Verify a decision

{"actor":"system:backfill","investigation_id":"c6cc4dfc-7387-419b-ad4d-a459604b9189","kind":"publish","page_slug":"squidsquad","published_at":"2026-10-21T08:16:42.010Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"SquidSquad","sections":[{"content":"According to an October 21, 2026 Telegram post by on-chain investigator ZachXBT, an institutional entity is suspected to have lost approximately $2.84 million on BNB Smart Chain (BSC) on October 8, 2026, in an incident the post attributes to a group it names 'SquidSquad,' described as DPRK-linked. The post names a victim address (0x579be84d2a0f7bcfc34b4b3883153adec84ff153) and a theft/attacker address (0x049b1ecce5e2fb254821bc9dc3ae98c5a6eb7e80) as reported in the source material. The identity of the victim institution has not been publicly disclosed, and no independent news outlet, blockchain-security firm, or regulator had published a corroborating report on this specific incident as of this writing. This claim is alleged and should be treated as single-sourced pending independent confirmation.","heading":"Alleged October 2026 BNB Smart Chain Theft","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT, Telegram post","type":"social_media","url":"https://t.me/zachxbt/368"}]},{"content":"The same ZachXBT post describes an alleged laundering sequence following the BSC theft. It states the attacker deposited 1,111.2 ETH into Tornado Cash on October 20, 2026, and withdrew the funds to three Ethereum addresses (0xb8b25f535a6e51d0b18c48941d791c7e83559d2b, 0x35c72e26f6888b4cba8668c6cfa4143599680bfe, and 0x8e4a232ac8a05d1f4cfe4458a96a581ceeb7e848). The post further alleges the funds were bridged from Ethereum to Tron using the USDT0 cross-chain protocol and consolidated at two Tron addresses (TEvUsnwXvprdvB7eNGiqh6rDiMqFiC8TBU and TVxzjnx3GPDTciiuagXPaUbU5f5y13Voux), which it says carry exposure to previously attributed DPRK wallets. From there, the post alleges the funds were routed through intermediaries to Chinese over-the-counter (OTC) desks, framed in the post as an apparent attempt to avoid a Tether freeze. These are allegations drawn from a single on-chain trace published by one investigator; while the underlying addresses are independently checkable on public blockchain explorers, AVOID.NET has not independently verified the full flow or the accompanying image reportedly included in the original post.","heading":"Alleged Laundering Trail: Tornado Cash, Tron Bridge, and Chinese OTC Routing","severity":"high","sources":[{"credibility":2,"name":"ZachXBT, Telegram post","type":"social_media","url":"https://t.me/zachxbt/368"}]},{"content":"Independent of the October 2026 incident, a cluster called 'SquidSquad' appears in CertiK's 'Skynet' DPRK Crypto Threats Report, as reported by TokenPost. That report's cluster taxonomy lists SquidSquad alongside aliases including Sapphire Sleet, APT38, BlueNoroff, and UNC1069, and describes it as specializing in impersonating venture capital firms, investors, and business partners to target cryptocurrency project founders, executives, and high-net-worth individuals. Per the report, typical initial contact occurs via Telegram or LinkedIn, followed by a malware-laden Google Drive link or PDF; named malware families include RustBucket, SwiftBucket, NimDoor, and AppleScript-based payloads, and named laundering channels include Tornado Cash, eXch, Noones, Paxful, and dust-collector services. This describes a social-engineering/malware-delivery pattern distinct from the direct exchange/platform compromise described in the October 2026 ZachXBT post, and no source identified in this investigation explicitly cross-references ZachXBT's October 2026 SquidSquad reference with the CertiK Skynet cluster of the same name. BlueNoroff — one of the aliases listed in that taxonomy — was itself designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) in 2019 as a North Korean government-controlled entity, alongside Lazarus Group and Andariel, over cyber-enabled financial theft.","heading":"SquidSquad in DPRK Threat-Actor Taxonomy","severity":"medium","sources":[{"credibility":2,"name":"TokenPost, reporting on CertiK's Skynet