Institutional BSC entity loses $2.84M to DPRK-linked group SquidSquad
Security & Exploits ·
On-chain analysis points to North Korea-linked laundering through Tornado Cash and Tron following an October 8 exploit on BNB Chain.
An institutional entity is suspected to have lost roughly $2.84 million to a group tracked as SquidSquad, with the loss traced to an October 8, 2026 exploit on BNB Chain. The attacker later moved 1,111.2 ETH into Tornado Cash on October 20, withdrawing the funds to three separate addresses as part of an apparent effort to break the trail back to the original theft. Investigators have attributed the operation to North Korea, a link described in detail on leviathan.news.
From the Tornado Cash withdrawal addresses, the funds were bridged from Ethereum to Tron using USDT0, consolidating at two Tron addresses. Both consolidation addresses reportedly carry exposure to previously attributed DPRK addresses, reinforcing the attribution to the same actor group. Within minutes of consolidation, the funds were pushed through intermediary addresses to Chinese OTC brokers, a pattern consistent with efforts to move funds before a potential freeze by Tether, as noted in coverage from wublockchain.xyz.
The laundering sequence — mixer, cross-chain bridge, then OTC off-ramp — mirrors established DPRK-linked money movement tactics, where speed through OTC brokers is used specifically to get ahead of stablecoin issuers freezing tainted addresses. The use of Tornado Cash as the initial obfuscation layer, despite its sanctioned status, underscores the continued reliance on the protocol by threat actors seeking to break on-chain traceability before bridging value to Tron.
Multiple parties have corroborated the core facts of the incident, including the $2.84 million loss figure, the 1,111.2 ETH Tornado Cash deposit, and the SquidSquad attribution, with on-chain investigators independently flagging the exploit and laundering path. The victim and theft addresses have been identified on BNB Chain, though the specific protocol or mechanism exploited to drain the institutional entity's funds has not been detailed in available reporting.
What remains unresolved is whether Tether or other stablecoin issuers were able to freeze any portion of the funds before they reached Chinese OTC brokers, and whether the institutional victim has been publicly named. The ultimate destination and conversion of the laundered funds beyond the OTC stage is also not yet known.