THORChain Does It Again: Kraken User's $18.2M Vanishes Into the Cross-Chain Void

Blockchain investigator ZachXBT dropped a bombshell on Telegram: some unlucky Kraken user got drained for $18.2 million in what looks like a classic social engineering scam. The fun part? The stolen funds are already hopping chains like it's nobody's business—because apparently, even criminals have FOMO on yield farming across protocols.

The threat actor kicked things off by bridging 878 $ETH (roughly $1.8 million) from Ethereum to Bitcoin via THORChain, using a SafePal wallet. Because of course they did. Nothing says "I'm definitely not up to anything sketchy" like a SafePal in 2025, but hey, we're not here to judge anyone's wallet preferences.

The sketchy address on Ethereum is 0xC55149BbD560435a9FbEabFdcF9711cf928acA21, with a corresponding $BTC address of 1D8f8956EEFLXN28AHfioEx4ywVbxCz8KN. THOR InfoBot confirmed the streaming swap went live about 45 minutes before ZachXBT sounded the alarm—smooth timing by the attacker, if you can call it that. Honestly, these guys could teach project managers a thing or two about execution.

THORChain's no-KYC policy has made it the go-to laundromat for stolen crypto. Just back in January 2026, some creep pulled off a $282 million heist using the same playbook—tricked a hardware wallet user into spilling their seed phrase, then converted the haul to Monero through instant exchanges, sending $XMR prices on a little joyride. Nothing says "clean money" quite like a Monero pump funded by someone's life savings.

In that January incident, 818 $BTC (worth $78 million at the time) got swapped through THORChain into $ETH, XRP, and $LTC. ZachXBT also tracked a $330 million theft in April 2025 and an $91 million loss in August of that year—same social engineering, same cross-chain gymnastics. At this point, THORChain should just start a loyalty program for these guys.

This 878 $ETH might just be the first slice of the $18.2M pie. These guys love splitting assets across multiple transactions and chains to muddy the trail. Classic "don't put all your stolen eggs in one basket" energy.

Kraken and SafePal are keeping quiet for now. The investigation is just getting started, and on-chain trackers are watching those flagged addresses like hawks. Meanwhile, the rest of us are just here for the chain analysis and the memes.