🔎 MistTrack TrackAgent spotted a notable cross-chain pattern in the movement of funds stolen from Bitget: Using a CoW Protocol + Chainflip combination to automate cross-chain transfers. The flow: 1) An automated script creates an order on #CoWProtocol. 2) The order’s recipient is set to a pre-prepared #Chainflip Deposit Contract address. 3) Once the order is executed, the assets enter Chainflip and are swapped across chains into BTC. ⤵️ One example: Create Order on CoW Protocol: https://etherscan.io/tx/0xae6b1153446a05db7123e94ed5e2de828a2f9f5dc4802429a77ba88fc2497b0a Order execution: https://etherscan.io/tx/0xfcb591c1c6aa0d0a6937b1ab3b834c27b9f6c096859b7a44b6df018187a80409 Chainflip Deposit Contract: 0xcEAE932A8bEE3a81a681A59890cb26d3110FDb65 Chainflip swap: https://scan.chainflip.io/swaps/1861124 Destination BTC address: bc1qa0rjjhyu9pg3adgpel4v7dct6a8606az863jyh The interesting part is the automation: rather than manually interacting with each bridge or swap, the attacker can prepare the destination and let the flow execute once the order is filled. We’ll continue tracking how the stolen funds move across chains and services. 👀