The attacker behind the NEAR Intents hack sent dust transactions to the infamous Ronin bridge address in an apparent attempt to mislead investigators into attributing the exploit to North Korea. Security researcher Tayvano identified the tactic as a deliberate false flag operation designed to mimic state-sponsored activity. This strategy mirrors techniques previously used by the Euler Finance hacker, where perpetrators intentionally route funds to known North Korean-linked addresses to create confusion. According to Tayvano, this specific demographic of hackers believes such misdirection is clever but often gets caught immediately after executing these obvious attribution tricks.