Chainalysis tracks the source of the THORChain attack: skilled in money laundering, the attack was carried out weeks after cross-chain fund movements
Prefer us on Google
Chainalysis posted on the X platform that before the theft of THORChain, wallets suspected to be associated with the attacker had been transferring funds through Monero, Hyperliquid, and THORChain for several weeks. The attacker-associated wallets had already deposited into Hyperliquid positions via the Hyperliquid and Monero privacy bridge as early as the end of April. The funds were then exchanged for USDC and transferred to Arbitrum, and later bridged to Ethereum, with some ETH subsequently transferred to THORChain to become staked RUNE for newly added nodes, which are believed to be the source of the attack.
Afterward, the attacker bridged some RUNE back to Ethereum and split it into four pathways, one of which went directly to the attacker. After being transferred through intermediate wallets, 8 ETH was sent to the final wallet receiving the stolen funds 43 minutes before the attack. The funds from the other three pathways flowed in the opposite direction. These wallets bridged ETH back to Arbitrum, deposited it into Hyperliquid, and transferred it into Monero through the same privacy bridge, with the last transaction occurring less than 5 hours before the attack began.
As of Friday afternoon, the stolen funds have not yet been used, but the attacker has demonstrated their skilled cross-chain money laundering capabilities, and the Hyperliquid to Monero path may become the next move.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
THORChain Soft Launch Integrates Monero, ADR31 and ADR27 Proposals Passed, v3.20 Enters Testing
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability
THORChain has not initiated any refund, airdrop, or compensation plans, reminding the community to be vigilant against fraud
The Balancer attacker associated address transferred 5,609 ETH to THORChain, worth 13 million dollars
The Balancer hacker has currently exchanged 14,300 ETH for 419.3 BTC
Data: Balancer hackers today exchanged 7,000 ETH for 204.7 BTC, worth approximately 15.88 million USD
Kelp DAO Attacker Transfers $175M in Ether Following Exploit
Key Takeaways: The Kelp DAO exploiter has moved $175 million worth of Ether, part of a larger $290…
Kraken users fell victim to a social engineering attack, resulting in 8,662 ETH being stolen and transferred to HitBTC
ZachXBT: A certain Kraken user is suspected of being a victim of social engineering fraud, resulting in a loss of 18.2 million dollars
ZachXBT: $1.2M Theft Address Likely Belongs to THORChain Founder John-Paul
Shield Wall: THORChain Suffers Attack, Loses Around $1.2 Million
THORChain launches native support for Solana
Data: A certain whale exchanged 102 BTC for 3489 ETH
A giant whale exchanged 99.5 BTC for 3,347 ETH through ThorChain
Vitalik Discusses Ethereum Scaling Path, Circle Announces Partnership with Polymarket, What's the Overseas Crypto Community Talking About Today?
BTC Whale Swaps to ETH Again, Moving $38.84M in Value
Ripple and SBI Team Up for RLUSD Stablecoin Launch in Japan by Early 2026
Latest Crypto Market Snapshot as of August 22, 2025 BTC Soars to $115,250.00 ETH Hits $4,450.75 XRP Climbs…
THORChain Soft Launch Integrates Monero, ADR31 and ADR27 Proposals Passed, v3.20 Enters Testing
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
