According to @zachxbt, a threat actor bridged funds from Bitcoin (BTC) to Ethereum (ETH), Litecoin (LTC), and Ripple (XRP) via THORChain, with the swaps identifiable by OP_Return memos shown in the attached screenshots, source: @zachxbt. He states the main counterparty taking the other side of these THORChain swaps uses Binance for arbitrage, source: @zachxbt. He identifies bc1qgkjems88jyk8hasj9ncspxz093nepdn00vaq0y as the THORChain user (threat actor) and labels bc1q30drw0j0erj804lyvl8pxrj789kaplpu2dryx9 and bc1q5yn5hpduzgcpskxjk49dyaczjsgwg5zvwsnahc as Asgard vault addresses, source: @zachxbt. He notes these transactions can be verified via THORChain block explorer evidence using OP_Return memos that mark THORChain swaps, source: @zachxbt. He adds that while Arkham is a useful free analytics tool, it does not attribute cross-chain swaps or UTXO flows well, cautioning analysts on cross-chain attribution, source: @zachxbt. For traders, the identification of a Binance arbitrage counterparty and specific Asgard vault addresses enables targeted monitoring of RUNE liquidity and cross-chain flows between BTC, ETH, LTC, and XRP on THORChain, source: @zachxbt.