DPRK Crypto Threats Report","type":"research","url":"https://www.tokenpost.kr/research/1235"},{"credibility":2,"name":"CertiK, Skynet DPRK Crypto Threats Report (PDF)","type":"research","url":"https://indd.adobe.com/view/publication/595e40e3-3953-4d4b-aeaa-3e9954d5d844/0l76/publication-web-resources/pdf/DPRK_Crypto_Threats_Report.pdf"},{"credibility":1,"name":"U.S. Department of the Treasury, press release on DPRK cyber actor sanctions","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sm774"},{"credibility":2,"name":"CyberScoop, Lazarus Group hit with Treasury sanctions","type":"news_article","url":"https://cyberscoop.com/lazarus-group-us-treasury-sanctions-north-korea/"}]},{"content":"The sole source for the October 2026 SquidSquad/BSC claim is on-chain investigator ZachXBT. ZachXBT's prior DPRK-related attributions have in at least one major case been subsequently corroborated: following the February 2025 Bybit exploit, ZachXBT's on-chain attribution to North Korea's Lazarus Group was reportedly backed days later by the FBI, which tracks the responsible actors as TraderTraitor, per TechCrunch. In an October 2026 report covered by Decrypt, ZachXBT said he had spent weeks posing as a paying client of a Chinese laundering network he alleges has moved more than $1 billion in stolen crypto for Lazarus Group, funding an address with roughly $349,700 in USDC to gather intelligence that he says helped trigger freezes of a cluster exceeding $12 million tied to the Bybit theft, including a reported 442,000 USDT freeze by Tether. ZachXBT has also stated he has helped action more than $75 million in freezes related to DPRK-linked incidents since 2022. This history supports treating ZachXBT as an informed source on DPRK laundering patterns generally, but it does not substitute for independent verification of the specific SquidSquad/BSC claim addressed in this entry.","heading":"Source Credibility: ZachXBT's Track Record on DPRK Attributions","severity":"low","sources":[{"credibility":2,"name":"Decrypt, 'ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers'","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"credibility":1,"name":"TechCrunch, 'Researchers accuse North Korea of $1.4 billion Bybit crypto heist'","type":"news_article","url":"https://techcrunch.com/2025/02/24/researchers-accuse-north-korea-of-1-4-billion-bybit-crypto-heist"}]},{"content":"As of this writing, the allegation that a group called 'SquidSquad' stole approximately $2.84 million on BNB Smart Chain on October 8, 2026, and laundered it through Tornado Cash, a Tron bridge, and Chinese OTC intermediaries, rests entirely on a single October 21, 2026 Telegram post by ZachXBT. Searches did not locate any independent news coverage, blockchain-security firm report, exchange statement, or regulatory action corroborating this specific incident, nor any source explicitly linking this incident to the 'SquidSquad' cluster named in CertiK's separately published Skynet DPRK threat taxonomy. The post reportedly included an image (described as an address/flow chart) that was not reviewed as part of this investigation; the text of the post appears to carry the substantive allegations independently of that image. This entry should be read as documenting a credible-but-unverified allegation from a reputable on-chain investigator, not as a confirmed finding.","heading":"Corroboration Status","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT, Telegram post","type":"social_media","url":"https://t.me/zachxbt/368"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT, Telegram post","type":"social_media","url":"https://t.me/zachxbt/368"},{"credibility":2,"name":"TokenPost, reporting on CertiK's Skynet DPRK Crypto Threats Report","type":"research","url":"https://www.tokenpost.kr/research/1235"},{"credibility":2,"name":"CertiK, Skynet DPRK Crypto Threats Report (PDF)","type":"research","url":"https://indd.adobe.com/view/publication/595e40e3-3953-4d4b-aeaa-3e9954d5d844/0l76/publication-web-resources/pdf/DPRK_Crypto_Threats_Report.pdf"},{"credibility":1,"name":"U.S. Department of the Treasury, press release on DPRK cyber actor