The attacker responsible for looting more than $282 million worth of Bitcoin and Litecoin last week has been observed actively moving funds across multiple blockchains. In a fresh development, the attacker was spotted on-chain shifting substantial amounts of cryptocurrency.
Approximately 928.7 Bitcoin, valued at around $71 million, was bridged using Thorchain to Ethereum, Ripple, and Litecoin. These Bitcoin transfers were converted into 19,631 Ether, 3.15 million XRP, and 77,200 Litecoin.
This activity occurs as the global digital assets market experiences a downturn, with red indexes appearing across the board. Geopolitical tensions have negatively impacted investor sentiment, leading the cumulative crypto market cap to dip by almost 3% in the last 24 hours, falling below $3.15 trillion. The price of Bitcoin has been pulled back to the $93K level after trading above $95K for approximately one week.
Stolen Crypto Routed Through Mixing Services and Exchanges
According to data from PeckShieldAlert, parts of the stolen funds have been routed through mixing services and centralized exchanges. Roughly 1,468 Ether, approximately worth $5 million, was sent through Tornado Cash.
An additional 735 ETH, valued at $2.4 million, was transferred to WhiteBit, while 2,402 ETH, approximately worth $8 million, moved to KuCoin. Smaller amounts, including 100 ETH and 143 ETH, were sent to ChangeNOW and Huobi, respectively.
Ethereum's price has dropped by around 3% in the last 24 hours, although it remains up by more than 2% over the last seven days. ETH is currently trading at an average price of $3,230.
On January 10, a victim lost $282 million worth of Bitcoin and Litecoin in what investigators described as a hardware wallet social engineering scam. ZachXBT was the first to report the incident, stating that the theft occurred around 23:00 UTC. The attack involved the movement of over 1,459 Bitcoins and about 2.05 million Litecoins from victim-controlled addresses.
On January 10, 2026 at around 11 pm UTC a victim lost $282M+ worth of LTC & BTC due to a hardware wallet social engineering scam.
The attacker began converting the stolen LTC & BTC to Monero via multiple instant exchanges causing the XMR price to sharply increase.
BTC was also…
— ZachXBT (@zachxbt) January 16, 2026
The on-chain sleuth also stated that the attacker converted large amounts of the stolen BTC and LTC into Monero through instant swap services. This activity coincided with a sharp rise in the price of XMR shortly after the theft.
Hack-Linked Swaps Boost Monero Price
The price of Monero rallied strongly in the days following the incident. XMR rose approximately 70% over four days after the January 10 transfers.
Earlier this week, XMR reached an all-time high near $798, climbing nearly 80% from a recent low of around $450. Monero's price has since jumped by an additional 8% in the last 24 hours after a few days of decline. It is currently trading at an average price of $630.
ZachXBT indicated that the swaps linked to the stolen funds likely contributed to a portion of this price movement. He added that the conversion activity created sudden buying pressure across venues with thin liquidity.
One wallet identified by the sleuth appeared to function as a consolidation address, holding approximately $43.7 million worth of Bitcoin. This wallet received about ten high-value transfers, each ranging between 39 and 47 BTC. These funds were later sent to another address after passing through an intermediate wallet. Currently, there is no clear on-chain evidence directly linking these specific funds to Monero swaps. A second address flagged by ZachXBT received over 1,108 BTC, valued at approximately $105 million.