Blockchain analytics firms TRM Labs and Chainalysis identified strong behavioral matches to known North Korean activity, including the 2025 Bybit hack. Evidence includes the commingling of stolen funds with proceeds from the previous Bitget exploit, the use of Tornado Cash to fund operational wallets, and highly specific laundering patterns.