On-chain investigator ZachXBT has linked a suspected $2.84 million theft from an unidentified institutional cryptocurrency holder to a group he calls North Korea-associated SquidSquad, tracing a later series of transfers through Tornado Cash, Ethereum-to-Tron bridging and addresses attributed to Chinese over-the-counter cryptocurrency dealers.
The suspected theft took place on October 8, 2026, on BNB Smart Chain, according to the investigator. The newly documented fund movements occurred on October 20, when 1,111.2 ether reportedly entered Tornado Cash before an alleged withdrawal sequence involving three Ethereum wallets and two subsequent Tron consolidation addresses. The findings were disclosed publicly on October 21.
The distinction between those dates is essential. This is a new tracing development following an earlier suspected theft, not evidence that the institution was hacked again on October 20. The victim has not been publicly named, the original compromise method remains unknown, and the identity of the people controlling the tracked wallets has not been independently established.
What Does ZachXBT’s $2.84 Million Investigation Actually Establish?
The investigator’s report, shared through his Investigations by ZachXBT channel, identifies the purported victim’s BNB Smart Chain address as 0x579be84d2a0f7bcfc34b4b3883153adec84ff153 and an initial theft-linked address as 0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80. Those addresses provide starting points for reviewing the public transaction history, but a transfer record alone does not identify an individual attacker.
ZachXBT estimates that roughly $2.84 million was taken on October 8. His diagram then follows assets from BNB Smart Chain across intermediate wallets into the Ethereum ecosystem. It does not disclose the name of the institution, a verified incident statement by that institution, or forensic evidence demonstrating the precise means of initial access.
It would therefore be premature to describe the incident as a newly confirmed protocol exploit, a compromise of BNB Smart Chain itself or a known smart-contract vulnerability. The suspected loss could have arisen from multiple categories of compromise, but none should be assigned without evidence.
The label SquidSquad is the investigator’s threat-actor attribution. He associates the activity with North Korean-linked operations, but that conclusion should not be confused with an independently established identity of the wallet controller or a formal law-enforcement attribution for this specific October 8 case.
How Did 1,111.2 ETH Move Through Tornado Cash?
ZachXBT says the October 20 activity involved deposits totaling 1,111.2 ETH into Tornado Cash. The privacy protocol allows users to deposit assets and later withdraw them using mechanisms designed to reduce the publicly observable connection between the source and the recipient.
He attributes subsequent withdrawals to three Ethereum addresses: 0xb8b25f535a6e51d0b18c48941d791c7e83559d2b, 0x35c72e26f6888b4cba8668c6cfa4143599680bfe and 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848.
This is an investigator-reconstructed link. Tornado Cash is designed to make direct deposit-to-withdrawal matching difficult, so a diagram joining the two sides may depend on transaction timing, amounts, additional address relationships and other information. A reader should not treat the diagram’s connection as proof that the protocol itself publicly revealed every matched withdrawal.
Nor is the 1,111.2 ETH an additional $2.84 million loss on top of the October 8 theft. The first figure is the asset quantity associated with a later stage of the fund flows; the second is the dollar valuation of the suspected original theft. Combining them as two separate theft totals would double-count at least some of the activity being investigated.
Similar tracing limitations apply to the Drift exploit-linked wallets that reportedly sent 25,700 ETH into Tornado Cash a day earlier. The two incidents are separate, and there is no established evidence that they were coordinated by the same people.
Why Did the Traced Funds Move From Ethereum to Tron?
According to the investigator’s flow chart, assets associated with the three withdrawal addresses moved from Ethereum to Tron using USDT0, a cross-chain version of the dollar-pegged stablecoin infrastructure. The trace then identifies two Tron addresses where the assets allegedly converged: TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux.
ZachXBT says both consolidation wallets had financial exposure to addresses previously linked by investigators to North Korean operations. A financial connection might be relevant corroboration, but it is not the same as proving common ownership, a shared private key or direct control by a named government organization.
The cross-chain stage also changes which intermediaries can see or restrict assets. Ether deposited into an Ethereum privacy protocol and dollar-denominated stablecoins transferred on Tron have different tracing characteristics. A bridge can create a visible link between transactions on two networks even after other steps have complicated the initial attribution.
