North Korean Hackers Refine Money Laundering Tactics with Automated Cross-Chain Mixing
A recent security incident involving cryptocurrency exchange Bitget has drawn attention to the evolving methods of cybercriminal groups. According to monitoring data from blockchain security firm SlowMist, hackers linked to North Korea are employing a more sophisticated and automated approach to process stolen funds. Their strategy moves beyond simple on-chain transfers, instead cleverly combining decentralized exchange protocols with cross-chain bridges to obfuscate the trail.
The Core of the Laundering Chain: A CoW Protocol & Chainflip Combo
The entire operation hinges on the serial use of two key components. First, hackers utilize automated scripts to initiate token swap orders on the CoW Protocol. This protocol's design, featuring batch auctions and intent-based trading, provides a layer of obfuscation for fund mixing.
A more critical step lies in the order configuration. Analysis reveals that when creating orders, the hackers did not set a conventional personal wallet as the recipient address. Instead, they directed proceeds directly to a pre-configured Chainflip deposit contract address. This means that once an order is matched and executed on the market, the swapped funds are sent directly into the cross-chain infrastructure.
Automated Cross-Chain Conversion and Final Cash-Out
Once funds enter the Chainflip contract, the cross-chain protocol automatically executes the subsequent conversion process. Chainflip's architecture enables seamless asset transfers between different blockchain networks. In this case, the stolen assets were ultimately converted to Bitcoin (BTC). Following the cross-chain swap, the BTC was transferred to the hackers' final destination address, completing the "cleaning" process from stolen assets to a mainstream cryptocurrency.
Analysis and Security Implications
This "protocol + cross-chain bridge" combined attack method highlights several concerning trends:
- High Automation: The entire flow is script-driven, minimizing manual intervention and increasing both efficiency and stealth.
- Leveraging DeFi Composability: Hackers are assembling different neutral infrastructure pieces (trading protocols, bridges) into new laundering tools, exploiting the composable nature of DeFi.
- Clear End Goal: Choosing to convert assets to Bitcoin likely considers BTC's continued high liquidity for subsequent movement or over-the-counter trading.
For exchanges and users, such incidents reinforce the critical importance of asset security and continuous monitoring. They also present a new challenge for DeFi protocols and cross-chain service providers: how to enhance the ability to identify and control risks associated with potentially illicit fund flows while maintaining an open ecosystem.