Chainalysis: The source of the THORChain attack was skilled in money laundering, and the attack was carried out several weeks later.

Chainalysis disclosed THORChain attack source tracing in a post on X platform, which indicated that suspected attacker related wallets had transferred funds through Monero, Hyperliquid and THORChain for several weeks before attacking THORChain. Attacker related wallets had already transferred Hyperliquid positions through Hyperliquid and Monero privacy bridges as early as the end of April, and then the funds were exchanged for USDC and transferred to Arbitrum, and then bridged to Ethereum. Part of ETH was then transferred to THORChain to become a newly added node pledge RUNE, which was considered to be the attack source. After that, the attacker bridged part of the RUNE back to Ethereum and split it into four links, one of which went straight to the attacker, transferred through the intermediate wallet, and transferred 8ETH to the wallet that eventually received the stolen funds 43 minutes before the attack, and the other three links flowed in the opposite direction. On May 14 - 15, the wallets again bridged ETH back to Arbitrum, deposited in Hyperliquid, and transferred to Monero via the same privacy bridge, with the last transaction occurring less than five hours before the attack began. As of Friday afternoon, the stolen funds had not been used, but the attackers had demonstrated their adept cross-chain money laundering skills, and the Hyperliquid to Monero path could be the next move.