A single crypto whale has lost over $282 million in Bitcoin (BTC) and Litecoin (LTC) after falling victim to a social engineering attack, marking one of the largest individual thefts in history. The incident, first flagged by on-chain investigator ZachXBT, exposes a critical vulnerability in self-custody: the human element.
The Heist: 2% of Litecoin Supply Gone
The attack occurred on January 10, 2026, when the victim was tricked by a bad actor impersonating Trezor’s "Value Wallet" support team. Under the guise of a troubleshooting procedure, the attacker convinced the user to reveal their seed phrase. Security is only as strong as its weakest link; in this case, a single conversation bypassed hardware-grade encryption.
The scale of the theft is market-moving. The attacker drained approximately 1,459 BTC (~$130M) and a staggering 2.05 million LTC. To put the Litecoin figure in perspective, that represents roughly 2.4% of the entire circulating supply of the asset.
The Launder: Monero Liquidity Crunch
Unlike typical bridge exploits where funds sit dormant, this attacker moved with sophisticated speed. The stolen assets were immediately funneled through THORChain, a decentralized cross-chain protocol, to obfuscate their origin. The funds were then aggressively swapped for Monero (XMR) via instant exchanges.
This massive buy pressure on thin order books caused a liquidity shock. XMR prices spiked violently, reportedly jumping over 30% during the laundering window, as the attacker swept available liquidity to erase the money trail. While Bitcoin (BTC) held steady at roughly $89,500, the privacy coin sector saw isolated volatility directly correlated to the wash trading.
"The attacker began converting the stolen LTC & BTC to Monero via multiple instant exchanges causing the XMR price to sharply increase.", ZachXBT
ZeroShadow Freezes Fraction of Funds
Security firm ZeroShadow, acting on a tip from exchange BitcoinVN, managed to freeze approximately $700,000 of the stolen funds. While a technical victory, this represents less than 0.3% of the total loot. The vast majority of the assets have likely successfully crossed into the privacy-shielded Monero network, rendering further on-chain tracking nearly impossible.
ZachXBT noted that despite the sophistication, the attack does not bear the signatures of the Lazarus Group, suggesting a different, highly organized criminal entity is responsible.
