blockintAI · Research blog

Twelve Days of Silence, Then Two Hours to Tron: Following the $2.84M Theft ZachXBT Links to North Korea's SquidSquad

BlockintAI · 2026-10-22T14:00:00.000Z

BlockintAI research. On-chain figures come from public BNB Chain, Ethereum and Tron data, re-checked on Wednesday, October 21, 2026, between about 7:08 AM and 7:25 AM Central Time (CT). Times are CT unless marked UTC.

At 7:02 AM Central Time on Thursday, October 8, 2026, a long-used wallet on BNB Chain sent 2,804,098 USDT to an address that had never been used before. Four minutes later it sent another 39,332 USDT to the same place.

By 7:13 AM, the new address had swapped all 2.84 million dollars of stablecoin into BNB. Within the hour, the BNB had crossed to Ethereum and become 1,111 ETH.

Then nothing happened for almost twelve days.

At 9:44 PM on Monday, October 19, the ETH moved again. By 2:09 AM the next morning it had been through Tornado Cash, swapped back into dollars, bridged to Tron, pooled in two addresses and passed on in million-dollar blocks. At the two Tron addresses where it pooled, no block of it sat still for more than about two minutes.

On-chain investigator ZachXBT published the addresses at 12:45 AM CT on October 21. He says an institutional entity is suspected to have lost about $2.84 million to SquidSquad, a hacking cluster he describes as linked to North Korea. That attribution is his. What follows is what the public chains show, hop by hop.

Key facts
The theft Oct 8, 2026, 7:02–7:06 AM CT, BNB Chain: 2,843,430.21 USDT (BNB Chain's Binance-Peg USDT) in two transfers from the victim's wallet to the new address 0x049B1eCcE5e2Fb254821BC9DC3ae98C5a6eb7E80
Who says it was SquidSquad ZachXBT, Telegram, Oct 21, 2026, 05:45 UTC (12:45 AM CT). He calls the victim "an institutional entity" and SquidSquad "DPRK-linked." The victim has not been named publicly
Off BNB Chain 7:13 AM CT: all 2.84M USDT swapped for 3,718.2 BNB through CoW Protocol. 7:16–7:40 AM: bridged out, arriving on Ethereum through Across, Mayan (via LI.FI), NEAR Intents, Relay and one unlabeled contract. At 7:52 AM, the 1,111.26 ETH moved to a second wallet
The wait 11 days and 14 hours, Oct 8, 7:52 AM to Oct 19, 9:44 PM CT
Tornado Cash Oct 19, 9:45–10:04 PM CT: 15 deposits, 1,111.2 ETH (11 × 100, 1 × 10, 1 × 1, 2 × 0.1). Oct 20, 12:43–1:50 AM CT: 14 withdrawals (1,111.1 ETH gross) to the three addresses ZachXBT named
Back to dollars Oct 20, 12:45–1:54 AM CT: about 1,107 ETH swapped for 2,638,089 USDT, then sent to Tron in seven transfers through USDT0, Tether's cross-chain version of USDT
On Tron 2,637,298 USDT arrived at three receiving addresses, 12:52–1:58 AM CT, and was forwarded to the two consolidation addresses ZachXBT named. Those two moved 10 million USDT in 1M blocks to ten addresses between 12:54 and 2:09 AM CT. Our on-chain review identified about 2.64M of that 10M as coming from this theft
Freezes and sanctions No address in this trail is on Tether's USDT blacklist on Tron or Ethereum, and none is on OFAC's sanctions list (Oct 21, 2026, about 7:15 AM CT). The two Tron consolidation addresses hold 0 USDT
BlockintAI report SquidSquad theft addresses (C3 f5973dc4)

Who is SquidSquad?

ZachXBT's post is short. It names the victim's address, the theft address, the three Tornado Cash withdrawal addresses and two Tron consolidation addresses, and it says both Tron addresses "have exposure to previously attributed DPRK addresses." He doesn't name the institution or say how its wallet was compromised. As crypto.news noted in its write-up, both remain undisclosed.

SquidSquad is a name used in public research on North Korean crypto theft. The public GitHub research notes on DPRK clusters kept by security researcher tayvano list "SquidSquad / DPRK-SQ" alongside names other trackers use for overlapping activity, including Sapphire Sleet, BlueNoroff and DangerousPassword. The notes list the cluster's tactics as impersonating venture capitalists, Telegram messages, fake video meetings, fake Google Drive links and macOS malware, and they name Tornado Cash among the laundering services it has used.

That is background, not evidence about this case. What the chain can show is the route the money took.

