records tracking the transactions of funds through CoW Protocol, Chainflip, THORChain, and other infrastructures. While the blockchain transactions show what occurred, they do not independently prove the identity of all the addresses used.
Going forward, for Bitget, investigators, and blockchain security agencies, the focus will most likely stay with the remaining funds and the creation of wallets. Funds in the form of ETH, stablecoins, and other assets are able to keep creating further transactions as they are transferred and bridged.
Also Read | Solana Price Eyes a Rally to $150 as Metaplex Expands RWA Tokenization
