A suspected North Korea-linked SquidSquad operation may be behind a roughly $2.84 million theft from an institutional cryptocurrency holder on BNB Chain, according to blockchain investigator ZachXBT. The reported attack took place on Oct. 8, while public tracing later focused on how the funds were moved after the theft.
The victim has not been identified, and the exact method used to compromise the holder has not been disclosed. What has been outlined so far is the route the funds allegedly took across multiple networks after the initial loss.
Post-theft movements traced across chains
ZachXBT said the attacker deposited 1,111.2 ETH into Tornado Cash on Oct. 20. After that, the funds were withdrawn to three Ethereum addresses, then transferred onward to the Tron network using USDT.
The reported laundering path ended in two Tron wallets. Those addresses were found to have exposure to wallets previously linked to North Korean operators, which is one of the key reasons the activity has been tied, at least tentatively, to SquidSquad.
Attribution remains limited
Despite the wallet links, the available information does not publicly confirm the original operators behind the attack or establish the entire chain of custody for the stolen assets. The connection is based on transaction analysis rather than a formal public identification of the attackers.
That leaves several important details unresolved, including who exactly controlled the funds at each stage and whether the actors tied to the destination wallets were the same ones responsible for the original BNB Chain exploit.
China OTC links but no confirmed cash-out outcome
The investigation also reportedly connected the transfers to over-the-counter destinations in China. However, it did not determine whether any of the assets were ultimately converted into fiat currency or frozen before that could happen.
As a result, the final status of the stolen funds remains unclear. Public reporting so far has described the route the crypto took, but not the outcome after it reached those OTC-linked destinations.
Broader DPRK laundering pattern under scrutiny
The case is being examined in the wider context of North Korean-linked laundering networks and earlier DPRK-associated crypto exploits. The source article pointed to prior incidents involving Bybit, Drift Protocol, Radiant Capital, and other campaigns in which Tornado Cash was used to move stolen funds.
For now, the confirmed next step is continued investigation. Until more evidence is disclosed, the identity of the institutional victim, the initial attack method, and the ultimate disposition of the assets all remain unconfirmed.
Source: crypto.news