SlowMist Cosine: North Korean hackers use a combination of Cow and Chainflip for cross-chain operations, automating the transfer of stolen Bitget funds into BTC. According to monitoring by SlowMist Cosine, the SlowMist TrackAgent detected that North Korean hackers utilized a combination of Cow Protocol and Chainflip to perform cross-chain operations with the stolen Bitget funds. The hackers' automated script creates orders via Cow Protocol, setting the receiving address to a pre-prepared Chainflip Deposit-related contract address. Once the order is successful, the cross-chain operation on Chainflip is completed, converting the assets into BTC.