The chart includes additional transfers involving clusters labeled by the researcher as DPRK-related and Chinese OTC-related. Those labels are analytical attributions, not a judicial determination that every address in a cluster knowingly handled criminal proceeds.
The ability to follow a movement across chains has implications for potential asset recovery, but it cannot establish that the original institution has regained control or that any intermediary has agreed to return assets. Public transaction visibility and legal control over funds are separate questions.
Were Chinese OTC Desks Used to Avoid a Tether Freeze?
ZachXBT says that within minutes of the funds reaching the identified Tron consolidation wallets, they moved through intermediary addresses toward clusters he describes as Chinese over-the-counter dealers. He suggests that the speed and routing could reflect an effort to avoid a potential USDT freeze by Tether.
That is a theory about motive, not a verified account of what the wallet operator intended. The available public evidence does not identify the individual broker, show a completed conversion into fiat currency or establish that a particular dealer knew the source of the funds.
Over-the-counter trading involves arranging asset transactions directly or through intermediaries rather than relying exclusively on a public exchange order book. Investigators often focus on such destinations because the service provider may hold records relevant to determining who ultimately received an asset. But a wallet attributed to an OTC service is not proof that every incoming transfer was accepted, completed or paid out in cash.
Tether has technical capabilities to restrict USDT at addresses on supported blockchains. That potential makes the timing of a transfer relevant to an investigation, but it does not establish that Tether had issued or planned a freeze against these particular wallets. No confirmed freeze, avoided freeze or completed cash-out was established in the material released alongside the chart.
More generally, research into billions of dollars in stablecoin freezes highlights the distinction between an issuer’s ability to restrict token balances and the more complicated process of identifying the right assets and actors before they move again.
What Does the SquidSquad Attribution Mean for Crypto Security?
North Korean-linked groups have been associated with a range of cryptocurrency theft and social-engineering campaigns. In this case, however, the disclosed evidence concerns a particular transaction graph and links to previously attributed wallet clusters. It does not disclose a verified phishing message, compromised device, malicious contract or stolen signing credential from the victim institution.
For security teams, that uncertainty should prevent assumptions about the entry point. Safeguards for institutional digital assets may include controls around transaction approval, key custody, staff identity verification, device security and monitoring of unusual withdrawals. Which of those would have prevented this suspected incident cannot be determined without a reconstruction of the October 8 loss.
The wider relevance is that movements after a theft can reveal more about financial infrastructure used by suspected operators even when the original exploit mechanism remains unknown. A separate ZachXBT investigation into a suspected large-scale DPRK-linked laundering network similarly emphasized intermediaries and money movement, but should not be assumed to involve this particular victim or the same wallets.
Institutions should also distinguish chain-level safety from account-level loss. The fact that the reported stolen funds originated on BNB Smart Chain does not establish a vulnerability in that blockchain’s consensus or a broader failure affecting other BNB Chain users.
Which Questions Remain Unanswered?
The most consequential open issue is the identity and circumstances of the alleged victim. An independent account from the institution, forensic findings and the precise October 8 transaction records would help confirm the theft amount, the method of compromise and whether any insurance or recovery process is underway.
Investigators would also need to substantiate the attribution of the three post-mixer Ethereum wallets, the historical links used to label the two Tron addresses as DPRK-associated and the actual nature of the ultimate OTC counterparties. A diagram is a valuable investigative map, but its most sensitive ownership and intent claims require evidence beyond the arrows.
Finally, the status of the funds after reaching the alleged OTC destinations remains unknown. The public account does not confirm that the operators received fiat currency, that Tether froze any of the proceeds or that stolen assets have been recovered.
The confirmed new disclosure on October 21 is ZachXBT’s tracing of a suspected October 8 institutional theft through 1,111.2 ETH in Tornado Cash deposits on October 20 and onward movements toward Tron and OTC-associated wallets. It offers a detailed lead on how suspected stolen cryptocurrency was moved, while leaving the original breach, human attribution and ultimate financial outcome unresolved.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574