Independent blockchain sleuth ZachXBT has revealed a massive cryptocurrency theft that occurred on January 10 around 23:00 UTC. The victim lost more than $282 million worth of Litecoin (LTC) and Bitcoin (BTC) after falling prey to a suspected social engineering attack targeting their hardware wallet.
How It Happened: Social Engineering Bypasses Hardware Security
According to on-chain data compiled by ZachXBT, the attacker drained approximately 2.05 million LTC and 1,459 BTC from the victim's addresses. Hardware wallets are generally considered safer than hot wallets, but the adversary exploited weaknesses in identity verification, private key custody, or customer support channels to gain access.
Money Laundering: Instant Exchanges and Cross-Chain Moves
After seizing the funds, the attacker quickly converted large amounts of LTC and BTC into Monero (XMR) through multiple instant exchange services. This caused XMR's price to spike briefly. Meanwhile, some Bitcoin was moved to Ethereum, Ripple, and Litecoin networks via the Thorchain cross-chain bridge, making the trail far harder to follow. The combination of a privacy coin and cross-chain transfers is a classic obfuscation tactic.
Takeaway for Investors: Cold Wallets Alone Are Not Enough
This incident underscores that even self-custody with hardware wallets can be compromised if the human or administrative layer is weak. For professional and institutional investors, a robust set of approval workflows and permission controls is essential—device security alone won't protect against sophisticated social engineering.