Alleged Cryptocurrency Theft by SquidSquad
A cryptocurrency institution is believed to have suffered a theft totalling around $2.84 million, allegedly orchestrated by the hacking group SquidSquad, which has ties to North Korea. Blockchain analyst ZachXBT reported on October 21 that the incident occurred on October 8 on the BNB Smart Chain and involved a cluster of transactions that appear to have facilitated the movement of stolen assets through multiple wallets before ultimately reaching over-the-counter (OTC) cryptocurrency traders in China.
Details of the Incident
The latest observed actions took place on October 20, when the hacker funneled 1,111.2 ETH into Tornado Cash, a platform known for anonymizing blockchain transactions, and later withdrew it to three distinct Ethereum addresses. Analysis has revealed links between these wallets and previous addresses believed to belong to North Korean entities. Despite this connection being established, the exact identity of the affected organization remains under wraps, as this attribution is based purely on blockchain data.
In the aftermath of the alleged theft, the hacker maintained possession of the proceeds until the aforementioned transaction movements, which included converting assets to Ethereum before being routed through Tornado Cash for further obscurity. ZachXBT’s examination pinpointed three Ethereum addresses that were linked to funds taken from Tornado Cash. From there, the assets were shifted to the Tron blockchain using USDT, Tether’s variant pegged to the US dollar designed for cross-chain transfers.
Movement of Stolen Funds
Eventually, the consolidated funds appeared in two Tron wallets, designated as TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuaqXPaUbU5f5yi3Voux. Both of these accounts have histories of transactions connecting back to North Korean cryptocurrency operations, although ZachXBT’s investigation did not specify the exact prior incidents linked to these wallets.
The rapid movement of funds suggests the intention to sidestep potential freezing actions by Tether, which is capable of limiting USDT held in certain wallet addresses. While this investigation has tracked the path of the stolen funds to OTC destinations, it’s unclear whether the perpetrators converted any part of the stolen assets into fiat currency or if they experienced any freezes on their funds thereafter.
Previous Investigations and Patterns
This case follows an earlier investigation on October 5, where ZachXBT claimed to have infiltrated a suspected network for laundering cryptocurrencies associated with North Korea’s Lazarus Group. Previously reported incidents included a major theft from the Bybit exchange, amounting to $1.5 billion in 2025, where ZachXBT alleged he traced over $12 million across various blockchains and identified a significant Chinese operation involved in numerous crypto exploitations.
Similar patterns of fund movements through Tornado Cash have been noted in other cryptocurrency theft cases, such as the Drift Protocol exploit where approximately 25,700 ETH, valued at over $61 million, was funneled through the privacy protocol after a brief period of inactivity. This exploit resulted in losses of about $285 million linked to North Korea’s UNC6862, further solidifying the ongoing threats posed by North Korean cybercriminals to the cryptocurrency sector.
Furthermore, the attackers in the 2024 Radiant Capital breach, which involved around $50 million, were reported to have utilized Tornado Cash as well. The attackers compromised contract permissions, with the incident also being tied back to North Korean operatives.
Ongoing Threats and Tactics
Research has illuminated SquidSquad’s ongoing campaigns targeting cryptocurrency stakeholders, employing tactics such as impersonating venture capitalists and executives to distribute malicious software through platforms like Telegram and LinkedIn. Their activities have been linked to diverse malware types, including RustBucket and SwiftBucket, while using services like Tornado Cash to obscure the origins of stolen assets. Cybersecurity experts have underscored the risks that similar methodologies pose, as seen in operations performed by the Lazarus Group, which has targeted leaders in the cryptocurrency industry using deceptive practices and malware.
