New blockchain data confirms the Sillytuna hackers have started moving the $24 million stolen from the DeFi trader last week. Investigators watching the wallets report a multi-step laundering process—mixing Bitcoin, swapping stablecoins, and splitting Ethereum funds—designed to break the tracking chain.
Bitcoin Mixer and BitKan Deposit
According to Arkham tracking, about $1.08 million in Bitcoin was sent to a mixing service. Mixers combine transactions from many users, making it hard to trace the next hop. At the same time, $900,000 worth of DAI was converted into USDT and deposited to BitKan, a platform linked to multiple partner exchanges and trading pools. Analysts say this allows the attackers to move funds across markets without drawing immediate attention.
Ethereum Address 0xd0c: $10M Split into Dozens of Wallets
A bigger cluster came from Ethereum address 0xd0c, which moved roughly $10 million. Instead of one destination, the funds were broken into many small transfers, each sent to a fresh wallet. This splitting tactic is standard in crypto heists—it raises the work needed to track the full sum. Security experts believe this is the first stage of a laundering chain that may later involve more swaps, cross-chain bridges, or exchange deposits.
How the Attack Happened: Physical Threats, Not Code Exploits
The incident began on March 4, 2026, when trader Sillytuna reported losing over $24 million in stablecoins and Bitcoin. Unusually, the attackers didn't exploit a smart contract or protocol bug—they used real-world violence and threats to force the victim to transfer assets from their wallet. The case underscores that crypto security risks extend beyond code: public wallet holders and well-known traders may also face physical danger.
Security Alert and Bounty
The latest movements have raised alarms. One analyst noted that splitting across many Ethereum wallets often precedes larger swaps or cash-outs. Security experts remind the community that protections must include physical safety and discretion about wallet holdings, not just smart contract audits. Sillytuna has offered a 10% bounty for fund recovery, even if the tip comes from the attackers themselves. Blockchain trackers continue to share suspicious addresses with exchanges and DeFi platforms to block withdrawals. The coming days are critical: if the attackers keep splitting or mixing, it signals preparations for a major payout. The case shows blockchain transparency helps trace stolen assets—but once funds start flowing, stopping them becomes extremely difficult.