Inside the $282 Million ZachXBT Investigation: How Stolen Bitcoin Reached Tornado Cash

On the night of January 10th, while most people were asleep, one of the biggest heists in cryptocurrency history was taking place in real-time. This incident wasn’t the result of a software flaw or a protocol breach; it stemmed from a breach of human trust.

Key Takeaways

On January 10th, an attacker stole over $282 million in Bitcoin and Litecoin through social engineering.
The victim was tricked into revealing their wallet's seed phrase, compromising their hardware wallet's security.
The attacker used THORChain to launder stolen funds and employed Tornado Cash for additional privacy.
This incident occurred during a chaotic market period, with notable declines in cryptocurrency values.
Law enforcement agencies recently took steps to combat large-scale fraud and money laundering in the cryptocurrency space.

In summary, this incident underscores the importance of security practices and awareness in the rapidly evolving cryptocurrency landscape.

A victim lost $282M+ worth of $LTC & $BTC

In a significant act of social engineering, an attacker managed to bypass the renowned security of hardware wallets, stealing over $282 million in Bitcoin and Litecoin from a single victim. However, this theft was just the start of a complex scheme.

Understanding the Scam

As blockchain investigator ZachXBT joined forces with security firm PeckShield to monitor the unfolding situation, the attacker swiftly moved to launder the stolen money across multiple blockchains. Hardware wallets, like Trezor, are often hailed as the safest crypto storage solution. However, they have one critical vulnerability: the user themselves.

Reports indicate that the victim was deceived through a sophisticated impersonation scam. The attacker masqueraded as support for “Trezor Value Wallet,” earning the victim’s trust. Eventually, the attacker managed to persuade the victim to share their seed phrase, which is the key to accessing the wallet. Once the seed phrase was revealed, the security of the hardware wallet became irrelevant.

Stolen Funds: Transfer and Laundering

Following the theft of over $282 million worth of Bitcoin (BTC) and Litecoin (LTC), the attacker noted the transactions were visible on public blockchains. To obscure their trail, the attacker turned to THORChain, a decentralized liquidity protocol. Utilizing THORChain, approximately $71 million, or around 928.7 BTC, was transferred across different blockchain networks.

THORChain offers an advantage over centralized exchanges, as it does not require KYC (Know Your Customer) checks. This anonymity allowed the attacker to swap Bitcoin for Ethereum and Ripple (XRP) without revealing their identity.

Once the stolen funds reached the Ethereum (ETH) network, the attacker took additional measures to cover their tracks. A significant portion—1,468.66 ETH valued at roughly $4.9 million—was sent via Tornado Cash, a privacy mixer. For those unfamiliar, mixers group funds from various users, breaking the transparent link between the origin and destination of the money. The attacker also converted large sums into Monero, a privacy-centric cryptocurrency, which temporarily increased Monero's market price.

Market Reactions and Developments

This entire sequence of events unfolded amidst a tumultuous market backdrop. On that same day, cryptocurrency markets were already experiencing declines following a tariff shock from Trump. Bitcoin's value dropped by 2.26% to $93,075, while Litecoin saw a decrease of 7.19%, according to CoinMarketCap data.

Despite a surge in scams, there are positive developments on the regulatory front. Recently, Europol and global law enforcement agencies dismantled a significant fraud and money-laundering operation that operated across several countries, resulting in the theft of over €700 million from thousands of victims.