A retired American, 77, has become the target of one of the record Bitcoin heists worth $330.7 million US dollars. The attacker used sophisticated social engineering techniques to infiltrate the victim’s cryptocurrency wallet. On April 30, onchain investigator ZachXBT u605 via Twitter reported a whopper. It’s currently the fifth-largest crypto hack ever and set off a convoluted laundering scheme spread across several different platforms.
The stolen funds were rapidly distributed via peel chains and laundered through more than six simultaneous exchanges. The thieves exchanged the stolen Bitcoin for Monero, a privacy-oriented cryptocurrency. This announcement caused a 50% increase in the price of Monero, briefly sending its price to $339. The impressive operation deployed over 300 hacker wallets as well as over 20 exchanges and payment services such as Binance.
The Anatomy of the Heist
The first of those thefts converted a staggering $330 million in Bitcoin — all in just two transactions.
$330M in BTC was received in two transactions, then immediately distributed via peel chains. - Yehor Rudytsia
The money was then quickly pushed out the door via a number of peel chains which made tracking it even more complex.
The attacker then attempted to obfuscate the funds through various instant exchanges and mixers, splitting them into smaller chunks.
Funds started to flow into multiple instant exchanges / mixers with small amounts, then mixers were distributing funds across multiple new wallets. The biggest funnelling chain is now consists of 40+ wallets. - Yehor Rudytsia
This complicated process took hundreds of wallets and multiple exchanges. These thieves had bridged less than 1% of the stolen Bitcoin to Ethereum. They would take that and deposit it into other platforms, which made it even more difficult to track.
The Monero Connection and Laundering Tactics
The eventual conversion of the stolen Bitcoin into Monero (XMR) greatly hindered tracking efforts.
Once funds are swapped into Monero, tracing becomes virtually impossible due to its privacy-preserving architecture. The chance of recovery drops significantly after this step. - Hakan Unal
This unfortunate move highlights the challenges that law enforcement and blockchain investigators face. Getting back stolen crypto becomes even harder when privacy coins are part of the mix. The attacker likely pre-set accounts on multiple exchanges and OTC desks in advance. This arrangement provided them the flexibility to rapidly deploy and spend down the money.
The size of the operation points to a highly prepared and sophisticated attacker. The paragraph remains the same except for changing “this” to “the potentially stolen” to clarify whose funds are in question.
Implications and Challenges for Recovery
The heist illustrates just how dangerous investing in cryptocurrency can be. This is particularly concerning for seniors, who may be more susceptible to social engineering schemes. The case exposes troubles with freezing accounts and returning reclaimed funds, but the pursuit of such with frustratedly lethargic judicial processes.
Major problem in cases like this (similar to Genesis creditor’s 4064 BTC theft back in Aug 2024) is that freezing centralized exchange accounts used in the laundering process is hardened due to particularly slow legal process of police reporting and investigations. - Yehor Rudytsia
According to analysts, cybercriminals stole more than $1.6 billion in crypto during the first quarter of 2025. This theft primarily targeted centralized exchanges and through on-chain smart contracts. The growing sophistication of these attacks, whether from lone actors or state-sponsored bad actors, represents a huge challenge to our industry. Famed onchain investigator ZachXBT knocked down theories that North Korea’s Lazarus Group perpetrated the attack. He acknowledged the laundering methods used were particularly complex.
So far, we haven’t been able to confidently link this activity to any known hacker group, as the laundering methods used — while sophisticated — don’t clearly match the signature patterns of previously identified actors. - Unal
