Blockchain sleuths tracked the haul as it was split and bridged across networks—about 288.37 BNB to BNB Chain and 123.6 ETH to Ethereum—moves consistent with rapid obfuscation playbooks seen in recent DeFi thefts.
Investigators now believe the attackers likely funneled portions of the funds through an obscure anonymizing service dubbed zeroexch.io, using fragmentation and cross‑chain hops to blur on‑chain provenance before final dispersal.
Hyperdrive said it suspended all money markets and withdrawals while the probe continues. Independent coverage has flagged a potential arbitrary‑call/router weakness as a working theory for initial access, though the team emphasized that thBILL itself shows no direct vulnerability.