The attacker who looted more than $282 million worth of Bitcoin and Litecoin last week is on the move. In the fresh play, the attacker was spotted on-chain shifting funds across multiple blockchains.
Around 928.7 Bitcoin (approximately worth $71 million) was bridged using Thorchain to Ethereum, Ripple, and Litecoin. However, the transfers converted those Bitcoins into 19,631 Ether, 3.15 million XRP, and 77,200 Litecoin.
This comes in when the global digital assets market printed red indexes all around as geopolitical tension broke investors’ mood. The cumulative crypto market cap dipped by almost 3% in the last 24 hours to dip below $3.15 trillion. Bitcoin price got dragged back to the $93K level after trading above $95K for around one week.
Stolen crypto hits Tornado
According to PeckShieldAlert data, parts of the stolen funds have been routed through mixing services and centralized exchanges. Roughly 1,468 Ether (approximately worth $5 million) was sent through Tornado Cash.
Another 735 ETH (worth $2.4 million) was transferred to WhiteBit, while 2,402 ETH (approximately worth $8 million) moved to KuCoin. Smaller amounts like 100 ETH and 143 ETH were sent to ChangeNOW and Huobi, respectively.
Ethereum price has dropped by around 3% in the last 24 hours. It is still running up by more than 2% over the last 7 days. ETH is trading at an average price of $3,230 at press time.
January 10 saw a victim lose $282 million worth of Bitcoin and Litecoin in what investigators described as a hardware wallet social engineering scam. ZachXBT was the first one to report the incident. He informed that the theft occurred around 23:00 UTC. This involved more than 1,459 Bitcoins and about 2.05 million Litecoin moved from victim-controlled addresses.
On January 10, 2026 at around 11 pm UTC a victim lost $282M+ worth of LTC & BTC due to a hardware wallet social engineering scam.
The attacker began converting the stolen LTC & BTC to Monero via multiple instant exchanges causing the XMR price to sharply increase.
BTC was also…
— ZachXBT (@zachxbt) January 16, 2026
The on-chain sleuth stated that the attacker also converted large amounts of the stolen BTC and LTC into Monero through instant swap services. That activity coincided with a sharp rise in the price of XMR shortly after the theft.
Hack-linked swaps push Monero
Monero price rallied strongly in the days following the incident. XMR rose about 70% over four days after the January 10 transfers.
Earlier this week, XMR hit an all-time high near $798. It climbed nearly 80% from a recent low around $450. Monero price has jumped by another 8% in the last 24 hours after a few days of slump. It is trading at an average price of $630 at the press time.
ZachXBT said the swaps linked to the stolen funds likely contributed to part of the price move. He added that the conversion activity created sudden buying pressure across thin liquidity venues.
One wallet identified by the sleuth appeared to act as a consolidation address holding about $43.7 million worth of Bitcoin. The wallet received roughly ten high-value transfers ranging between 39 and 47 BTC.
This was backed by other smaller transactions. Those funds were later sent to another address after passing through an intermediate wallet. Meanwhile, there is no clear on-chain evidence that these specific funds were swapped into Monero. A second address flagged by ZachXBT received more than 1,108 BTC worth about $105 million.
