Starting in April, setting up nodes and making precise transfers of 8 ETH as gas 40 minutes before an attack—this operational rhythm doesn't feel spontaneous, it feels more like a rehearsed performance. The funds are currently sitting idle—are they waiting for the storm to pass or for the next exit?

Chainalysis reports that the stolen wallet from THORChain transferred funds over several weeks through Monero, Hyperliquid, and THORChain. In April, funds were deposited into Hyperliquid via a privacy bridge, then transferred to USDC on Arbitrum before bridging to Ethereum, with some ETH entering THORChain to become new RUNE nodes. The attacker split the RUNE into four routes back to Ethereum, one of which went directly and sent 8 ETH to the final wallet about 40 minutes before the attack. The other three routes of funds flowed in reverse through Hyperliquid/Monero back to Monero. As of Friday, the funds had not been moved, but the case demonstrated cross-chain money laundering capability, with the Hyperliquid to Monero path potentially being the next step.