An unnamed institutional entity is suspected of being compromised on BNB Chain on October 8, on-chain investigator ZachXBT has traced. The theft has been attributed to SquidSquad, a group linked to North Korea.

About $2.84M was stolen, and on October 20 the attacker deposited 1,111.2 ETH into Tornado Cash before withdrawing it to three fresh addresses.

From there, the funds were bridged from Ethereum to Tron via USDT0 and consolidated in two addresses with exposure to wallets previously attributed to DPRK. Within minutes, the assets moved through intermediary addresses to Chinese OTC desks, likely to avoid a potential Tether freeze.

The case adds to a long list of DPRK-linked thefts and shows how quickly laundering now moves from mixers to cross-chain stablecoin rails and off-ramps.