Chainalysis Reports on THORChain Attacker's Fund Movements

Chainalysis has reported on X platform that prior to the THORChain theft, the suspected attacker's wallet had been moving funds through Monero, Hyperliquid, and THORChain for several weeks. According to Odaily, the wallet associated with the attacker began funding Hyperliquid positions via Hyperliquid and Monero privacy bridges as early as late April. The funds were then converted to USDC, transferred to Arbitrum, and bridged to Ethereum. Some ETH was subsequently transferred to THORChain to stake RUNE as a new node, which is believed to be the attack source. Following this, the attacker bridged some RUNE back to Ethereum, splitting it into four paths, one of which led directly to the attacker. Forty-three minutes before the attack, 8 ETH was transferred to the wallet that ultimately received the stolen funds, while the other three paths saw funds flowing in the opposite direction. Between May 14 and 15, these wallets bridged ETH back to Arbitrum, deposited it into Hyperliquid, and transferred it to Monero via the same privacy bridge. The last transaction occurred less than five hours before the attack began. As of Friday afternoon, the stolen funds remain unused, but the attacker has demonstrated adept cross-chain money laundering skills, with the Hyperliquid to Monero path potentially being the next step.