ZachXBT Reports Suspected $2.84 Million BSC Loss Linked to North Korea-Connected SquidSquad
An institution is suspected of losing $2.84 million in an attack involving the BNB Smart Chain (BSC), with funds allegedly linked to North Korea-connected hacking group SquidSquad, according to blockchain investigator ZachXBT. The reported incident involves the movement of 1,111.2 ETH through Tornado Cash and multiple intermediary addresses, raising concerns about efforts to obscure the trail of potentially stolen cryptocurrency.
Coin Bureau highlighted the reported findings, citing ZachXBT's investigation into the incident. The suspected loss follows an attack on October 8, while subsequent on-chain movements indicate that the funds were transferred through a cryptocurrency mixing service before being distributed to three addresses.
Ethereum Transfers Follow October 8 Attack
According to ZachXBT, the hacker deposited 1,111.2 ETH into Tornado Cash on October 20, 12 days after the reported attack. The funds were subsequently withdrawn to three separate addresses, adding several steps to the transaction trail.
Tornado Cash is a cryptocurrency mixing protocol designed to make it more difficult to associate incoming deposits with specific withdrawals. Its use can complicate blockchain tracing by obscuring direct links between transactions, although investigators can still examine subsequent transfers and address relationships for potential clues.
In this case, the reported movements did not end with the withdrawals. The funds subsequently passed through intermediary addresses before reaching Chinese over-the-counter (OTC) trading desks within minutes, according to ZachXBT.
Investigators Flag Possible Tether Freeze Risk
The speed of the transfers and the route through intermediaries are significant details in the reported investigation. ZachXBT suggested that the movement toward Chinese OTC desks was likely intended to evade a potential freeze by Tether, the issuer of the USDT stablecoin.
A freeze could prevent affected assets from being transferred when an issuer uses its authority over supported tokens to restrict specific addresses. However, the reported intention to avoid such action remains an assessment attributed to ZachXBT rather than a confirmed explanation from the suspected attacker.
The information provided does not establish that Tether initiated a freeze or that the company confirmed any action related to the incident. It also does not identify the institution suspected of suffering the $2.84 million loss.
Address Connections Raise North Korea Attribution Concerns
ZachXBT also reported that both consolidation addresses involved in the transaction trail had exposure to addresses previously identified as being linked to the Democratic People's Republic of Korea (DPRK), the official name of North Korea.
Those connections form part of the basis for the suspected North Korea link involving SquidSquad. Exposure to previously identified addresses can provide investigators with a lead when assessing cryptocurrency flows, but it does not independently establish who controlled the wallets or conclusively prove responsibility for an attack.
The reported case therefore combines several elements: a suspected $2.84 million institutional loss on BSC, an October 8 attack, a transfer of 1,111.2 ETH into Tornado Cash on October 20, withdrawals to three addresses, rapid movement through intermediaries to Chinese OTC desks, and links between two consolidation addresses and previously identified DPRK-connected wallets. These details are attributed to ZachXBT's investigation, as highlighted by Coin Bureau.
Writer: Victoria HaleTechnology & Blockchain WriterVictoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.She prioritises clarity and accuracy when explaining technical developments to a general audience.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.