Blockchain investigator ZachXBT reported that an unknown Kraken user lost $18.2 million in a suspected social engineering scam, with stolen funds already moving across chains.
The threat actor began bridging 878 $ETH, worth roughly $1.8 million, from Ethereum ($ETH) to Bitcoin ($BTC) through THORChain using a SafePal wallet. ZachXBT shared the details on his Telegram channel.
Another Social Engineering Victim Funneled Through THORChain
The theft address tied to the incident is 0xC55149BbD560435a9FbEabFdcF9711cf928acA21 on Ethereum, with a corresponding $BTC address of 1D8f8956EEFLXN28AHfioEx4ywVbxCz8KN.
On-chain data from the THOR InfoBot confirmed the streaming swap was initiated roughly 45 minutes before the alert went public, adding credence to ZachXBT’s claim.
🌊 New streaming swap
[ca21]: 878.0 $ETH ($1.8M) → ⚡ → $BTC
Track Tx: https://t.co/nUrnTUA3eo.
Runescan: https://t.co/E6QqxPewrJ pic.twitter.com/IJbVJRKWwX— THOR InfoBot (@THOR_InfoBot) March 31, 2026
THORChain, a decentralized cross-chain liquidity protocol, does not require KYC verification. That feature has made it a repeated tool for laundering stolen funds.
In January 2026, an attacker used the same protocol to move portions of $282 million in stolen $BTC and Litecoin ($LTC) after tricking a hardware wallet user into revealing their seed phrase.
On January 10, 2026 at around 11 pm UTC a victim lost $282M+ worth of $LTC & $BTC due to a hardware wallet social engineering scam.
The attacker began converting the stolen $LTC & $BTC to Monero via multiple instant exchanges causing the $XMR price to sharply increase.
$BTC was also…
— ZachXBT (@zachxbt) January 16, 2026
In that case, 818 $BTC worth $78 million was swapped into $ETH, XRP, and $LTC through THORChain.
The blockchain investigator also tracked a $330 million theft in 2025 and a $91 million loss in August of that year, both involving social engineering and cross-chain fund movement.
Nine hours ago a suspicious transfer was made from a potential victim for 3520 $BTC ($330.7M)
Theft address
bc1qcrypchnrdx87jnal5e5m849fw460t4gk7vz55gShortly after the funds began to be laundered via 6+ instant exchanges and was swapped for $XMR causing the $XMR price to spike…
— ZachXBT (@zachxbt) April 28, 2025
The 878 $ETH visible on-chain may represent only one tranche of the $18.2 million total being moved. Attackers in prior cases frequently split stolen assets across multiple transactions and chains simultaneously.
Neither Kraken nor SafePal has publicly commented on the incident at the time of writing.
The investigation remains in its early stages as on-chain trackers monitor further fund movements from the flagged addresses.