sanctions","type":"regulatory","url":"https://home.treasury.gov/news/press-releases/sm774"},{"credibility":2,"name":"CyberScoop, Lazarus Group hit with Treasury sanctions","type":"news_article","url":"https://cyberscoop.com/lazarus-group-us-treasury-sanctions-north-korea/"},{"credibility":2,"name":"Decrypt, 'ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers'","type":"news_article","url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"credibility":1,"name":"TechCrunch, 'Researchers accuse North Korea of $1.4 billion Bybit crypto heist'","type":"news_article","url":"https://techcrunch.com/2025/02/24/researchers-accuse-north-korea-of-1-4-billion-bybit-crypto-heist"}],"summary":"SquidSquad is a cluster name used in at least one industry threat-intelligence taxonomy for a DPRK-linked group that targets crypto founders and executives through venture-capital impersonation and malware. On October 21, 2026, on-chain investigator ZachXBT alleged on Telegram that a group he identifies as SquidSquad stole approximately $2.84 million from an institutional entity on BNB Smart Chain on October 8, 2026, and traced the proceeds through Tornado Cash, a Tron bridge, and addresses with prior DPRK exposure en route to Chinese OTC desks. As of this writing, that specific incident and the SquidSquad attribution for it rest on a single public source and have not been independently corroborated.","timeline":[{"date":"2019-09","event":"OFAC designates Lazarus Group, BlueNoroff (an alias later listed alongside SquidSquad in at least one cluster taxonomy), and Andariel as North Korean government-controlled entities over cyber-enabled financial theft.","source":"U.S. Department of the Treasury","source_url":"https://home.treasury.gov/news/press-releases/sm774"},{"date":"2025-02","event":"Bybit exchange is hacked for approximately $1.4 billion; ZachXBT's on-chain attribution to Lazarus Group is later said to have been backed by the FBI, which tracks the actors as TraderTraitor.","source":"TechCrunch","source_url":"https://techcrunch.com/2025/02/24/researchers-accuse-north-korea-of-1-4-billion-bybit-crypto-heist"},{"date":"2025-03-06","date_evidence":"On Mar 6, 2025, I funded a new address with 349.7K USDC on Ethereum","event":"ZachXBT begins posing as a client of an alleged Chinese laundering network, funding an address with roughly $349,700 in USDC as part of an intelligence-gathering operation into DPRK-linked laundering.","source":"Decrypt / ZachXBT","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"date":"2026-05","event":"CertiK publishes its 'Skynet' DPRK Crypto Threats Report, which includes a cluster profile for 'SquidSquad' describing VC-impersonation social engineering tactics, as later reported by TokenPost.","source":"TokenPost, citing CertiK","source_url":"https://www.tokenpost.kr/research/1235"},{"date":"2026-10","date_original":"2026-10-05","event":"ZachXBT discloses that he spent weeks posing as a client of a Chinese laundering network he alleges moved more than $1 billion in stolen crypto for Lazarus Group, as reported by Decrypt.","source":"Decrypt","source_url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers"},{"date":"2026-10-08","date_evidence":"An institutional entity is suspected to have lost ~$2.84M on BSC on October 8, 2026","event":"An institutional entity is alleged to have lost approximately $2.84 million on BNB Smart Chain, in an incident later attributed by ZachXBT to a group he calls SquidSquad.","source":"ZachXBT, Telegram","source_url":"https://t.me/zachxbt/368"},{"date":"2026-10-20","date_evidence":"deposited 1111.2 ETH into Tornado Cash on Oct 20, 2026","event":"The alleged attacker deposits 1,111.2 ETH into Tornado Cash and withdraws to three Ethereum addresses, per ZachXBT's on-chain trace.","source":"ZachXBT, Telegram","source_url":"https://t.me/zachxbt/368"},{"date":"2026-10","date_original":"2026-10-21","event":"ZachXBT publishes a Telegram post naming 'SquidSquad' as the DPRK-linked actor behind the October 8 BSC theft and detailing an alleged laundering route through Tornado Cash, a Tron bridge via USDT0, and Chinese OTC intermediaries.","source":"ZachXBT, Telegram","source_url":"https://t.me/zachxbt/368"}]},"v":1}