According to CoinMeta, Cosin, the founder of SlowMist, stated that MistTrack TrackAgent discovered suspected North Korean hackers transferring stolen funds using a combination of paths involving CoW Protocol and Chainflip. The attackers utilized automated scripts to place orders on CoW Protocol, setting the payment recipient address to a pre-prepared Chainflip Deposit contract. Once the orders were executed, they could proceed to Chainflip to complete cross-chain exchanges, ultimately converting the assets into BTC. The case showed that the relevant funds entered Chainflip after completing the transaction through CoW and eventually flowed to the address Bitcoin. This path directly connects DEX transactions with cross-chain exchanges, increasing the difficulty of tracking the stolen funds.