Attackers used lending vaults to deposit crypto assets from one address and withdraw to others without direct wallet transfers, alongside Thorchain cross-chain swaps.