How This Millionaire Crypto Hacker Continues to Freely Cash Out a Year Later

Why It Matters

The ongoing exits erode confidence in bridge and mixer ecosystems, pressuring DeFi projects to tighten operational security and regulators to refine monitoring of illicit flows, while exchanges must enhance behavior‑based controls to prevent tainted assets from re‑entering the market.

Summary

A year after the Radiant hack that stole roughly $50‑$58 million from its Arbitrum and BNB Chain lending pools, the same attacker has been quietly cashing out large ETH tranches via cross‑chain bridges and the Tornado Cash mixer. On Oct. 31 2025 the hacker moved about 5,411.8 ETH (≈$20.7 million) to Tornado, following a prior 2,834.6 ETH (≈$10.8 million) deposit nine days earlier, both staged through Arbitrum and BNB Chain bridges and DEX swaps to consolidate into ETH. The breach stemmed from a compromised multi‑signature process involving many key‑holders, highlighting operational weaknesses that a state‑backed group allegedly exploited. Analysts say the methodical, low‑profile laundering underscores persistent vulnerabilities in cross‑chain infrastructure and the limited effectiveness of current compliance tools.