October 8: fifty minutes to leave BNB Chain

The victim's address, which ZachXBT published (0x579b…f153), is an ordinary single-key wallet with more than 800 transactions on BNB Chain. Both transfers out of it on October 8 were signed by that wallet itself:

  • 7:02:50 AM: 2,804,098.01 USDT to 0x049B1eCcE5e2Fb254821BC9DC3ae98C5a6eb7E80, an address with no earlier activity.
  • 7:05:09 AM: 0.001 BNB, enough for the new address to pay its own transaction fees.
  • 7:06:56 AM: 39,332.21 USDT more.

Whoever controlled the new address didn't wait. At 7:13 AM it sold the whole 2,843,430.21 USDT for 3,718.2 BNB in a single trade settled by CoW Protocol's settlement contract.

Then it started moving the BNB off the chain:

Time (CT), Oct 8 Route BNB sent
7:16–7:20 AM Three swap-and-bridge transactions to the contract verified as Across Protocol's SpokePoolPeriphery 2,700
7:18–7:26 AM Three transactions through the LI.FI contract, calling its Mayan bridge route 700
7:35 AM One transfer to a separate address, forwarded to a contract within seconds 318.2

The address also sent the 5,307 USDT it got back as leftovers from the LI.FI swaps on through another address at 7:38 AM, and made a tiny deposit to Relay's bridge contract at 7:40 AM.

On Ethereum, the same address started receiving ETH at 7:16 AM. By 7:40 AM it had collected 1,111.26 ETH: 807.2 ETH from the contract Etherscan tags "Across: Multicall Handler," 207.3 ETH from the one it tags "Mayan: Swift v2 Destination," 94.6 ETH from an unlabeled contract, and 2.08 ETH from the address Etherscan tags "NEAR Intents."

At 7:52 AM it sent everything, 1 ETH and then 1,110.26 ETH, to a second Ethereum wallet, 0xfc3Bbf34Cb8789CA029DB252E0DC1CcAd6BdecAB. From the first transfer out of the victim's wallet to the money sitting on a different chain in a different wallet: 50 minutes.

The thief became a target, too

Within minutes, the new addresses started receiving tiny transfers and fake tokens from look-alike addresses that copy the first and last characters of real ones. On Ethereum, addresses beginning 0xfc3b and ending ecab, built to look like the thief's second wallet, kept sending the theft address dust and fake "ETH" tokens. On BNB Chain, a fake USDT token arrived from an address made to look like the victim's.

That is address poisoning: bots watch for large transfers and seed the sender's history with look-alikes, hoping someone copies the wrong address next time. It hit the thief the same way it hits everyone else.

Nearly twelve days in one wallet

The 1,111.26 ETH then sat in 0xfc3B…ecAB for 11 days and 14 hours. Plenty of thieves wait this way. Holding still until attention fades is a habit of patient laundering.

It moved at 9:44 PM CT on Monday, October 19, in one transfer of 1,111.26 ETH to a fresh wallet, 0x721DeBf85A1Bcc61DCb455d100FF69a474db6865. One minute later, that wallet started depositing into Tornado Cash through the contract Etherscan tags "Tornado.Cash: Router":

  • 11 deposits of 100 ETH, 9:45–10:03 PM
  • 1 of 10 ETH, 1 of 1 ETH and 2 of 0.1 ETH, 10:03–10:04 PM

That is 1,111.2 ETH in 15 deposits, matching the 1,111.2 ETH ZachXBT reports, done in under 20 minutes.

Tornado Cash breaks the link between a deposit and a withdrawal. It only works if someone else's money is in the pool at the same time, which is why the waiting time between deposit and withdrawal usually matters. Here it was short.

October 20, 12:43 AM: out, swapped, bridged

Two hours and 38 minutes after the last deposit, withdrawals began. Between 12:43 AM and 1:50 AM CT on October 20, the three addresses ZachXBT named received 14 withdrawals: 11 from the 100 ETH pool, one each from the 10 ETH, 1 ETH and 0.1 ETH pools. That is 1,111.1 ETH before Tornado's relayer fees, which took about 0.35–0.36 ETH from each 100 ETH note.

Withdrawal address Withdrawals ETH swapped for USDT USDT bridged to Tron
0xb8b25f535a6e51d0b18c48941d791c7e83559d2b 3 × 100 ETH, 12:43–12:59 AM 298.9 714,431.04 in 3 transfers
0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848 4 × 100, 1 × 10, 1 × 0.1, 1:10–1:37 AM 408.6 972,523.52 in 3 transfers
0x35c72e26f6888b4cba8668c6cfa4143599680bfe 4 × 100, 1 × 1, 1:40–1:50 AM 399.5 951,134.87 in 1 transfer

Each address followed the same three steps, often within two or three minutes of a withdrawal: swap the ETH for USDT (mostly through the contract Etherscan tags "Uniswap: Universal Router v2.1.2," once through CoW Swap), approve the USDT, and send it to Tron through the contract that USDT0's own deployment list names as its Ethereum bridge contract.

