North Korea-linked SquidSquad linked to $2.84M BNB Chain heist

The stolen funds remained dormant until October 20, when the attacker funneled 1,111.2 ETH into the Tornado Cash privacy mixer. From there, the assets were dispersed into three Ethereum addresses before being converted into USDT and shifted to the Tron network. Two specific Tron wallets, TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuaqXPaUbU5f5yi3Voux, became the final consolidation point for the loot. ZachXBT noted that these addresses share transaction history with known North Korean illicit networks, suggesting an effort to bypass Tether’s freezing protocols before reaching Chinese over-the-counter dealers.

This incident mirrors a broader trend of North Korean state-sponsored theft. Threat assessments from 2026 identify SquidSquad as a group that specializes in social engineering, often masquerading as venture capitalists on platforms like Telegram and LinkedIn to deploy malware such as RustBucket and NimDoor. While the identity of the latest victim remains shielded, the attack follows a pattern of high-profile breaches, including the massive 2025 Bybit exploit and the 2024 Radiant Capital compromise, both of which involved similar laundering techniques through mixers to obfuscate the destination of stolen capital.