According to CoinMeta, and based on monitoring by SlowMist Cosine, North Korean hackers used automated scripts to place orders at CoW Protocol, setting the payment recipient addresses to pre-prepared contract addresses related to Chainflip and deposit. After the orders were executed, the relevant assets could be transferred across chains at Chainflip and exchanged for BTC. This operation involved funds that were stolen from Bitget.