Let's say that an end-user wishes to sell Bitcoin for Qora -- First, he will deposit bitcoin to a multisig bitcoin account generated and managed by Qora Exchange (name of an AT program sitting on Qora's blockchain). After received confirmations of the bitcoin deposit, the AT program will proceed to move the fund to the main exchange account and issue Bitcoin Asset IOU on the Qora Asset Exchange to the end user.
Unfortunately this doesn't work, because an AT cannot manage a bitcoin address. An AT cannot have secrets because everything it knows is on the Blockchain thus it cannot manage the private Key of a bitcoin address.