The cross-chain money laundering routes have been thoroughly exposed, from Hyperliquid to Monero and then to THORChain nodes; this chain of operations is more complex than DeFi LEGO blocks.

Chainalysis reports that the stolen wallet from THORChain transferred funds over several weeks through Monero, Hyperliquid, and THORChain. In April, funds were deposited into Hyperliquid via a privacy bridge, then transferred to USDC on Arbitrum before bridging to Ethereum, with some ETH entering THORChain to become new RUNE nodes. The attacker split RUNE into four routes back to Ethereum, one directly reaching the final wallet and sending 8 ETH approximately 40 minutes before the attack, while the other three routes flowed back through Hyperliquid/Monero to Monero. As of Friday, the funds have not been moved but demonstrate cross-chain money laundering capabilities, with the Hyperliquid to Monero path potentially being the next step.