An institutional cryptocurrency holder has reportedly lost approximately $2.84 million in a suspected attack by North Korea-linked hacking group SquidSquad.
Summary
- An institutional cryptocurrency holder reportedly lost approximately $2.84 million in an October 8 attack on BNB Chain.
- On October 20, the attacker reportedly deposited 1,111.2 ETH into Tornado Cash before withdrawing the funds to three Ethereum addresses and subsequently transferring them to Tron through USDT0.
- ZachXBT identified two Tron wallets that received the funds and had exposure to previously attributed North Korean addresses.
- The identity of the affected institution and the method used to compromise its assets remain undisclosed.
Blockchain investigator ZachXBT disclosed the suspected theft on October 21, identifying October 8 as the date of the incident on BNB Smart Chain and detailing a series of transactions that allegedly moved the proceeds through several wallets before they reached Chinese over-the-counter cryptocurrency dealers.
According to the investigator, the latest activity took place on October 20, when the attacker deposited 1,111.2 ETH into Tornado Cash and subsequently withdrew the funds to three separate Ethereum addresses.
The investigation identified financial connections between the wallets used in the transfers and addresses previously attributed to North Korean operators. However, the findings remain an on-chain attribution, and the identity of the affected institution has not been publicly disclosed.
SquidSquad stolen funds move through Tornado Cash
Following the suspected October 8 theft, the attacker appears to have retained control of the proceeds until the latest movement, which involved converting or transferring the assets into Ethereum before sending them through the privacy protocol.
ZachXBT’s transaction analysis identified three addresses that received funds withdrawn from Tornado Cash. From those wallets, the assets were transferred from Ethereum to Tron using USDT0, a version of Tether’s dollar-pegged stablecoin designed for transfers across supported blockchain networks.
The transfers eventually brought the funds together in two Tron addresses, identified by the investigator as TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuaqXPaUbU5f5yi3Voux.
Both wallets reportedly had transaction exposure to addresses previously associated with North Korean cryptocurrency operations. ZachXBT did not identify the specific earlier incidents connected to those addresses in the supplied findings.
Within minutes of the consolidation, the funds passed through intermediary wallets before reaching addresses attributed to Chinese OTC dealers.
The investigator suspected that the rapid transfers were intended to avoid a potential freeze by Tether, which can restrict USDT held in addresses on supported blockchains.
Although the investigation traced the reported movements to OTC destinations, the public findings did not establish whether the operators had completed a conversion into fiat currency or whether any portion of the stolen assets had subsequently been frozen.
North Korean laundering networks have remained under scrutiny
The latest case follows an October 5 investigation in which ZachXBT said he had infiltrated a suspected cryptocurrency laundering network connected to North Korea’s Lazarus Group.
As crypto.news previously reported, the investigator said he spent $349,700 posing as a customer to trace transactions associated with the $1.5 billion Bybit theft in 2025.
His findings identified an alleged Chinese operation that had processed more than $1 billion across multiple cryptocurrency exploits, although the claimed size of the network was not independently confirmed by publicly available U.S. enforcement records.
During that investigation, ZachXBT said he identified more than $12 million in Bybit-linked funds moving across different blockchains. Tether subsequently froze 442,000 USDT associated with wallets uncovered during the operation, according to his account.
The investigator has not established a publicly documented connection between the operators identified in that investigation and the OTC dealers involved in the latest SquidSquad transaction trail.
Tornado Cash transfers follow other suspected DPRK-linked attacks
Separate cryptocurrency theft investigations have documented similar movements through Tornado Cash, including transactions involving assets stolen from Drift Protocol earlier this year.
On October 20, wallets associated with the Drift Protocol exploit transferred approximately 25,700 ETH, valued at $61.56 million, into the privacy protocol after a period of limited activity.
Drift suffered losses estimated at $285 million in April, with a subsequent forensic investigation by cybersecurity firm Mandiant attributing the attack to UNC6862, a North Korean threat group.
The Drift transfers were reported on the same day as the movements identified in the SquidSquad case, although investigators have not established that the two transactions involved the same operators or were coordinated.
A separate investigation into the 2024 Radiant Capital attack documented the use of Tornado Cash after attackers stole approximately $50 million from the lending protocol.
According to Radiant Capital’s subsequent disclosures, the attackers compromised signing permissions and replaced a lending pool implementation contract. Cybersecurity investigators later connected the incident to North Korean operators.
By October 2025, blockchain security firm CertiK had identified 2,834 ETH deposited into Tornado Cash from wallets associated with the attack, with approximately $10.8 million believed to have passed through the mixer.
Radiant announced in June 2026 that it would wind down operations after failing to recover from the theft and secure sufficient funding to continue development.
SquidSquad suspected to be using impersonation and malware
A 2026 DPRK cryptocurrency threat assessment found that SquidSquad was associated with campaigns targeting cryptocurrency founders, executives and wealthy investors.
According to the report, the group commonly impersonates venture capitalists, investors and business contacts before attempting to distribute malicious documents or software through messaging platforms such as Telegram and LinkedIn.
Researchers linked the group to malware families including RustBucket, SwiftBucket and NimDoor, while identifying Tornado Cash among the services used to move stolen funds.
Similar methods have appeared in other North Korean hacking campaigns, with Lazarus Group targeting cryptocurrency executives through fake meeting invitations and malicious macOS software, according to an April investigation by cybersecurity firm CertiK.