In all, 2,638,089.43 USDT left Ethereum for Tron between 12:48 AM and 1:54 AM.

Waiting cost the thief money. On October 8 the stolen 2.84 million dollars bought 1,111.26 ETH. Twelve days, a falling ETH price and a stack of bridge and relayer fees later, the same ETH came back as about 2.64 million.

Tron: tested first, then a million at a time

USDT0's contract on Tron paid the money out to three receiving addresses. The amounts match the Ethereum side transfer for transfer, less a bridge fee of about 0.03%:

Sent from Ethereum (CT) Arrived on Tron (CT) USDT arrived Tron receiving address
12:48 AM, 12:58 AM, 1:06 AM 12:52 AM, 1:02 AM, 1:10 AM 714,216.71 TZ3H7Z4vFrpr6Rcnq1wRT3j8PDhJPHpzyS
1:15 AM, 1:27 AM, 1:41 AM 1:19 AM, 1:31 AM, 1:45 AM 972,231.76 THqY7jxjxU1SdHqhNHKHn5m5mm3gSnQTAP
1:54 AM 1:58 AM 950,849.53 TLgY7igNZhd3kLu44YPxHevhZKwTUFoja2

From those three, the money went on to the two Tron addresses ZachXBT names as consolidation points, TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux.

The route had been tested before the money arrived. At 12:22 and 12:23 AM, another address sent each consolidation address 100 USDT. Between 12:25 and 12:29 AM, each consolidation address sent 10 USDT to five different addresses. Those ten addresses are where the money went next.

Then the real transfers began. Each consolidation address took in about 1 million USDT at a time and sent exactly 1,000,000 USDT to one of its five tested addresses, usually within one or two minutes:

  • TEvUsnwX…8TBU sent five 1M blocks between 12:54 and 2:09 AM.
  • TVxzjnx3…Voux sent five 1M blocks between 12:54 and 2:08 AM.

The last small change left them at 2:13 and 2:15 AM. Both still held 0 USDT when BlockintAI re-checked this morning.

More than this theft went through

Those two addresses moved 10 million USDT that night, nearly four times what was bridged from this theft. Our on-chain review identified about 2.64 million of it as coming from the three Tornado Cash withdrawal addresses, through the three receiving addresses above. The other roughly 7.36 million came in through two more Tron addresses: one fed mostly by separate USDT0 transfers that don't match this theft's withdrawals, and one fed by an ordinary Tron wallet.

ZachXBT writes that "all funds were bridged from Ethereum to Tron via USDT0 and consolidated" at the two addresses, and that is what the chain shows for this theft's money. The extra 7.36 million means the same consolidation points carried other money in the same two hours. Where it came from is a separate question.

Ahead of a freeze

Tether can freeze USDT at an address on Tron, and has done so in theft cases before. That only works while the money is still there. ZachXBT says the funds moved within minutes through intermediary addresses to Chinese OTC desks, "likely to evade any potential Tether freeze."

The timing fits that. No 1M block sat at a consolidation address for more than about two minutes. The ten next-hop addresses passed it on again in large chunks, within minutes to a few hours. As of this morning, none of the addresses in this trail is on Tether's blacklist on Tron or Ethereum.

What this case shows

  • Fast conversion, slow exit. The thief turned stolen stablecoins into BNB in 11 minutes and ETH within the hour, then waited almost twelve days before laundering.
  • Bridges are the getaway roads. Across, LI.FI, Mayan, NEAR Intents, Relay and USDT0 all carried part of this money. None of them did anything unusual; the thief just used them the way anyone would.
  • Tornado Cash is still in the playbook. Treasury lifted its sanctions on Tornado Cash in March 2025. This is at least the third large Tornado run BlockintAI has followed in a week, after the Drift and Aztec Connect exploiters.
  • Stablecoins come back at the end. After all that, the money still left as USDT on Tron, where it can be frozen. That last stretch is the one the launderers hurried most.
  • If you hold funds for a company, protect the signer. The public research notes cited above list SquidSquad's lures as fake investors, fake meetings and malicious files. Keep signing keys on hardware wallets or multisig, separate from the machines used for email and calls, and be suspicious of any "investor" asking you to install software or open a shared file before a meeting.
  • Report it. In the U.S., report hacks and fraud to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. If you've been hacked or scammed, you can also file a report at blockint.ai with the addresses and transaction IDs. It's free, and anonymous reports are accepted.

#DPRK #TornadoCash #CryptoHack #USDT #Tron

Sources

The attribution

BNB Chain, October 8, 2026 (BscScan)

Ethereum (Etherscan; name tags as shown on Oct 21, 2026)

USDT0

Tron (Tronscan)

Freezes and sanctions