According to MistTrack, the on-chain tracking platform of SlowMist, the Bitget attacker attempted to transfer stolen funds via the cross-chain liquidity protocol Chainflip, but the transaction was rejected at the broker interface, and the protocol subsequently returned the deposit directly to the sender. Yu Xian, the founder of SlowMist, stated that Chainflip is actively preventing North Korean hacker groups from money laundering, but its AML (Anti-Money Laundering) and KYT (Know Your Transaction) solutions are still lagging behind the attackers' speed. The attackers used automated tools to split funds, transfer them across chains, and quickly switch to new paths when blocked, ultimately converting the illicit gains into Bitcoin and obfuscating them through CoinJoin.