More than a year after a devastating multi-chain security breach shook the decentralized finance sector, the perpetrators behind the Radiant Capital exploit are continuing a methodical and calculated effort to launder their ill-gotten gains. In the latest phase of digital asset movement, blockchain surveillance tools and security analysts have tracked substantial tranches of Ethereum flowing through privacy-enhancing protocols, underscoring the persistent challenges security teams and compliance officers face when tracking cross-chain thefts.
On Oct. 31, 2025, the Radiant exploiter transferred approximately 5,411.8 Ether to Tornado Cash, a privacy tool designed to obscure transaction trails. At the time of the transfer, the movement was worth roughly $20.7 million. This substantial transaction followed a similar pattern executed just nine days earlier, when the same cluster of addresses moved approximately 2,834.6 Ether, equivalent to $10.8 million. Before reaching the mixer, those earlier funds were meticulously staged across multiple blockchains and funneled through various decentralized exchanges and token swaps.
Neither of these recent financial bursts appeared rushed or panicked. Instead, both operations exhibited the traits of a careful, disciplined operator testing market liquidity and compliance timing. The deposits were systematically parceled into common Tornado Cash denominations, an approach that minimizes transaction costs during blending while maximizing the difficulty of tracing the funds across public ledgers.
How the Radiant Hack Happened
To understand the significance of these ongoing laundering operations, it is necessary to examine the origins of the breach. The Radiant Capital story began on Oct. 16, 2024, when its lending pools operating across the Arbitrum and BNB Chain networks were drained of approximately $50 million to $58 million. Early technical post-mortems conducted by blockchain security firms quickly converged on a simple yet devastating vulnerability.
The breach was not the result of a complex smart contract flaw, but rather an operational compromise involving keyholders and administrative approvals. This lapse allowed an attacker to push malicious transactions directly through a multi-signature process. Security firms detailed how legitimate signers were successfully induced to approve the wrong calls, bypassing normal defensive measures.
At the time, the project relied on a three-out-of-eleven threshold scheme for sensitive administrative actions. While this broad set of signers improved operational availability and decentralized control, it significantly widened the surface area for device compromise and targeted social engineering. Comprehensive analysis from firms like Halborn reconstructed how specific approvals and lax device hygiene created narrow windows of opportunity that the attacker successfully exploited. Radiant’s own subsequent incident updates helped refine the timeline and scale of the attack.
Later intelligence and reporting suggested that a sophisticated, state-backed threat actor utilized advanced impersonation tactics to gain initial access, a narrative that Radiant leadership echoed as the dust began to settle across the ecosystem.
CryptoSlate covered the immediate fallout at the time through the lens of broader crypto crime trends. A retrospective report noted that total exploit losses for October 2024 fell to approximately $116 million. Notably, the Radiant incident accounted for nearly half of that monthly total, placing an outsized share of the industry’s financial pain into a single catastrophic event.
This framing remains crucial because it demonstrates how a single, well-executed cross-chain breach can profoundly distort a given month’s risk profile, even when the broader macroeconomic and security environment appears relatively calm.
What followed over the subsequent year established the predictable pattern visible today. Funds were systematically moved out of Layer 2 networks and routed back to Ethereum through cross-chain bridges, where network liquidity is deepest and most accommodating for large volumes. Subsequent token swaps consolidated fragmented balances cleanly into Ether, preparing the inventory for the mixing process.
The tranche moved on Oct. 22 and 23, 2025, provides a clear case study of this methodology. Security platform CertiK flagged 2,834.6 Ether in Tornado Cash deposits, noting that 2,213.8 Ether of that total had arrived directly via the Arbitrum bridge from an externally owned address, while the remainder was sourced from conversions involving DAI stablecoins.
The Oct. 31 burst expanded the running total by another 5,411.8 Ether, utilizing modular deposits that precisely matched standard Tornado pool norms. Because the blockchain remains public, the route is entirely predictable, yet the economic and structural incentives strongly encourage patience over spectacle.
What the New Laundering Bursts Reveal
The recent mixer activity reads more like a slow bleed strategy designed to evade detection over an extended timeframe rather than a hurried single exit. Bridge hops originating from Arbitrum or BNB Chain pull balances into the deepest liquidity pools on the Ethereum mainnet. Decentralized exchange rotations then lock the inventory into Ether for the most efficient entry into Tornado Cash.
Batching funds into standardized denominations fractures the public transaction graph into smaller, disconnected fragments that are exceptionally costly and time-consuming to stitch back together. Despite these hurdles, compliance and analytics teams still retain significant visibility. Sophisticated tools cluster addresses around shared gas usage patterns and precise timing, match deposit amounts to withdrawal execution windows, and watch for telltale peel chains that start with minor amounts, spread wide across the network, and eventually aggregate near a target exchange venue.
This defensive posture remains pragmatic because the evolving legal and regulatory environment generally rewards pragmatism. Courts have progressively narrowed the government’s broadest theories regarding the legal sanctioning of decentralized software protocols. Prosecutors have won and lost various legal battles related to crypto mixers and developer liability, creating a complex judicial landscape.
The result is a distinct gray zone where privacy-focused tools continue to operate, and centralized exchanges increasingly rely on behavior-driven monitoring controls rather than blanket administrative labels. Comprehensive investigations still manage to catch and flag illicit exits, but the primary friction has fundamentally shifted from software constraints to investigative process.
For industry users and protocol builders, the lessons learned from the Radiant exploit are concrete and actionable. Architectural design choices carry direct financial outcomes. Bridges and cross-chain routers naturally concentrate both value and potential failure modes, which is precisely why exploiters target them on their way out of a compromised ecosystem. Multi-chain applications require institutional muscle memory for emergency halts, allowlist modifications, and immediate liquidity snapshots, rather than relying on ad hoc improvisation during the chaotic hour following a breach.
Radiant’s documentation illustrates how the project’s defensive response tightened over time. However, the financial costs of that steep learning curve were severe because the attacker retained the initiative from the outset. The current flows observed moving through Tornado Cash represent the long tail of that exact distribution.
The operator continues moving assets because the underlying blockchain rails continue to function without interruption. The appropriate response across the industry remains hardened keyholder procedures, narrower and more scrutinized administrative approvals, real-time bridge monitoring, and an organizational culture that treats signer devices with the utmost security.
The Radiant exploiter is likely to continue employing this exact playbook until external market and regulatory conditions shift. Additional Tornado deposits will inevitably arrive in familiar denominations, and further bridge activity will likely appear from addresses linked to the original October 2024 pathways. Eventually, a clean exit will ping a regulated trading venue, where compliance desks will carefully weigh historical timing and behavioral heuristics against user narratives.
The broader consequence for the cryptocurrency market remains predictable. Every patient, calculated exit of this nature chips away at user confidence in cross-chain abstractions and forces development teams to audit not just their smart contract code, but their operational security as well. Users continually chase yield across disparate blockchain networks because the user experience feels seamless, yet skilled threat actors know precisely where those infrastructural seams are hidden.
