North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
Blockchain investigator ZachXBT attributes a $2.84 million BNB Chain theft to North Korea-linked group SquidSquad, tracing funds through Tornado Cash to Tron wallets tied to prior North Korean addresses.
Why it matters
The incident highlights ongoing North Korean cyber operations targeting crypto institutions and the use of mixing services like Tornado Cash and cross-chain bridges to obfuscate stolen funds. If confirmed, it adds to the growing tally of state-sponsored crypto thefts.
Key facts
Blockchain investigator ZachXBT attributed the attack to North Korea-linked hacking group SquidSquad.
Reported by Crypto.News
Funds were withdrawn from Tornado Cash to three Ethereum addresses and then transferred to Tron via USDT0.
Reported by Crypto.News
Two Tron wallets receiving the funds had exposure to addresses previously attributed to North Korean operators.
Reported by Crypto.News
The identity of the affected institution and the method used to compromise its assets remain undisclosed.
Reported by Crypto.News
What happened
Crypto.News reports that an institutional cryptocurrency holder lost approximately $2.84 million in an October 8 attack on BNB Smart Chain, according to blockchain investigator ZachXBT. The investigator identified the North Korea-linked hacking group SquidSquad as the suspected perpetrator. On October 20, the attacker allegedly deposited 1,111.2 ETH into Tornado Cash before withdrawing to three Ethereum addresses and moving funds to Tron via USDT0. ZachXBT found two Tron wallets receiving the funds had exposure to previously attributed North Korean addresses. The affected institution's identity and the compromise method remain undisclosed, and the findings are described as on-chain attribution rather than confirmed attribution.
How the story developed
- Update
Attack occurs on BNB Smart Chain
Institutional holder loses approximately $2.84 million
- Update
Attacker deposits 1,111.2 ETH into Tornado Cash
Funds mixed before withdrawal to three Ethereum addresses
- First report
First report by Crypto.News
North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft
- Update
ZachXBT discloses investigation and attributes attack to SquidSquad
On-chain analysis links Tron wallets to North Korean addresses
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 21 Oct 2026, 06:54 UTC: Crypto.News — 1 independent source, 1 reports
- 21 Oct 2026, 15:21 UTC: Crypto News (CryptoNews.net) — 2 independent sources, 2 reports
Affected entities
Also mentioned: United States, Chainlink
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Crypto.News Crypto media | North Korea-linked SquidSquad suspected in $2.84M BNB Chain theft | Original | |
| Crypto News (CryptoNews.net) Aggregator | North Korea-Linked SquidSquad Drains $2.84 Million From BNB Smart Chain Holder | Syndicated |
Related events
THORChain declines Bitget request to block addresses tied to $387.5 million hack
Bitget asked THORChain to refuse service to addresses holding its stolen funds; THORChain says a network halt is not a selective freeze and it does not censor by design.
Bitget Raises September Hack Loss Estimate to $387.5 Million After Adding Zcash and TRON Transfers
Bitget raised its estimate of assets moved to attacker-controlled addresses in the September 24 breach to $387.5 million, about 83.5% of its protection fund.
Bitget resumes bitcoin withdrawals four days after $387.5 million breach
Bitget reopened bitcoin withdrawals at 08:00 UTC on Sep. 28 after a Sep. 24 breach that moved about $387.5 million to attacker-controlled addresses.
Duelbits Confirms About $7M Hot Wallet Drain Across Four Blockchains, Site Offline
Duelbits confirmed a roughly $7M hot wallet hack on Thursday, pulled its site offline and says user funds are safe while blockchain trackers dispute the amount stolen.
Binance Wallet Adds USDT Gas Payments on BNB Chain, Ethereum, Solana and TRON
Binance Wallet now lets users pay gas fees in USDT on BNB Smart Chain, Ethereum, Solana and TRON instead of holding each chain's native token.
Changer+ launches self-custodial stablecoin wallet across four blockchains
Changer+ released a self-custodial wallet focused on USDT and USDC across Ethereum, TRON, BNB Chain, and Solana with a launch promotion of free transactions.
