An institutional cryptocurrency holder reportedly lost approximately $2.84 million in a suspected October 8 attack on BNB Chain. Blockchain investigator ZachXBT links the proceeds to North Korea-linked group SquidSquad, but the finding remains an on-chain attribution, and the victim has not been named.
Blockchain investigator ZachXBT disclosed the suspected theft on October 21, placing the incident on October 8 on BNB Smart Chain. He detailed a series of transactions that allegedly moved the proceeds through several wallets before they reached Chinese over-the-counter cryptocurrency dealers.
Stolen funds move through Tornado Cash
According to the investigator, the latest activity took place on October 20, when the attacker deposited 1,111.2 ETH into Tornado Cash and withdrew the funds to three separate Ethereum addresses. From those wallets, the assets moved from Ethereum to Tron using USDT0, a version of Tether's dollar-pegged stablecoin designed for transfers across supported blockchain networks.
The transfers eventually brought the funds together in two Tron addresses. Both wallets reportedly had transaction exposure to addresses previously associated with North Korean cryptocurrency operations. However, ZachXBT did not identify the specific earlier incidents tied to those addresses in the supplied findings.
Within minutes of the consolidation, the funds passed through intermediary wallets and reached addresses attributed to Chinese OTC dealers. The investigator suspected the rapid transfers were meant to avoid a potential freeze by Tether. The public findings did not establish whether the operators converted the proceeds into fiat currency or whether any portion was frozen.
Other DPRK-linked cases also touched Tornado Cash
The case follows an October 5 investigation in which ZachXBT said he had infiltrated a suspected laundering network connected to North Korea's Lazarus Group. Separately, on October 20, wallets associated with the Drift Protocol exploit transferred approximately 25,700 ETH, valued at $61.56 million, into the privacy protocol. Investigators have not established that the Drift and SquidSquad transactions involved the same operators or were coordinated.
How SquidSquad is suspected to operate
A 2026 DPRK cryptocurrency threat assessment found that SquidSquad was associated with campaigns targeting cryptocurrency founders, executives and wealthy investors. According to the report, the group commonly impersonates venture capitalists, investors and business contacts before attempting to distribute malicious documents or software through messaging platforms such as Telegram and LinkedIn.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
