A TrackAgent spotted a notable cross-chain pattern in the movement of funds stolen from Bitget: Using a CoW Protocol + Chainflip combination to automate cross-chain transfers.
The flow:
An automated script creates an order on #CoWProtocol.
The order’s recipient is set to a pre-prepared #Chainflip Deposit Contract address.
Once the order is executed, the assets enter Chainflip and are swapped across chains into BTC.
⤵️ One example:
Create Order on CoW Protocol: etherscan.io/tx/0xae6b11534…
Order execution: etherscan.io/tx/0xfcb591c1c…
Chainflip Deposit Contract: 0xcEAE932A8bEE3a81a681A59890cb26d3110FDb65
Chainflip swap: scan.chainflip.io/swaps/1861124
Destination BTC address: bc1qa0rjjhyu9pg3adgpel4v7dct6a8606az863jyh
The interesting part is the automation: rather than manually interacting with each bridge or swap, the attacker can prepare the destination and let the flow execute once the order is filled.
@EthSecurity1