A single crypto investor lost over $282 million in Bitcoin and Litecoin on January 10 after falling victim to a sophisticated social engineering attack, according to on-chain sleuth ZachXBT. The theft, which stripped the victim of 2.05 million LTC and 1,459 BTC, ranks as the largest known individual crypto heist to date, surpassing the $243 million theft from a Genesis creditor in 2024.
The "Trezor" Trap
The attacker did not exploit a protocol vulnerability or crack a private key. Instead, they compromised the human element. Security firm ZeroShadow noted the victim was likely tricked into sharing their seed phrase by an actor impersonating Trezor support. Once access was granted, the wallet was emptied at 23:00 UTC, with the attacker immediately initiating a high-velocity laundering operation.
Monero Price Shock
Liquidity vanished instantly as the thief flooded the market to obscure the trail. The attacker aggressively swapped the stolen assets, specifically the 2.05 million LTC ($153M), into Monero (XMR) via decentralized exchanges and swap services like THORChain. This concentrated buy pressure forced XMR to spike nearly 60% earlier this week, hitting local highs near $800 before retracing to $623 (-9% 24h).
ZachXBT confirmed the attacker also bridged Bitcoin across Ethereum and Ripple networks to further fragment the trail. While ZeroShadow managed to freeze approximately $700,000, the vast majority of the funds have likely entered the privacy-shielded Monero network, rendering recovery nearly impossible.
“A victim lost $282M+ worth of LTC & BTC due to a hardware wallet social engineering scam… The attacker began converting the stolen LTC & BTC to Monero via multiple instant exchanges causing the XMR price to sharply increase.” ZachXBT
Institutional Context
This incident confirms a darker shift in crypto crime: attackers are moving away from complex smart contract exploits toward high-value social engineering. Protocol hacks require technical genius; draining a whale requires only a convincing email or phone call. With XMR acting as the primary exit ramp, the privacy coin’s liquidity is being stress-tested by illicit flows, a dynamic likely to draw renewed regulatory scrutiny on non-KYC swap services.
