Key Highlights:
- A wallet labelled by blockchain security firm PeckShield as linked to the BlueMove hacker bridged another 193,000 USDC from Ethereum to Hyperliquid and purchased 306.59 XMR at approximately $630 per token.
- The same address routed another 200,000 USDC through Solana using Wormhole, returned the funds to Ethereum through deBridge and deposited them into Railgun.
- The transactions follow the July 11 BlueMove DEX exploit, in which an attacker drained 710,670 SUI, worth approximately $529,000, from 389 locked liquidity pools.
The wallet associated with the July BlueMove DEX exploit has continued moving funds across blockchain networks, with its latest transactions involving Hyperliquid, Solana and the privacy-focused Railgun. As per blockchain security firm PeckShield, the hacker-labelled address transferred 193,000 USDc from Ethereum to Hyperliquid and used the funds to buy 306.59 Monero (XMR) at around $630 per token.
It also moved another 200,000 USDC through Solana before depositing the funds into Railgun. The activity adds to earlier movements involving the same address and brings renewed attention to how funds from the July exploit are being transferred and potentially used across different networks.
How Did the BlueMove Hacker Move Funds Across Blockchain Networks?
In its latest alert on November 4, PeckShield reported that the address labelled as belonging to the BlueMove hacker bridged another 193,000 USDC from Ethereum to Hyperliquid. The wallet then purchased 306.59 XMR at approximately $630 per token. The address also moved 200,000 USDC from Ethereum to Solana through Wormhole. It subsequently transferred the funds back to Ethereum using deBridge and deposited them into Railgun.
These transactions followed an earlier movement reported by PeckShield, in which the same hacker-labelled address bridged 115,000 USDC from Ethereum to Hyperliquid and purchased 188.25 XMR at approximately $608.43 per token. Taken together, the two reported purchases amount to 494.84 XMR, although the transactions do not establish whether the acquired tokens were subsequently moved or converted.
The use of multiple networks and services is significant because it makes fund tracking more complicated. Wormhole and deBridge facilitate transfers between blockchain networks, allowing assets to move across different ecosystems. Railgun, meanwhile, is a privacy protocol that uses zero-knowledge proofs to shield transaction details. Depositing funds into such a protocol can make it more difficult for outside observers to follow their subsequent movement.
Monero also has built-in privacy features that conceal transaction information, including sender and receiver details and transaction amounts. Its use in the reported purchases therefore adds another privacy-focused asset to the wallet’s movement of funds. However, the available transaction reports do not establish the attacker’s precise intentions or confirm that all the transferred assets have been successfully concealed.
What Happened in the July BlueMove DEX Exploit?
BlueMove DEX, an automated market maker operating on the Sui and Aptos ecosystems, was exploited on July 11. As per Peakshield’s description, the attacker drained 710,670 SUI, valued at approximately $529,000 at the time, from 389 locked liquidity pools. The incident affected liquidity providers and prompted BlueMove to temporarily suspend its decentralized exchange while investigating the security breach. Its official interface subsequently displayed a security incidence notice stating that the protocol has been suspended and that affected users would be compensated.
#PeckShieldAlert The #BlueMove hacker-labeled address bridged another 193K ethereum:0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 from #Ethereum to #Hyperliquid and bought 306.59 $XMR at $630.
It also bridged 200K ethereum:0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 from #Ethereum to #Solana via #Wormhole, bridged it back to #Ethereum via #deBridge, and deposited it into #Railgun.
— PeckShieldAlert (@PeckShieldAlert) November 4, 2026
The notice also said the 48-hour response period given to the attacker had ended without a reply and directed users to a compensation claim process. The precise technical explanation for the exploit has been debated. BlueMove initially described the incident as involving a long-standing arithmetic overflow issue in its legacy automated market maker contract. However, a technical analysis published on the Sui developer forum in August argued that the drain resulted from a reserve-accounting mismatch between different versions of the protocol’s contracts.
The analysis said this discrepancy allowed the attacker to manipulate liquidity-pool accounting and extract funds. DefiLlama also lists the July 11 incident as a security exploit involving incorrect share accounting, recording losses of approximately $529,000. Its incident description refers to a possible double-minting mechanism introduced in a May 31 upgrade or an arithmetic issue in the older AMM code.
The latest transfers suggest that the wallet identified by PeckShield continues to move assets associated with the exploit several months after the incident. However, the reported on-chain activity alone does not confirm how much of the original stolen amount remains under the wallet’s control, whether any funds have been recovered, or whether the person behind the address has been identified.
Also Read: Blockchain Security: Protecting Your Digital Assets
