Validin pivots from Safe{Wallet}, SlowMist, and Mandiant/Google Cloud indicators tied to the FBI-attributed North Korean Lazarus Group Bybit hack to hunt for related command-and-control infrastructure. The analysis uses rare host-response traits from getstockprice domains, including Werkzeug/Python server values, banner and header hashes, JARM, and 404 title patterns, to identify additional finance- and crypto-themed domains. Newly surfaced infrastructure includes getcoinprice[.]info, financecap[.]io, en[.]stocksindex[.]org, wfinance-related hosts, api[.]stockinfo[.]io, and associated IPs and PTR patterns observed across late 2024 and early 2025. The value for defenders is a repeatable DNS-history and host-fingerprinting method that narrows infrastructure hunting around a high-impact cryptocurrency theft without treating every pivot result as confirmed actor-controlled.