CoinMetro was included among cryptocurrency hacks that ZachXBT traced to Lazarus Group, also described in the evidence as Bluenoroff or APT38, within a broader August 2020 to October 2023 laundering investigation. The linked evidence says the campaign affected exchanges, DeFi projects, and individuals, with stolen funds routed through intermediary wallets, mixers, Ren Protocol, conversion services, and OTC infrastructure.