BlueMove Hacker-Tagged Wallet Bridges 115,000 USDC, Buys 188.25 XMR

The transfer, the purchase and the older exploit

The latest report contains two separate actions. First, the tagged address reportedly moved 115,000 USDC from Ethereum to Hyperliquid. Second, it reportedly bought 188.25 XMR at $608.43. Keeping the actions separate matters: a transfer amount and a purchase quantity answer different questions. The reports do not say that the full incoming amount was spent, and the quoted figures should not be rewritten as an exact account statement.

PANews also supplies the historical connection. It says BlueMove, an AMM decentralized exchange on Sui and Aptos, was exploited on July 11, 2026. The account describes 710,670 SUI taken from 389 locked liquidity pools, worth approximately $529,000 at the time described by the report. Those are reported historical losses, rather than a new November loss calculation. Odaily repeats that history alongside its November update.

The event therefore has two dates with different meanings. July 11 is the date given for the underlying exploit. November 3 is the date of the new reporting about the tagged address. Describing the whole story as “BlueMove hacked today” would merge those dates and give readers the wrong incident timeline. The new fact is the reported movement and XMR purchase associated with the tagged address.

The figures in this table come from the PANews and Odaily reports linked above. The table does not identify an independently checked transaction hash or confirm the current status of any position.

What the arithmetic can establish

Multiplying the reported XMR quantity by the reported price gives 188.25 × $608.43 = $114,536.9475, or about $114,537. Compared with the reported 115,000 USDC transfer, the numerical difference is approximately $463.05 if one uses one dollar per USDC for this comparison. That assumption is a calculation convention here; the reports do not supply a contemporaneous USDC conversion price or an execution statement.

This arithmetic checks whether the reported purchase and transfer are broadly similar in size. It cannot establish what happened to the difference. Neither report itemizes trading costs, bridge costs, residual cash or additional transactions. Calling the difference a fee would invent an explanation. Calling it the wallet’s remaining balance would invent an account snapshot.

The same restraint applies to the quoted purchase price. A price of $608.43 describes the reported trade. It is not a current XMR quote, an average price available to other users or evidence that another order could receive that execution. The news reports do not include the order book, trade identifier or a separate time series against which to compare it.

The historical dollar amount also belongs to a different calculation. Dividing the new transfer by the earlier reported dollar loss would compare different assets and different moments. It would not establish a recovered percentage, the amount still controlled by the attacker or the total proceeds from the exploit. Such a calculation needs a complete fund-flow record and consistent valuation dates, which these short reports do not contain.

Why the address label matters

SponsoredHyperliquid

Partner rebate share30%Up to

Check regional eligibility and account terms

✓Code applied automatically by the sign-up link: NEXU888

Sign up on Hyperliquid →CodeNEXU888Copied

PANews uses the wording “address tagged as the BlueMove hacker” and attributes the observation to PeckShieldAlert. That is the evidence chain available in the article: a named monitoring account’s observation, carried by a news outlet. Odaily carries the same transfer amount, purchase quantity and price. Readers should retain the attribution when describing the story to someone else.

Matching figures across news sites can help identify transcription differences. They do not, by themselves, show that separate investigators examined the underlying transfers. Because the PANews item names PeckShieldAlert, this article treats the monitoring observation as the common factual lead and does not present the outlet count as independently repeated on-chain verification.

A wallet label also differs from a verified identity. The reports describe the address through its alleged connection to BlueMove’s exploit. They do not name a person operating it, demonstrate who controlled it when the purchase occurred or publish an investigation finding about the operator. The reported tag supports following the address as an incident lead; it does not support adding an identity or motive.

For someone tracking a loss, the next useful evidence would be the relevant address, transaction identifiers and an explanation of how the new transaction connects to the earlier incident. Those details would let a reader compare the source and destination records rather than relying on a label alone. The opened news items do not reproduce that full chain, so we do not claim to have reconstructed it.

