Chainalysis tracks the source of the THORChain attack: skilled in money laundering, the attack was carried out weeks after cross-chain fund movements
By: rootdata|2026/05/18 23:57:25
0
Share
Prefer us on Google
Chainalysis posted on the X platform that before the theft of THORChain, wallets suspected to be associated with the attacker had been transferring funds through Monero, Hyperliquid, and THORChain for several weeks. The attacker-associated wallets had already deposited into Hyperliquid positions via the Hyperliquid and Monero privacy bridge as early as the end of April. The funds were then exchanged for USDC and transferred to Arbitrum, and later bridged to Ethereum, with some ETH subsequently transferred to THORChain to become staked RUNE for newly added nodes, which are believed to be the source of the attack.
Afterward, the attacker bridged some RUNE back to Ethereum and split it into four pathways, one of which went directly to the attacker. After being transferred through intermediate wallets, 8 ETH was sent to the final wallet receiving the stolen funds 43 minutes before the attack. The funds from the other three pathways flowed in the opposite direction. These wallets bridged ETH back to Arbitrum, deposited it into Hyperliquid, and transferred it into Monero through the same privacy bridge, with the last transaction occurring less than 5 hours before the attack began.
As of Friday afternoon, the stolen funds have not yet been used, but the attacker has demonstrated their skilled cross-chain money laundering capabilities, and the Hyperliquid to Monero path may become the next move.
-- Price
--
--
--
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
April 2026 is not just a security crisis; it is the moment when the industry's mental model completely collapses, and it is also the moment when the protocols that can survive are distinguished from those that cannot.
THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
THORChain has released its fourth update regarding the attack incident on May 15, and the proposal ADR028 has been announced, with voting for node operators now open.According to the recovery plan, the protocol will first absorb losses through its own liquidity, with the remaining portion to be shar...
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
The Echo Protocol encountered a vulnerability attack on the Monad network, where the attacker minted 1,000 eBTC (worth approximately $76.64 million). According to PeckShield's tracking, the attacker deposited 45 eBTC (about $3.45 million) into Curvance, borrowed 11.29 WBTC, and then bridged it to Et...
THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability
THORChain released an update on the hacking incident on platform X. Preliminary evidence suggests that a node that recently joined the network may have been controlled by a malicious operator, who exploited the GG20 TSS vulnerability to obtain key information from vault participants, ultimately reco...
THORChain has not initiated any refund, airdrop, or compensation plans, reminding the community to be vigilant against fraud
THORChain officials stated that a large number of fake accounts and false information have appeared in the market, involving activities such as "refunds," "airdrops," and "compensations"; preliminary investigations show that user funds were not harmed in the previous security incidents, and no refun...
The Balancer hacker has currently exchanged 14,300 ETH for 419.3 BTC
According to on-chain analyst Yu Jin's monitoring, the Balancer hacker has started exchanging ETH for BTC through THORChain, having already converted 14,300 ETH into 419.3 BTC (worth $32.51 million).He currently holds 7,700 ETH on the ETH chain and 419.3 BTC on the BTC chain, valued at $50.4 million...
Data: Balancer hackers today exchanged 7,000 ETH for 204.7 BTC, worth approximately 15.88 million USD
According to on-chain analyst Yu Jin's monitoring, the KelpDAO hacker exchanged all 75,700 ETH for BTC through THORChain yesterday. The hacker who stole $98 million in assets from Balancer last November also exchanged ETH for BTC through THORChain today.Today, the Balancer hacker has already exchang...
Kelp DAO Attacker Transfers $175M in Ether Following Exploit
Key Takeaways: The Kelp DAO exploiter has moved $175 million worth of Ether, part of a larger $290…
Kraken users fell victim to a social engineering attack, resulting in 8,662 ETH being stolen and transferred to HitBTC
According to on-chain analyst Yu Jin (@EmberCN), a Kraken user is suspected of falling victim to a social engineering attack, resulting in the theft of 8,662 ETH, worth approximately $18.19 million. The attacker then exchanged 878 ETH for 26.5 BTC using the cross-chain tool THORChain, and six hours ...
ZachXBT: A certain Kraken user is suspected of being a victim of social engineering fraud, resulting in a loss of 18.2 million dollars
According to ZachXBT, an unidentified Kraken user is suspected of losing approximately $18.2 million due to a social engineering scam.The address involved started transferring funds from Ethereum to Bitcoin through the SafePal wallet and THORChain about 45 minutes ago.
ZachXBT: $1.2M Theft Address Likely Belongs to THORChain Founder John-Paul
BlockBeats News, September 12th, On-chain detective ZachXBT commented on the "A THORChain User Was Hacked for $1.2 Million" incident, suggesting that the address may belong to THORChain founder John-Paul Thorbjornsen (JP, @jpthor), whose private wallet was compromised a few days ago due to a fake co...
Shield Wall: THORChain Suffers Attack, Loses Around $1.2 Million
BlockBeats News, September 12, according to PeckShieldAlert, THORChain was attacked, losing approximately $1.2 million.
Vitalik Discusses Ethereum Scaling Path, Circle Announces Partnership with Polymarket, What's the Overseas Crypto Community Talking About Today?
What was the most talked-about topic among foreigners in the last 24 hours?
