Kraken User's $18.2M Takes a Scenic Tour Through THORChain—Because KYC is Optional

Blockchain investigator ZachXBT reports yet another brutal social engineering hit—this time draining a Kraken user of $18.2 million. The threat actor immediately started bridging 878 ETH (roughly $1.8 million) from Ethereum to Bitcoin via THORChain, using a SafePal wallet in the process. Because nothing says "secure asset management" quite like watching your life savings do the cross-chain cha-slide.

ZachXBT broke the news on his Telegram channel, dropping the addresses for the curious on-chain detectives: 0xC55149BbD560435a9FbEabFdcF9711cf928acA21 on Ethereum and 1D8f8956EEFLXN28AHfioEx4ywVbxCz8KN on BTC. For those keeping score at home, these strings of characters are basically the blockchain equivalent of "seen you, not catching you."

THOR InfoBot confirmed the swap went live roughly 45 minutes before the alert hit the streets, showing 878 ETH converting to BTC through THORChain's streaming swap feature. That's right, folks—your $1.8 million went from one chain to another faster than you can say "I should have used a hardware wallet." THORChain's no-KYC policy continues to make it the go-to laundromat for misappropriated crypto. Back in January 2026, an attacker pulled off an even nastier trick—tricking a hardware wallet user into spilling their seed phrase and walking away with over $282 million in BTC and Litecoin. That attacker also used THORChain, converting 818 BTC ($78 million) into ETH, XRP, and LTC. At this point, THORChain's KYC policy is basically a "bring your own ethics" situation.

ZachXBT has also tracked a $330 million heist from April 2025 and an $91 million loss in August of that year, all following the same social engineering + cross-chain shuffle playbook. These guys aren't just stealing crypto—they're running a diversified portfolio strategy with other people's money.

The 878 ETH on-chain might just be the first slice of the $18.2M pie being sliced and diced across multiple transactions. Investigators are watching the flagged addresses for any further moves. Somewhere, a degen is refreshing Etherscan with the intensity of a day trader in 2020.

Kraken and SafePal have both stayed silent so far. Classic. Nothing like corporate silence to make victims feel truly seen.