Hyperliquid is the reported destination

The transfer destination in this story is Hyperliquid. The exploit in the historical account concerns BlueMove. The source material does not report a Hyperliquid breach, a loss from ordinary Hyperliquid user accounts or a current interruption to its services. Conflating a destination used by a tagged wallet with the platform that suffered the original exploit would misstate the report.

The wording “bought XMR” also leaves an important product question open. The readable items do not identify a contract, a market specification or a withdrawal record for the reported purchase. This article therefore does not classify the transaction as a spot purchase, a perpetual position or a purchase of withdrawable native XMR. A ticker and a quantity alone cannot settle that distinction.

That missing detail matters to a trader deciding whether the story applies to an instrument already in their account. Compare the exact contract or asset name on your own position with the instrument identified in any later transaction evidence. Do not treat the headline ticker as proof that every product carrying the same letters has the same ownership or settlement terms.

Our funding-rates board and liquidations page are separate reader tools. This article has not used their current numbers to claim a market response to the transfer. A transfer report cannot establish that XMR funding changed, that a liquidation occurred or that the trade moved the wider price without additional observations tying those events together.

What an affected user should check

If you are reviewing exposure connected to the older BlueMove incident, begin with your own records. Identify the pool or transaction you used and preserve its transaction identifier, network and timestamp. Compare those records with an incident update that actually names the affected contracts. The historical count of 389 pools is too broad to establish the status of an individual user’s position.

For a pending transfer, keep the source record and the destination credit separate:

1. Check your source transaction hash, amount, receiving address and timestamp against your own transfer record. Save that record before making changes.
2. Review whether the destination account has credited that transaction. If it has not, record the exact stage needing investigation before deciding whether to send again. A pending credit alone is not a reason to repeat the transfer.

These checks organize a transfer inquiry. The reports do not establish that Hyperliquid or any bridge currently has a service problem.

If a message offers to recover funds from the BlueMove incident, ask for evidence that links the proposed process to the incident’s documented response. A news story about a tagged address buying XMR supplies no recovery authorization. Do not use it as a reason to approve an unfamiliar transaction, reveal a wallet recovery phrase or send funds to an address provided in an unsolicited message.

For XMR traders, the narrower task is to avoid converting a forensic lead into a trading signal. The news identifies one reported address and one reported action. It gives no evidence of the operator’s forecast, broader holdings or reason for choosing the trade. An incident-linked purchase cannot establish that other traders face a favorable entry price.

The evidence that would change this account

A transaction record could establish the movement’s exact time and addresses. A market fill or position record could clarify the product involved and whether $608.43 was a single execution price or a rounded description. A subsequent account snapshot could show whether the reported exposure remained open. These are different records, and one should not stand in for another.

An official incident update could also change the meaning of the transfer. For example, a documented freeze or recovery would answer a different question from an observed purchase. The two opened reports do not announce a recovery, freeze or return of these funds. We therefore do not describe the movement as a successful recovery or a completed disposal of all exploit proceeds.

The immediate news is a reported use of funds linked by a monitoring label to BlueMove’s earlier exploit. The reader-facing questions remain specific: which transaction carried the 115,000 USDC, which product represented the 188.25 XMR purchase, and what later records show about those funds. Those records would support a substantive follow-up.

Quick answers

Did Hyperliquid suffer the BlueMove exploit?

The reports place the older exploit at BlueMove and identify Hyperliquid as the destination of the newly reported transfer. They do not establish a new Hyperliquid security incident.

Was all 115,000 USDC spent on XMR?

That is not established. The quoted quantity multiplied by the quoted price gives about $114,537. The difference does not identify fees, a remaining balance or another purchase.

Is $608.43 the current XMR price?

It is the price reported for the described purchase. The opened reports do not provide a current executable quote or prove the type of instrument traded.

Does this mean the BlueMove losses were recovered?

The two reports describe a tagged address’s activity. Neither supplies a recovery announcement or evidence of returned funds.