Chainalysis Reveals THORChain Attacker Transferred 8 ETH Weeks Before Strike, Displaying Advanced Cross-Chain Laundering Skills

According to Chainalysis, the THORChain attacker executed a sophisticated multi-week preparation involving cross-chain fund transfers through Monero, Hyperliquid, and THORChain. Beginning in late April, the attacker moved funds via privacy bridge to Hyperliquid, converted them to USDC, bridged to Arbitrum then Ethereum, and deployed ETH as staked RUNE on the targeted node. In the final stage, the attacker split RUNE across four chains, transferring 8 ETH to the final receiving wallet 43 minutes before the attack. Other pathways reversed through Arbitrum back into Hyperliquid, exiting via the same Monero privacy bridge within 5 hours of the attack. As of Friday, stolen funds remain unmoved, but the attacker has demonstrated sophisticated laundering capabilities; the Hyperliquid-to-Monero pathway may signal the next step.