BTC Whale Swaps to ETH Again, Moving $38.84M in Value
BlockBeats News, January 16th, according to ChainInfo, the whale/institution that swapped BTC for ETH the day before yesterday, today continued to sell 404 BTC ($38.84 million) through the cross-chain exchange tool THORChain for 11,533 ETH.In two days, they have exchanged a total of 686.1 BTC ($65.1...
Ripple and SBI Team Up for RLUSD Stablecoin Launch in Japan by Early 2026
Latest Crypto Market Snapshot as of August 22, 2025 BTC Soars to $115,250.00 ETH Hits $4,450.75 XRP Climbs…
Why Bitcoin in El Salvador Captured Only 0.7% of the Remittance Market Five Years After the Law
Bitcoin in El Salvador has not become a mainstream channel for family remittances: according to the Central Bank of the country, in the first half of 2026, only $35.4 million was received through cryptocurrency services out of more than $5 billion in total remittance volume. This is about 0.7% of th...
Bitcoin Rises on Dollar Weakness... Next Challenge is Yen Strength
Brent Crude Surpasses $90 as Middle East Risks Escalate
Iranian parliamentary officials have publicly mentioned the possibility of reviewing nuclear doctrine and withdrawing from the Treaty on the Non-Proliferation of Nuclear Weapons (NPT) due to increased U.S. military pressure. While the rhetoric has intensified, interpretations suggest that it is more...
Hormuz Strait's 20 Million Barrels Daily Passage: Restricted Navigation Threatens to Prolong War
The oil passage through the Strait of Hormuz is wavering between complete blockade and normal operations, emerging as a variable that could determine the duration of the Iran war and the flow of international oil prices. If even a portion of the oil can escape, the short-term supply shock may be del...
Critique of Cryptocurrency: Ben McKenzie Releases Documentary on FTX Collapse and Market Risks
American actor Ben McKenzie, known to audiences from the series The O.C. and Gotham, has presented a documentary titled Everyone Is Lying To You For Money, where the critique of cryptocurrencies becomes the main theme. The film continues the ideas from his book on the crypto market, co-written with ...
Bitcoin and Ethereum ETFs just had their biggest week of 2026 as crypto exploded higher
Bitcoin and Ethereum funds posted their biggest inflow week of 2026 as fresh capital arrived alongside the short squeeze.
Ledger Vulnerability Could Allow Signing of Different Ethereum Transaction Than Displayed
Crypto Industry M&A: Europe's Strict Rules May Trigger a Wave of Deals in the Crypto Sector
M&A in the crypto industry is coming to the forefront as Europe launches MiCA, while the UK finalizes its own regulations for the cryptocurrency market. The new reality is simple: obtaining a license is no longer enough; companies now need to spend years on compliance, risk management, customer prot...
Bitcoin Core considers dropping encrypted routing support as poor node health exposes users to eclipse attacks
Bitcoin Core is weighing a CJDNS warning in 32.x and possible removal in 33.x after one seeder found seven good nodes.
How the Infinite Money Bug on the Stock Market Broke
The fall of the crypto market has crushed the infinite money bug—a market scheme that public companies holding cryptocurrency on their balance sheets had profited from for several years. Now, some of these players are urgently trying to repackage themselves into businesses related to artificial inte...
Sharp Decline in Economic Expectations: 6 out of 10 Argentinians Believe They Will Be Worse Off in the Coming Months
The perception of the economy has deteriorated despite the stabilization of some macroeconomic variables. 64% fear job loss.
A Wall Street Guru Bets on Gold and Explains Why It Remains His Favorite Hedge
Michael Hartnett, strategist at Bank of America, maintains his recommendation on the metal as protection against a potential weakness of the dollar, asset inflation, and a decline in bonds.
Why Shadow Crypto Exchanges Won't Disappear After Raids at 'Gorbushka' and 'Moscow City'
Shadow crypto exchanges in Russia are taking painful hits after raids, but such operations do not destroy the market itself. Alexander Brazhnikov, director of the Russian Association of Cryptoeconomics, Artificial Intelligence, and Blockchain, believes that law enforcement can disrupt individual fra...
DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code
April 2026 is not just a security crisis; it is the moment when the industry's mental model completely collapses, and it is also the moment when the protocols that can survive are distinguished from those that cannot.
THORChain has released a recovery plan for the attack incident, and voting for node operators has begun
THORChain has released its fourth update regarding the attack incident on May 15, and the proposal ADR028 has been announced, with voting for node operators now open.According to the recovery plan, the protocol will first absorb losses through its own liquidity, with the remaining portion to be shar...
Cryptocurrency Market Update: Major Developments and Insights
Key Takeaways Sky co-founder Rune Christensen has leveraged strategic moves to short the S&P 500 and invest in…
Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways: The attacker moved $175 million in stolen ETH to new wallets using privacy tools. The exploit…
Three major DeFi attacks in five days, with a total of 14 cryptocurrency hacking incidents in May
The Echo Protocol encountered a vulnerability attack on the Monad network, where the attacker minted 1,000 eBTC (worth approximately $76.64 million). According to PeckShield's tracking, the attacker deposited 45 eBTC (about $3.45 million) into Curvance, borrowed 11.29 WBTC, and then bridged it to Et...
THORChain: RUNE transfers are expected to resume in 12 hours, the attack may be due to the GG20 TSS vulnerability
THORChain released an update on the hacking incident on platform X. Preliminary evidence suggests that a node that recently joined the network may have been controlled by a malicious operator, who exploited the GG20 TSS vulnerability to obtain key information from vault participants, ultimately reco...
...
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com
