Key Highlights
- On-chain transactions sent to the hacker’s wallet addresses contained unsolicited messages urging the perpetrator not to return assets to CZ and linking to a fake THORChain swap platform.
- THORChain halted operations across 10 of its 13 supported blockchains over the weekend following the exploiter’s illicit movement of stolen digital assets.
- Unfazed by marketing pitches and on-chain requests, the attacker began converting 970,522 stolen SOL (valued at approximately $96 million) into bitcoin via cross-chain bridge Relay.
On-Chain Messages Target Hacker With Phishing Links and Promotional Pitches
In the wake of a massive cryptocurrency exploit, blockchain transaction observers have spotted bizarre activity directly on the hacker’s public ledger addresses. Twice on Friday, inbound payments arrived at the culprit’s designated wallets containing embedded input data. The transactions delivered the message Use https://swap.thorchain.ai and swap your funds, never return it to CZ,
targeting an address holding 437 BTC as well as an address that previously consolidated an enormous sum of 18,270 BTC. A longer version of the communication explicitly warned the attacker that they should never accept a whitehat bounty or recovery settlement.
Investigation into the embedded URL reveals that it directs users to a fraudulent domain masquerading as an authentic THORChain interface. The phishing attempt came amid major disruptions for THORChain, the cross-chain liquidity network that the exploiter had initially leveraged to transfer the pilfered funds. In response to the high-profile movement of stolen capital, THORChain suspended operations on 10 of its 13 integrated blockchains over the weekend to mitigate further systemic exposure.
Opportunistic Solicitations and Halloween Messages Fail to Deter the Exploit
Beyond malicious phishing schemes, external cryptocurrency market participants have also treated the attacker’s public addresses as an advertising board. A self-identified Turkish crypto influencer broadcast a promotional plea for their own venture, writing that any donations you send will go toward developing the $NST token ecosystem.
The unusual barrage of input messages continued into early Saturday, when another user sent a transaction reading Happy Hacklloween Satoshis for treats PLS.
Despite the flurry of spam, social engineering attempts, and opportunistic solicitations, the hacker has maintained complete silence, issuing no replies or acknowledgments. Instead, the malicious actor continued laundering operations unabated, systematically expanding their primary bitcoin holdings.
Elon Musk Dismisses $120 Billion Anthropic Exit Talk as SpaceX Plans $74 Billion AI Expansion
Attacker Swaps Tens of Millions in SOL for Bitcoin
Rather than negotiating or falling victim to external ploys, the exploiter accelerated asset conversion efforts over the weekend. On Sunday, the entity initiated the exchange of 970,522 stolen SOL, carrying an estimated market value of $96 million. The perpetrator utilized the cross-chain bridge Relay to facilitate the conversion of the Solana tokens directly into bitcoin, further centralizing the stolen proceeds into BTC.
Why This Matters
The incident demonstrates the public, permissionless nature of transparent blockchains, where anyone can broadcast transactions and arbitrary text to prominent wallet addresses. Cybercriminals, promoters, and scammers increasingly track high-value hacker addresses in real-time, seeking to divert stolen wealth through phishing portals or solicit capital. Furthermore, the attacker’s ongoing utilization of cross-chain bridges like Relay—combined with THORChain’s partial network shutdown—underscores the critical security and liquidity hurdles that decentralized finance (DeFi) protocols face when attempting to deter illicit fund laundering.
Frequently Asked Questions
Why did THORChain halt services across most of its chains?
THORChain paused trading on 10 of its 13 supported blockchains over the weekend after the attacker began utilizing the decentralized cross-chain protocol to swap and obfuscate the stolen assets.
What methods is the hacker using to launder the stolen funds?
The perpetrator has actively utilized cross-chain routing services and liquidity bridges, including THORChain and Relay. Most recently, the hacker leveraged Relay to swap nearly one million stolen SOL tokens—worth roughly $96 million—into bitcoin.
Did the hacker respond to the on-chain phishing or promotional messages?
No. None of the inbound transactions, which included phishing sites mimicking THORChain and promotional pitches for the $NST token ecosystem, have elicited any response or interaction from the attacker.
