Tectonic: the branch that skipped Tornado — 232 XMR1 still sitting on Hyperliquid

Tectonic is the largest lending market on Cronos. On 30 August an attacker pushed the price of its thinly traded TONIC token up roughly 300-fold, used it as collateral and borrowed $120.4 million across nine markets. Cronos validators halted the chain and restarted it from an earlier block, which undid most of the theft: $111.2 million came back. What had already crossed the bridge to Ethereum did not.

rekt.news identified 0xc404160B79BD8905061a1cAecBeCa2EEab3f72DD as the attacker’s Ethereum receiving wallet. It received about 6.3 million USDC through Relay and Circle between 12:59 and 14:15 UTC on 30 August and swapped it on Uniswap in 34 trades — together with 29 ETH delivered directly, that is the 2,592 ETH in the published account. A second wave followed on 2 September: about 207 ETH from eleven senders, 70.6 ETH of it from 0xfDb11781ee3818135eebd2acd2247C263e266652, the bridge exit wallet rekt.news also names.

On 3 September, between 20:28 and 21:14 UTC, the wallet put 2,658.9 ETH into the Tornado Cash router in 48 deposits. That part is gone.

At 23:55 UTC on 31 August, before any of that, the wallet sent a 0.1 ETH test and then 140 ETH to 0x6dF89C42f0ABdfAA2B5b77EdCdAFbc945eD6Ee6c. Minutes later, look-alike addresses beginning 0x6dF8 and ending 6eE6c started appearing in its history, with fake "ETH" and "USDC" tokens — address poisoners copying the destination, not the attacker. The real branch split two ways.

To Bitcoin, about 90 ETH. 58.2 ETH went through 0x7560E936a6978aD4ecDA6b395f4c7D1c65F8A595 and 32 ETH directly into Relay’s bridge, which paid out 1.80 BTC and 0.99 BTC to two fresh taproot addresses. Both were spent the same day, within hours, into transactions with hundreds of inputs and outputs in the fixed denominations of Wasabi-style coinjoins. That is where the Bitcoin trail ends.

To Hyperliquid, 49.9 ETH. Six fresh wallets received between 5 and 16.9 ETH each on 1 and 2 September. They are not the attacker’s own wallets. Each was topped up with exactly 0.0075 ETH of gas by 0xAe06669dfd3e932476F00ea49fCE82E5E63f83Bf — the gas station of Wagyu.xyz, a no-KYC service that swaps crypto into Monero — and every bridge out of them carries Wagyu’s integrator tag in LI.FI. They are order addresses Wagyu creates for a swap: the attacker paid ETH into six Wagyu orders to buy Monero. Each one bridged its ETH through LI.FI — five through Mayan, one through Layerswap — to its own address on Arbitrum, arriving as 121,631 USDC in total, and deposited it to Hyperliquid through its Bridge2 contract within minutes. On Hyperliquid every account bought XMR1, the Monero token issued by Wagyu.xyz.

Read from Hyperliquid on 23 September 2026, the six order addresses hold 232.0 XMR1 between them — about $130,000 at the market price of $563 — and it has not been delivered. Because the addresses are Wagyu’s, the XMR1 is not in the attacker’s hands: it is sitting in six orders that Wagyu has not completed. Once delivered to the attacker’s Monero address it cannot be followed.

Wagyu’s published policy is that it freezes assets only on a court order, but may block addresses it suspects of illegal activity. Before publishing we sent Wagyu the six addresses and the route, and sent the same to Tectonic, which would need to seek that order.

All twelve addresses in this trace — the receiving wallet, the bridge exit, the branch, the relay hop, the two Bitcoin addresses and the six Wagyu order addresses — are labelled in PublicAML under the Tectonic exploit. The order addresses carried nothing but the attacker’s money; Wagyu’s gas station itself is not labelled.