SBI Crypto suffers $21M loss in NK-linked hack via Tornado Cash

SBI Crypto, the mining-pool subsidiary of Japan's SBI Group, lost roughly $21 million in a suspected hack on Sept. 24, 2025, blockchain investigators reported, with the stolen assets traced through several instant exchanges and ultimately deposited into Tornado Cash, a cryptocurrency mixing service. The outflows, flagged by analysts monitoring onchain activity, involved bitcoin, ether, litecoin, dogecoin and Bitcoin Cash and originated from addresses linked to the SBI Crypto operation.

Blockchain investigator ZachXBT and other onchain sleuths said the funds were moved through five instant exchanges before being routed into Tornado Cash, which obscures transaction origins. Onchain records show wallet addresses tied to SBI Crypto were systematically emptied and the proceeds funneled through laundering channels. ZachXBT noted that elements of the transfer pattern "closely resemble" tactics used in previous intrusions attributed to North Korean state cyber units, commonly known as the Lazarus Group.

SBI Group has not publicly acknowledged the incident, and as of publication the stolen funds remain unaccounted for. The suspected involvement of North Korea-linked actors follows a...