An archived BLIN Analytics post links the DMM Bitcoin hack to hackers from the DPRK and says the same coinjoin service was used in the case. The post notes that the service did not fully obfuscate change outputs, which could leave useful traces for blockchain analysis. The evidence in the excerpt is limited to the archived social-media claim, so the summary should be treated as attribution and laundering context rather than a full technical incident report.