ZachXBT links $2.84M BNB Chain theft to wallets tied to North Korea as stolen ETH is laundered through Tornado Cash

Blockchain investigator ZachXBT has traced a suspected $2.84 million theft from an institutional holder on BNB Smart Chain to wallets with exposure to North Korea-linked operators, after the attacker moved 1,111.2 ETH through Tornado Cash and across to Tron. The victim, the attack method and the perpetrators have not been independently confirmed.

SquidSquad investigation tracks funds through Tornado Cash

The suspected theft reportedly occurred on October 8, but a significant movement of funds emerged on October 20. According to ZachXBT’s transaction analysis, the attacker deposited 1,111.2 ETH into Tornado Cash, a cryptocurrency privacy protocol that pools deposits and withdrawals to make individual transaction trails harder to follow.

The funds were subsequently withdrawn to three separate Ethereum addresses. Investigators then traced transfers from those wallets to the Tron blockchain through USDT0, a cross-chain transfer system supporting the movement of assets between compatible networks.

The transaction trail eventually converged on two Tron wallets: TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuaqXPaUbU5f5yi3Voux. ZachXBT reported that both addresses had transaction exposure to wallets previously attributed to North Korean cryptocurrency operators.

That exposure provides a potential investigative lead, but it does not by itself prove that North Korean actors controlled the receiving wallets or executed the original attack. On-chain analysis can establish transaction relationships; identifying the people or organizations behind those transactions requires additional evidence.

Within minutes of the funds being consolidated, they reportedly passed through intermediary wallets before reaching addresses linked by the investigator to Chinese OTC dealers.

ZachXBT suspected the rapid transfers could have been intended to reduce the risk of a freeze by Tether, the issuer of USDT, which can restrict tokens at designated addresses on supported networks. However, the publicly described findings did not establish whether the assets were ultimately converted into fiat currency or whether any funds were frozen.

Earlier North Korea-linked laundering cases raise concerns

The latest SquidSquad investigation follows a separate inquiry published by ZachXBT on October 5 into an alleged cryptocurrency laundering network connected to North Korea’s Lazarus Group.

In that investigation, the blockchain investigator said he spent $349,700 posing as a customer to trace transactions associated with the $1.5 billion Bybit hack in 2025. His findings pointed to an alleged Chinese laundering operation that had processed more than $1 billion linked to multiple cryptocurrency exploits, although the network’s full scale was not independently established through the public enforcement records cited in the report.

ZachXBT also said he identified more than $12 million in Bybit-linked funds moving across different blockchains. According to his account, Tether subsequently froze 442,000 USDT associated with wallets uncovered during the operation.

The earlier investigation highlights how blockchain tracing and cooperation with stablecoin issuers can disrupt the movement of suspicious assets. Nevertheless, no publicly documented evidence in the supplied findings establishes that the OTC dealers identified in that inquiry are connected to the latest SquidSquad transaction trail.

Tornado Cash activity draws attention after other crypto exploits

The reported transfers also emerged amid renewed attention to Tornado Cash following other major cryptocurrency thefts.

On October 20, wallets associated with the Drift Protocol exploit reportedly transferred approximately 25,700 ETH, valued at $61.56 million at the time, into the privacy protocol. Drift suffered losses estimated at $285 million in April 2026. A subsequent forensic investigation by cybersecurity firm Mandiant attributed the attack to UNC6862, a North Korean threat group.

The timing of the Drift transfers and the suspected BNB Chain laundering activity does not establish that the incidents share operators or were coordinated.

Another relevant case is the 2024 Radiant Capital attack, in which approximately $50 million was stolen after attackers compromised transaction-signing permissions and replaced a lending-pool implementation contract. Investigators later connected the incident to North Korean operators. By October 2025, blockchain security firm CertiK had identified 2,834 ETH deposited into Tornado Cash from wallets associated with the attack, with approximately $10.8 million believed to have passed through the service.

Radiant announced in June 2026 that it would wind down operations after struggling to recover from the theft and secure sufficient funding to continue development. The case illustrates how a major exploit can inflict lasting damage beyond the initial financial loss.

SquidSquad suspected of using impersonation and malware

A 2026 report on North Korean cryptocurrency threats associated SquidSquad with campaigns targeting cryptocurrency founders, executives and wealthy investors. According to the assessment, the group allegedly impersonates venture capitalists, investors and business contacts to establish trust before attempting to deliver malicious files or software.

Messaging platforms, including Telegram and LinkedIn, can serve as initial contact points in these schemes. Researchers have linked the group’s reported activities to malware families including RustBucket, SwiftBucket and NimDoor, while identifying Tornado Cash among the services used to move stolen assets.

These tactics reflect a broader security problem for cryptocurrency businesses: attackers may exploit human trust and compromised devices rather than relying exclusively on weaknesses in smart contracts. Fake meeting invitations, fraudulent investment approaches and malicious software can expose executives and employees with access to valuable digital assets.

In an April investigation, cybersecurity firm CertiK also described Lazarus Group campaigns targeting cryptocurrency executives with fake meeting invitations and malicious macOS software.

For now, the $2.84 million BNB Chain incident remains a suspected theft with an unresolved attribution. The latest SquidSquad allegations, the victim’s identity and the final disposition of the assets have not been conclusively established in the publicly described findings.

The case underscores the importance of wallet security, careful verification of business contacts and rapid coordination among blockchain investigators, exchanges and stablecoin issuers when suspicious transfers emerge.