The hacker behind the BlueMove exploit bridged 115,000 USDC from Ethereum to Hyperliquid and purchased 188.25 XMR at $608.43 per coin, according to PeckShieldAlert tracking data. The Monero acquisition suggests continued efforts to obscure stolen funds through privacy-focused assets. BlueMove, an AMM decentralized exchange operating on Sui and Aptos, was exploited on July 11, 2026. The attacker drained 710,670 SUI from 389 locked liquidity pools, worth approximately $529,000 at the time of the breach.