User Loses $282M in Social-Engineering Hack; Stolen BTC and LTC Routed to XMR via THORChain

Published: 2026-01-18 18:22:24 |

A single user lost roughly $282 million after a social‑engineering attack that exposed their hardware‑wallet seed phrase on Jan. 10, 2026 (around 23:00 UTC). The attacker drained about 1,459 BTC (~$139M) and 2.05M LTC (~$153M). Funds were rapidly moved across chains, bridged using THORChain into Ethereum, Ripple and Litecoin ecosystems, and large portions were converted into Monero (XMR) via instant exchanges. The conversion caused a brief XMR price spike. Security firm ZeroShadow reported that the attacker impersonated Trezor “Value Wallet” support and that approximately $700,000 of stolen assets were frozen before full conversion to privacy coins. Blockchain investigator ZachXBT confirmed the timeline and dismissed links to the North Korea‑linked Lazarus Group. The case highlights social‑engineering risks, the vulnerability of seed phrases, and how decentralized cross‑chain infrastructure and privacy coins can be used to obfuscate stolen funds. For traders: monitor Monero flows and liquidity, THORChain bridging activity, and on‑chain signs of large sell pressure or sudden liquidity changes in BTC, LTC and XMR; watch for regulatory or exchange responses that could affect market access to bridged funds or XMR liquidity.

Bearish

Short term: Bearish for XMR (and possibly LTC/BTC liquidity) — the rapid conversion of large BTC and LTC volumes into Monero and other bridges increased sell pressure and caused a brief XMR price spike followed by potential unwind or increased sell-side liquidity. Traders typically react by taking profits, widening spreads, or withdrawing liquidity, which can depress prices. The use of THORChain and instant exchanges to route funds also creates uncertainty and episodic liquidity shocks for bridged assets. Regulatory or exchange actions (freezes or delists) targeting addresses, bridges or privacy‑coin flows could further restrict liquidity and add downward pressure. Long term: Neutral to slightly negative for XMR — while a single large wash through XMR may not change fundamentals, repeated high‑profile laundering events could invite stricter exchange delisting, on‑chain monitoring, or tighter AML controls, reducing exchange liquidity for privacy coins over time. For BTC and LTC the direct long‑term price impact is limited given broad market depth, but reputation risks for cross‑chain bridges and seed‑phrase compromise could increase market friction and volatility around bridge activity.