An unnamed institution reportedly lost about USD 2.84 million on BNB Smart Chain on October 8, with North Korea-linked SquidSquad suspected of carrying out the theft. Blockchain investigator ZachXBT disclosed the case on October 21 after tracking funds through Ethereum, Tron and intermediary wallets.
In his Telegram report, ZachXBT said an institutional entity was suspected of losing approximately USD 2.84 million to North Korea-linked SquidSquad. He identified the affected wallet as 0x579be84d2a0f7bcfc34b4b3883153adec84ff153 and the suspected theft address as 0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80.
The investigator did not identify the institution or explain how the attackers gained access to its assets. He also did not report a confirmed recovery or name any person involved. His account included no statement from the unnamed institution and did not identify the security systems involved in the breach. The claim about SquidSquad rests on his analysis of blockchain transactions and links to addresses associated with North Korean operators.
On October 20, the attacker deposited 1,111.2 ETH into Tornado Cash, according to ZachXBT. The funds were then withdrawn to three Ethereum wallets. Tornado Cash allows users to move cryptocurrency through a privacy service that makes tracing transfers between wallet addresses more difficult. The investigator published the three withdrawal addresses, making those transfers identifiable in Ethereum transaction records.
The funds subsequently moved from Ethereum to Tron through USDT0, a version of Tether’s stablecoin used across supported blockchain networks. ZachXBT listed three receiving Ethereum addresses and traced their later movements into two Tron wallets.
The sequence took place nearly two weeks after the reported BNB Chain theft. Although the transactions offer a trail of where the assets moved, they do not establish who controlled each wallet or how the original institution was compromised.
The investigator identified the two Tron destination addresses as TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuaqXPaUbU5f5yi3Voux. He said both had financial exposure to addresses previously attributed to North Korean actors.
Within minutes, the funds passed through additional wallets before reaching Chinese over-the-counter cryptocurrency dealers, according to his findings. Such dealers arrange cryptocurrency trades directly between buyers and sellers rather than through public exchange order books.
ZachXBT suggested the fast transfers were likely intended to avoid a possible freeze by Tether. However, he did not establish whether the funds were exchanged for cash or whether Tether had frozen any assets connected to this case. The dealers involved were not publicly named. His account also did not say whether the recipient wallets still held any of the transferred stablecoins.
A May 2026 report from cybersecurity firm CertiK identified SquidSquad among North Korea-linked groups targeting people in the cryptocurrency industry. Its research described attackers posing as investors, venture capitalists or business partners to approach founders, executives and wealthy cryptocurrency holders.
CertiK linked the group to malicious files delivered through contact on Telegram and LinkedIn. The report named RustBucket, SwiftBucket and NimDoor among malware associated with the group and identified Tornado Cash as one of its laundering channels. It also described fake investment documents and meeting agendas used to approach victims. Some impersonations lasted weeks, CertiK reported.
CertiK estimated that North Korea-linked hackers stole USD 6.75 billion across 263 crypto incidents from 2016 to early 2026. Its research assigned USD 2.06 billion in losses to 79 North Korean-linked attacks during 2025. The report was published in May, before the October 8 theft described by ZachXBT.
ALSO READ: Crypto Prices Today: Bitcoin Holds Near USD 82,585 as Zcash Leads Top 12 Gains