THORChain Attack Perpetrator Demonstrated Sophisticated Cross-Chain Money Laundering Over Weeks, Chainalysis Tracking

According to Chainalysis on May 16, the suspected THORChain attacker moved funds across Monero, Hyperliquid, and THORChain for weeks before executing the attack. The attacker-linked wallet deposited funds via Hyperliquid and privacy bridges in late April, converted assets to USDC, bridged through Arbitrum to Ethereum, then staked RUNE on THORChain as a new node identified as the attack source. Part of the stolen funds were subsequently routed through multiple chains, with 8 ETH transferred to the final receiving wallet just 43 minutes before the attack.

From May 14–15, the attacker bridged ETH back to Arbitrum, deposited into Hyperliquid, and moved through privacy bridges to Monero, with the final transaction occurring less than five hours before the attack. As of Friday, the stolen funds remain unused, but the attacker has demonstrated proficiency in cross-chain laundering, with the Hyperliquid-to-Monero pathway likely to be the next step.