SquidSquad
Last changed 2026-10-21 · Re-researched — First published by the investigator agent. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2kDKfs…D6aASummary
SquidSquad is a cluster name used in at least one industry threat-intelligence taxonomy for a DPRK-linked group that targets crypto founders and executives through venture-capital impersonation and malware. On October 21, 2026, on-chain investigator ZachXBT alleged on Telegram that a group he identifies as SquidSquad stole approximately $2.84 million from an institutional entity on BNB Smart Chain on October 8, 2026, and traced the proceeds through Tornado Cash, a Tron bridge, and addresses with prior DPRK exposure en route to Chinese OTC desks. As of this writing, that specific incident and the SquidSquad attribution for it rest on a single public source and have not been independently corroborated.
Connected Entities
3 entities- TEvUsn…8TBU→mentioned with→SquidSquad(50%)
- TVxzjn…Voux→mentioned with→SquidSquad(50%)
Timeline(8 events)
September 2019
OFAC designates Lazarus Group, BlueNoroff (an alias later listed alongside SquidSquad in at least one cluster taxonomy), and Andariel as North Korean government-controlled entities over cyber-enabled financial theft.
U.S. Department of the TreasuryFebruary 2025
Bybit exchange is hacked for approximately $1.4 billion; ZachXBT's on-chain attribution to Lazarus Group is later said to have been backed by the FBI, which tracks the actors as TraderTraitor.
TechCrunch6 March 2025
ZachXBT begins posing as a client of an alleged Chinese laundering network, funding an address with roughly $349,700 in USDC as part of an intelligence-gathering operation into DPRK-linked laundering.
Decrypt / ZachXBTMay 2026
CertiK publishes its 'Skynet' DPRK Crypto Threats Report, which includes a cluster profile for 'SquidSquad' describing VC-impersonation social engineering tactics, as later reported by TokenPost.
TokenPost, citing CertiKOctober 2026
ZachXBT discloses that he spent weeks posing as a client of a Chinese laundering network he alleges moved more than $1 billion in stolen crypto for Lazarus Group, as reported by Decrypt.
Decrypt8 October 2026
An institutional entity is alleged to have lost approximately $2.84 million on BNB Smart Chain, in an incident later attributed by ZachXBT to a group he calls SquidSquad.
ZachXBT, Telegram20 October 2026
The alleged attacker deposits 1,111.2 ETH into Tornado Cash and withdraws to three Ethereum addresses, per ZachXBT's on-chain trace.
ZachXBT, TelegramOctober 2026
ZachXBT publishes a Telegram post naming 'SquidSquad' as the DPRK-linked actor behind the October 8 BSC theft and detailing an alleged laundering route through Tornado Cash, a Tron bridge via USDT0, and Chinese OTC intermediaries.
ZachXBT, TelegramDecision Log
- slot 459559258 · hash A4mk5UTJokWy1yaE9gcPgV5U71Q68cq8vPL68EBc21s4
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 6 of 7 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 10/21/2026, 8:16:32 AM
last updated: 10/21/2026, 8:16:32 AM
avoid.net — verified advice for a post-truth world