Chainalysis reveals the flow of funds for THORChain attackers

According to Chainalysis' article on the X platform, the wallet associated with the THORChain attacker transferred funds through Monero, Hyperliquid, and THORChain in the weeks leading up to the attack. The attacker's wallet deposited Hyperliquid positions through the Hyperliquid and Monero privacy bridges at the end of April. The funds were exchanged for USDC and transferred to Arbitrarum, which then bridged to Ethereum. Part of ETH is transferred to THORChain and staked as RUNE to become a new node, which is considered the source of the attack.