North Korea-Linked SquidSquad Drains $2.84 Million From BNB Smart Chain Holder

Institutional Holder Hit on October 8

Roughly $2.84 million was drained from an institutional cryptocurrency holder on BNB Smart Chain on October 8, and the theft was attributed to SquidSquad, a hacking group linked to North Korea, in tracing work published on Wednesday, October 21. The attribution comes from blockchain investigator ZachXBT, whose findings reconstruct a laundering chain that carried the proceeds through several intermediate wallets before they arrived at addresses tied to Chinese over-the-counter cryptocurrency dealers. Those dealers operate outside the compliance perimeter of a regulated crypto exchange. ZachXBT identified financial connections between the wallets used in the transfers and addresses previously attributed to North Korean operators, and that exposure forms the basis of the SquidSquad designation. The findings remain an on-chain attribution. Confidence rests on wallet-level overlap with prior DPRK-linked activity rather than any claim of inside knowledge. The identity of the affected institution is undisclosed, the method used to compromise its assets is undisclosed, and no public record shows whether the holder reported the loss to authorities. The published record also stops short of explaining the initial compromise, so it is not yet known whether signing keys, an employee device or a third-party integration failed. No statement from any platform or custody provider has independently confirmed the loss. On-chain activity shows the attacker retained control of the proceeds for nearly two weeks after the breach, with the first major movement arriving only on October 20. Until then, the assets produced no visible footprint on the network. Nothing in the published findings implicates the BNB price or the network's operation; the compromise sits at the custody layer of a single institutional holder on BNB.

1,111.2 ETH Through Tornado Cash

The October 20 movement was the busiest leg of the chain so far. The attacker deposited 1,111.2 ETH into Tornado Cash, a privacy protocol that breaks the visible link between sending and receiving wallets, then withdrew to three separate Ethereum addresses. From there the assets crossed to Tron through USDT0, a version of Tether's dollar-pegged stablecoin built to move across supported networks directly, without the routing users normally set up through cross-chain bridges. The transfers converged in two Tron addresses, TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuaqXPaUbU5f5yi3Voux, both of which show transaction overlap with addresses previously tied to North Korean operations. Within minutes of that consolidation, the funds passed through intermediary wallets and reached addresses attributed to Chinese OTC dealers. The speed reads as an attempt to preempt a freeze: Tether can restrict USDT balances at addresses on the networks it supports. The findings do not establish whether the operators completed a conversion into fiat currency, the step usually described as cashing out crypto, or whether any portion of the stolen assets has since been frozen. A 2026 DPRK cryptocurrency threat assessment ties SquidSquad to campaigns against crypto founders, executives and wealthy investors. The group impersonates venture capitalists, investors and business contacts on Telegram and LinkedIn before distributing malicious documents or software, and researchers have linked it to the RustBucket, SwiftBucket and NimDoor malware families, with Tornado Cash listed among the services used to move stolen funds. The case follows an October 5 disclosure in which ZachXBT said he spent $349,700 posing as a customer while tracing transactions tied to the $1.5 billion Bybit theft of 2025; the work pointed to an alleged Chinese operation that processed more than $1 billion, and Tether froze 442,000 USDT linked to wallets uncovered there. Wallets tied to the Drift Protocol exploit, a $285 million April theft Mandiant attributed to the North Korean group UNC6862, moved 25,700 ETH worth $61.56 million into Tornado Cash the same day, though no coordination between the two cases has been established. The 2024 Radiant Capital theft of about $50 million followed a similar mixer path; by October 2025 CertiK had counted 2,834 ETH, roughly $10.8 million, through the mixer from wallets tied to that attack, and Radiant wound down in June 2026. Security pressure on BNB Smart Chain predates this case; COINOTAG separately covered a Cysic bridge halt on the network.

Minutes Between Consolidation and OTC Desks

Two details in this file matter more than the headline figure. One is timing: minutes, not days, separated the Tron consolidation from the OTC desks, a cadence aimed at beating any freeze order Tether might issue. The other is the exit route. Every hop in the chain is visible to anyone running a blockchain node, yet the trail still ends at counterparties outside the published findings, which is where recovery prospects thin out. The market side of BNB, covered separately in BNB technical analysis and in supply events such as the 37th quarterly auto-burn, runs on its own drivers. As of the latest disclosure, whether the $2.84 million was converted, frozen or recoverable is unreported.