An institutional cryptocurrency holder reportedly lost approximately $2.84 million in a suspected attack attributed to the North Korea-linked hacking group SquidSquad. Blockchain investigator ZachXBT disclosed the incident on October 21, 2026, identifying October 8 as the date of the theft on BNB Smart Chain. The identity of the affected institution and the precise method used to compromise the assets have not been disclosed.
On October 20, the attacker deposited 1,111.2 ETH into Tornado Cash, then withdrew the funds to three separate Ethereum addresses. The assets were subsequently bridged from Ethereum to Tron via USDT0 and consolidated into two Tron addresses. Both consolidation wallets showed transaction exposure to addresses previously attributed to North Korean operators. The funds then moved rapidly through intermediary addresses to Chinese over-the-counter desks, a step ZachXBT suggested may have been intended to reduce the risk of a potential Tether freeze.
The Drivers of the Current Situation
The main issue is the suspected theft of $2.84 million from an institutional holder on BNB Chain and the subsequent multi-chain laundering path. The attack itself occurred on October 8. Nearly two weeks later, the proceeds were mixed through Tornado Cash, moved across chains, and routed toward OTC channels linked to previously identified North Korean-associated addresses.
Related factors shape the assessment. The consolidation addresses on Tron carried financial ties to wallets earlier attributed to North Korean activity, supporting the SquidSquad attribution in the investigator’s analysis. The rapid transfer to Chinese OTC desks after the bridge step is consistent with efforts to cash out while minimizing freeze risk. Only the reported loss amount, the October 8 BNB Chain incident date, the October 20 Tornado Cash deposit of 1,111.2 ETH, the three withdrawal addresses, the two Tron consolidation wallets, and their prior North Korea-linked exposure are confirmed in the disclosed tracking. Broader patterns of North Korean crypto operations and prior laundering networks contributed to the suspicion.
Continued monitoring requires observation of any further fund movements, potential freezes, or additional on-chain links. Limited public disclosure of the victim’s identity and the initial compromise vector forms a narrower path for complete forensic detail. Investigators and chain-analysis observers continue to track the flow while the attribution remains based on wallet associations. The situation is a suspected institutional theft on BNB Chain followed by classic mixer-and-bridge laundering tied to North Korea-linked infrastructure.
Impact and Broader Context
Questions about the North Korea-linked SquidSquad’s suspected role in the $2.84 million BNB Chain theft keep growing. The multi-step movement of funds creates uncertainty about how much of the value can still be recovered or frozen. It also elevates attention on institutional custody risks and the persistent use of mixers and cross-chain bridges by sophisticated actors. Security teams, exchanges, stablecoin issuers, and law-enforcement observers continue to assess the implications.
The issue drives debate on the effectiveness of current tracking and interdiction against state-linked crypto crime. It raises questions about the durability of institutional defenses on major chains, the limits of mixer and bridge monitoring, risks of rapid OTC off-ramps in certain jurisdictions, effects on near-term confidence in BNB Chain custody practices, and competition among investigators in attributing similar campaigns. Coverage stresses the wallet links to previously identified North Korean addresses and the speed of the final OTC transfers. Notes highlight that the victim and exact attack vector remain undisclosed.
The October 21 disclosure forced renewed focus on North Korea-linked activity targeting institutional crypto holdings. The current review shows how subsequent fund freezes, additional wallet clustering, or official statements will determine the lasting effect.
New on-chain movements, Tether or other issuer actions, or further investigative updates will clarify the outcome of the laundering path and the strength of the attribution.
This analysis uses ZachXBT’s on-chain disclosure and contemporaneous reporting. Attribution remains based on transactional links, and recovery prospects are subject to further investigation and enforcement actions.